diff --git a/inventory/host_vars/openqa-aarch64-01.arm.fedoraproject.org b/inventory/host_vars/openqa-aarch64-01.arm.fedoraproject.org
new file mode 100644
index 0000000000..a97ad957ff
--- /dev/null
+++ b/inventory/host_vars/openqa-aarch64-01.arm.fedoraproject.org
@@ -0,0 +1,34 @@
+---
+freezes: false
+# the if connected to the infra network on this box is eth2, not eth0
+gw: 10.5.78.254
+dns: 10.5.126.21
+eth0_ip: 10.5.78.6
+eth0_nm: 255.255.255.0
+datacenter: phx2
+fas_client_groups: sysadmin-qa,sysadmin-main,sysadmin-noc,fi-apprentice,sysadmin-veteran
+nrpe_procs_warn: 250
+nrpe_procs_crit: 300
+
+sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
+
+# openQA tap worker hosts (like this one) do stuff with ifcfg that base
+# doesn't understand. terrible, terrible stuff. seriously - it doesn't
+# handle the openvswitch config well. so let's tell it to just configure
+# the regular interfaces (which on this system is eth0-eth3) for us,
+# disabling all but the one we want to use (eth2), and leave everything
+# else alone.
+ansible_ifcfg_whitelist: ['eth0', 'eth1', 'eth2', 'eth3']
+ansible_ifcfg_disabled: ['eth2', 'eth1', 'eth3']
+
+# this is a powerful machine, can handle more openQA workers
+openqa_workers: 8
+# firewall ports for server->worker websockets connections
+# this port is 'QEMUPORT plus 1'
+# QEMUPORT is:
+# $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002;
+# so for worker 1 it's 20012, for worker 2 it's 20022, etc etc
+tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083']
+
+# has an HW RNG, so let's have rngd
+openqa_rngd: True
diff --git a/inventory/host_vars/openqa-aarch64-01.qa.fedoraproject.org b/inventory/host_vars/openqa-aarch64-01.qa.fedoraproject.org
deleted file mode 100644
index 7d9ba64fdc..0000000000
--- a/inventory/host_vars/openqa-aarch64-01.qa.fedoraproject.org
+++ /dev/null
@@ -1,18 +0,0 @@
----
-
-eth0_ip: 10.5.78.75
-gw: 10.5.78.254
-nm: 255.255.255.0
-dns: 10.5.126.21
-
-datacenter: phx2
-fas_client_groups: sysadmin-qa,sysadmin-main,sysadmin-noc,fi-apprentice,sysadmin-veteran,sysadmin-secondary
-nrpe_procs_warn: 250
-nrpe_procs_crit: 300
-
-sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
-
-openqa_workers: 3
-
-# has an HW RNG, so let's have rngd
-openqa_rngd: True
diff --git a/inventory/host_vars/openqa-aarch64-02.arm.fedoraproject.org b/inventory/host_vars/openqa-aarch64-02.arm.fedoraproject.org
new file mode 100644
index 0000000000..d25a6dd593
--- /dev/null
+++ b/inventory/host_vars/openqa-aarch64-02.arm.fedoraproject.org
@@ -0,0 +1,34 @@
+---
+freezes: false
+# the if connected to the infra network on this box is eth2, not eth0
+gw: 10.5.78.254
+dns: 10.5.126.21
+eth0_ip: 10.5.78.7
+eth0_nm: 255.255.255.0
+datacenter: phx2
+fas_client_groups: sysadmin-qa,sysadmin-main,sysadmin-noc,fi-apprentice,sysadmin-veteran
+nrpe_procs_warn: 250
+nrpe_procs_crit: 300
+
+sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
+
+# openQA tap worker hosts (like this one) do stuff with ifcfg that base
+# doesn't understand. terrible, terrible stuff. seriously - it doesn't
+# handle the openvswitch config well. so let's tell it to just configure
+# the regular interfaces (which on this system is eth0-eth3) for us,
+# disabling all but the one we want to use (eth2), and leave everything
+# else alone.
