diff --git a/.packit.yaml b/.packit.yaml
index be29c80..016ea0c 100644
--- a/.packit.yaml
+++ b/.packit.yaml
@@ -9,10 +9,12 @@ jobs:
     skip_build: true
     enable_net: true
     targets:
-      # TODO: Replace these three with fedora-all-x86_64 once Fedora 38 is gone.
-      - fedora-rawhide-x86_64
-      - fedora-40-x86_64
-      - fedora-39-x86_64
+      - fedora-stable-x86_64
+      # TODO: Looks like we need Armv8.3-A CPUs for nested virt, and QEMU and
+      # kernel support is also very recent. Testing Farm is using AWS Graviton3,
+      # which is ARMv8.4-A, so hopefully things work once the software stack
+      # catches up and we can enable this.
+      # - fedora-stable-aarch64
     identifier: docker
     tmt_plan: /tests/docker
 
diff --git a/tests/env.sh b/tests/env.sh
index c5db4e7..e03e850 100755
--- a/tests/env.sh
+++ b/tests/env.sh
@@ -124,6 +124,15 @@ trap '__extra_cleanup; rm -fr "$temp_dir"' EXIT
 
 export RUST_BACKTRACE=1 RUST_LIB_BACKTRACE=1
 
+arch=$( uname -m )
+case "$arch" in
+x86_64|aarch64)
+    ;;
+*)
+    >&2 echo "Unsupported arch \"$arch\""
+    ;;
+esac
+
 case "${1:-}" in
 build)
     if (( $# != 1 )); then
@@ -136,6 +145,15 @@ build)
 
     # build disk image
 
+    case "$arch" in
+    x86_64)
+        qemu_system_pkg=qemu-system-x86-core
+        ;;
+    aarch64)
+        qemu_system_pkg=qemu-system-aarch64-core
+        ;;
+    esac
+
     packages=(
         bash
         cloud-init
@@ -154,7 +172,7 @@ build)
         openssh-clients
         podman
         qemu-img
-        qemu-system-x86-core
+        "$qemu_system_pkg"
         shadow-utils
         util-linux
         virtiofsd
@@ -165,14 +183,22 @@ build)
 
     daemon_json='{ "runtimes": { "crun-vm": { "path": "/home/fedora/bin/crun-vm" } } }'
 
-    commands=(
+    virt_builder_args=(
         # generate an ssh keypair for users fedora and root so crun-vm
         # containers get a predictable keypair
-        'ssh-keygen -q -f /root/.ssh/id_rsa -N ""'
+        --run-command='ssh-keygen -q -f /root/.ssh/id_rsa -N ""'
 
-        "mkdir -p /etc/docker && echo ${daemon_json@Q} > /etc/docker/daemon.json"
+        --run-command="mkdir -p /etc/docker && echo ${daemon_json@Q} > /etc/docker/daemon.json"
     )
 
+    if [[ "$arch" == aarch64 ]]; then
+        # enable nested virtualization
+        virt_builder_args+=(
+            --append-line '/etc/default/grub:GRUB_CMDLINE_LINUX_DEFAULT="kvm-arm.mode=nested"'
+            --run-command 'grub2-mkconfig -o /boot/grub2/grub.cfg'
+        )
+    fi
+
     __log_and_run virt-builder \
         "fedora-${CRUN_VM_TEST_ENV_FEDORA_VERSION:-40}" \
         --smp "$( nproc )" \
@@ -182,7 +208,7 @@ build)
         --size 50G \
         --root-password password:root \
         --install "$packages_joined" \
-        "${commands[@]/#/--run-command=}"
+        "${virt_builder_args[@]}"
 
     # reduce image file size
 
@@ -232,6 +258,10 @@ start)
         __log_and_run podman exec "$container_name" --as fedora "$@"
     }
 
+    # ensure nested hardware-accelerated virt is supported
+
+    __exec '[[ -e /dev/kvm ]] || { sudo dmesg; exit 1; }'
+
     chmod a+rx "$temp_dir"  # so user "fedora" in guest can access it
 
     __exec sudo cp /root/.ssh/id_rsa /root/.ssh/id_rsa.pub .ssh/