diff --git a/playbooks/groups/openqa.yml b/playbooks/groups/openqa.yml
index 333c89eacc..5e42fd646b 100644
--- a/playbooks/groups/openqa.yml
+++ b/playbooks/groups/openqa.yml
@@ -47,6 +47,7 @@
    - { role: fedmsg/base, tags: ['fedmsg_base', 'fedmsg'] }
    - { role: fedmsg/relay, tags: ['fedmsg_relay', 'fedmsg'] }
    - { role: fedmsg/hub, tags: ['fedmsg_hub', 'fedmsg'] }
+   - { role: openqa/fixes, tags: ['openqa_fixes'] }
 
   handlers:
    - include: "{{ handlers }}/restart_services.yml"
diff --git a/roles/openqa/fixes/tasks/main.yml b/roles/openqa/fixes/tasks/main.yml
new file mode 100644
index 0000000000..aa1902e36b
--- /dev/null
+++ b/roles/openqa/fixes/tasks/main.yml
@@ -0,0 +1,14 @@
+# This file contains some temporary fixes for the fedmsg config on openQA
+# hosts, since the roles still aren't quite right for firewalled systems.
+
+- name: remove internal message source policy
+  file: path=/etc/fedmsg.d/policy.py state=absent
+
+- name: use packaged relay.py, not ansible one (which doesn't work)
+  command: cp /etc/fedmsg.d/relay.py.rpmnew /etc/fedmsg.d/relay.py
+
+- name: restart fedmsg services
+  service: name={{ item }} state=restarted
+  with_items:
+  - fedmsg-hub
+  - fedmsg-relay