+ansible_ifcfg_whitelist: ['eth0', 'eth1', 'eth2', 'eth3']
+ansible_ifcfg_disabled: ['eth2', 'eth1', 'eth3']
+
+# this is a powerful machine, can handle more openQA workers
+openqa_workers: 8
+# firewall ports for server->worker websockets connections
+# this port is 'QEMUPORT plus 1'
+# QEMUPORT is:
+# $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002;
+# so for worker 1 it's 20012, for worker 2 it's 20022, etc etc
+tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083']
+
+# has an HW RNG, so let's have rngd
+openqa_rngd: True
diff --git a/inventory/host_vars/openqa-aarch64-02.qa.fedoraproject.org b/inventory/host_vars/openqa-aarch64-02.qa.fedoraproject.org
deleted file mode 100644
index 37db504733..0000000000
--- a/inventory/host_vars/openqa-aarch64-02.qa.fedoraproject.org
+++ /dev/null
@@ -1,25 +0,0 @@
----
-
-eth0_ip: 10.5.78.155
-gw: 10.5.78.254
-nm: 255.255.255.0
-dns: 10.5.126.21
-
-datacenter: phx2
-fas_client_groups: sysadmin-qa,sysadmin-main,sysadmin-noc,fi-apprentice,sysadmin-veteran,sysadmin-secondary
-nrpe_procs_warn: 250
-nrpe_procs_crit: 300
-
-sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
-
-# openQA tap worker hosts (like this one) do stuff with ifcfg that base
-# doesn't understand. terrible, terrible stuff. seriously - it doesn't
-# handle the openvswitch config well. so let's tell it to just configure
-# the actual connected interface (which on this system is eth0) for us
-# and leave everything else alone.
-ansible_ifcfg_whitelist: ['eth0']
-
-openqa_workers: 3
-
-# has an HW RNG, so let's have rngd
-openqa_rngd: True
diff --git a/inventory/host_vars/openqa-aarch64-03.arm.fedoraproject.org b/inventory/host_vars/openqa-aarch64-03.arm.fedoraproject.org
new file mode 100644
index 0000000000..e975379971
--- /dev/null
+++ b/inventory/host_vars/openqa-aarch64-03.arm.fedoraproject.org
@@ -0,0 +1,34 @@
+---
+freezes: false
+# the if connected to the infra network on this box is eth2, not eth0
+gw: 10.5.78.254
+dns: 10.5.126.21
+eth0_ip: 10.5.78.8
+eth0_nm: 255.255.255.0
+datacenter: phx2
+fas_client_groups: sysadmin-qa,sysadmin-main,sysadmin-noc,fi-apprentice,sysadmin-veteran
+nrpe_procs_warn: 250
+nrpe_procs_crit: 300
+
+sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
+
+# openQA tap worker hosts (like this one) do stuff with ifcfg that base
+# doesn't understand. terrible, terrible stuff. seriously - it doesn't
+# handle the openvswitch config well. so let's tell it to just configure
+# the regular interfaces (which on this system is eth0-eth3) for us,
+# disabling all but the one we want to use (eth2), and leave everything
+# else alone.
+ansible_ifcfg_whitelist: ['eth0', 'eth1', 'eth2', 'eth3']
+ansible_ifcfg_disabled: ['eth2', 'eth1', 'eth3']
+
+# this is a powerful machine, can handle more openQA workers
+openqa_workers: 8
+# firewall ports for server->worker websockets connections
+# this port is 'QEMUPORT plus 1'
+# QEMUPORT is:
+# $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002;
+# so for worker 1 it's 20012, for worker 2 it's 20022, etc etc
+tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083']
+
+# has an HW RNG, so let's have rngd
+openqa_rngd: True
diff --git a/inventory/host_vars/openqa-aarch64-04.arm.fedoraproject.org b/inventory/host_vars/openqa-aarch64-04.arm.fedoraproject.org
new file mode 100644
index 0000000000..df49f004e9
--- /dev/null
+++ b/inventory/host_vars/openqa-aarch64-04.arm.fedoraproject.org
@@ -0,0 +1,34 @@
+---
+freezes: false
+# the if connected to the infra network on this box is eth2, not eth0
+gw: 10.5.78.254
+dns: 10.5.126.21
+eth0_ip: 10.5.78.9
+eth0_nm: 255.255.255.0
+datacenter: phx2
+fas_client_groups: sysadmin-qa,sysadmin-main,sysadmin-noc,fi-apprentice,sysadmin-veteran
+nrpe_procs_warn: 250
+nrpe_procs_crit: 300
+
+sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
+
+# openQA tap worker hosts (like this one) do stuff with ifcfg that base
+# doesn't understand. terrible, terrible stuff. seriously - it doesn't
+# handle the openvswitch config well. so let's tell it to just configure
+# the regular interfaces (which on this system is eth0-eth3) for us,
+# disabling all but the one we want to use (eth2), and leave everything
+# else alone.
+ansible_ifcfg_whitelist: ['eth0', 'eth1', 'eth2', 'eth3']
+ansible_ifcfg_disabled: ['eth2', 'eth1', 'eth3']
+
+# this is a powerful machine, can handle more openQA workers
+openqa_workers: 8
+# firewall ports for server->worker websockets connections
+# this port is 'QEMUPORT plus 1'
+# QEMUPORT is:
+# $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002;
+# so for worker 1 it's 20012, for worker 2 it's 20022, etc etc
+tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083']
+
+# has an HW RNG, so let's have rngd
+openqa_rngd: True