diff --git a/Makefile-tests.am b/Makefile-tests.am
index c87893ee28..1ad660bf42 100644
--- a/Makefile-tests.am
+++ b/Makefile-tests.am
@@ -107,6 +107,7 @@ _installed_or_uninstalled_test_scripts = \
 	tests/test-admin-deploy-nomerge.sh \
 	tests/test-admin-deploy-none.sh \
 	tests/test-admin-deploy-bootid-gc.sh \
+	tests/test-admin-deploy-whiteouts.sh \
 	tests/test-osupdate-dtb.sh \
 	tests/test-admin-instutil-set-kargs.sh \
 	tests/test-admin-upgrade-not-backwards.sh \
diff --git a/tests/basic-test.sh b/tests/basic-test.sh
index 67d57ddac2..30a0ff5312 100644
--- a/tests/basic-test.sh
+++ b/tests/basic-test.sh
@@ -19,7 +19,7 @@
 
 set -euo pipefail
 
-echo "1..$((88 + ${extra_basic_tests:-0}))"
+echo "1..$((90 + ${extra_basic_tests:-0}))"
 
 CHECKOUT_U_ARG=""
 CHECKOUT_H_ARGS="-H"
@@ -1203,3 +1203,26 @@ if test "$(id -u)" != "0"; then
 else
     echo "ok # SKIP not run when root"
 fi
+
+cd ${test_tmpdir}
+rm checkout-test2 -rf
+$OSTREE checkout test2 checkout-test2
+
+assert_not_has_file checkout-test2/whiteouts/whiteout
+assert_not_has_file checkout-test2/whiteouts/whiteout2
+assert_has_file checkout-test2/whiteouts/.ostree-wh.whiteout
+assert_has_file checkout-test2/whiteouts/.ostree-wh.whiteout2
+
+echo "ok checkout: no whiteout passthrough by default"
+
+cd ${test_tmpdir}
+rm checkout-test2 -rf
+$OSTREE checkout --process-passthrough-whiteouts test2 checkout-test2
+
+assert_not_has_file checkout-test2/whiteouts/.ostree-wh.whiteout
+assert_not_has_file checkout-test2/whiteouts/.ostree-wh.whiteout2
+
+assert_is_whiteout_device checkout-test2/whiteouts/whiteout
+assert_is_whiteout_device checkout-test2/whiteouts/whiteout2
+
+echo "ok checkout: whiteout with overlayfs passthrough processing"
\ No newline at end of file
diff --git a/tests/kolainst/data-shared/libtest-core.sh b/tests/kolainst/data-shared/libtest-core.sh
index d10aac1c94..3465fb9ba0 100644
--- a/tests/kolainst/data-shared/libtest-core.sh
+++ b/tests/kolainst/data-shared/libtest-core.sh
@@ -163,6 +163,13 @@ assert_file_has_mode () {
     fi
 }
 
+assert_is_whiteout_device () {
+    device_details="$(stat -c '%F %t:%T' $1)"
+    if [ "$device_details" != "character special file 0:0" ]; then
+        fatal "File '$1' is not a whiteout character device 0:0"
+    fi
+}
+
 assert_symlink_has_content () {
     if ! test -L "$1"; then
         fatal "File '$1' is not a symbolic link"
diff --git a/tests/libtest.sh b/tests/libtest.sh
index 686f08dcb4..a34f97c076 100755
--- a/tests/libtest.sh
+++ b/tests/libtest.sh
@@ -245,6 +245,12 @@ setup_test_repository () {
     ln -s nonexistent baz/alink
     mkdir baz/another/
     echo x > baz/another/y
+
+    mkdir whiteouts
+    touch whiteouts/.ostree-wh.whiteout
+    touch whiteouts/.ostree-wh.whiteout2
+    chmod 755 whiteouts/.ostree-wh.whiteout2
+
     umask "${oldumask}"
 
     cd ${test_tmpdir}/files
@@ -406,7 +412,7 @@ setup_os_repository () {
     mkdir osdata
     cd osdata
     kver=3.6.0
-    mkdir -p usr/bin ${bootdir} usr/lib/modules/${kver} usr/share usr/etc
+    mkdir -p usr/bin ${bootdir} usr/lib/modules/${kver} usr/share usr/etc usr/container/layers/abcd
     kernel_path=${bootdir}/vmlinuz
     initramfs_path=${bootdir}/initramfs.img
     # the HMAC file is only in /usr/lib/modules
@@ -449,6 +455,13 @@ EOF
     mkdir -p usr/etc/testdirectory
     echo "a default daemon file" > usr/etc/testdirectory/test
 
+    # overlayfs whiteout passhthrough marker file
+    touch usr/container/layers/abcd/.ostree-wh.whiteout
+    chmod 400 usr/container/layers/abcd/.ostree-wh.whiteout
+
+    # overlayfs whiteout passhthrough marker file
+    touch usr/container/layers/abcd/.ostree-wh.whiteout2
+    chmod 777 usr/container/layers/abcd/.ostree-wh.whiteout2
     ${CMD_PREFIX} ostree --repo=${test_tmpdir}/testos-repo commit ${bootable_flag} --add-metadata-string version=1.0.9 -b testos/buildmain/x86_64-runtime -s "Build"
 
     # Ensure these commits have distinct second timestamps
diff --git a/tests/test-admin-deploy-whiteouts.sh b/tests/test-admin-deploy-whiteouts.sh
new file mode 100755
index 0000000000..44399600f7
--- /dev/null
+++ b/tests/test-admin-deploy-whiteouts.sh
@@ -0,0 +1,40 @@
+#!/bin/bash
+#
+# Copyright (C) 2020 Red Hat, Inc.
+#
+# SPDX-License-Identifier: LGPL-2.0+
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library. If not, see <https://www.gnu.org/licenses/>.
+
+set -euox pipefail
+
+. $(dirname $0)/libtest.sh
+
+# Exports OSTREE_SYSROOT so --sysroot not needed.
+setup_os_repository "archive" "syslinux"
+${CMD_PREFIX} ostree --repo=sysroot/ostree/repo pull-local --remote=testos testos-repo testos/buildmain/x86_64-runtime
+
+echo "1..3"
+${CMD_PREFIX} ostree admin deploy --os=testos --karg=root=LABEL=foo --karg=testkarg=1 testos:testos/buildmain/x86_64-runtime
+origdeployment=$(${CMD_PREFIX} ostree admin --sysroot=sysroot --print-current-dir)
+
+assert_is_whiteout_device "${origdeployment}"/usr/container/layers/abcd/whiteout
+echo "ok whiteout deployment"
+
+assert_not_has_file  "${origdeployment}"/usr/container/layers/abcd/.ostree-wh.whiteout
+echo "ok .ostree-wh.whiteout not created"
+
+assert_file_has_mode "${origdeployment}"/usr/container/layers/abcd/whiteout 400
+assert_file_has_mode "${origdeployment}"/usr/container/layers/abcd/whiteout2 777
+echo "ok whiteout permissions are preserved"