diff --git a/roles/base/templates/iptables/iptables.kojibuilder b/roles/base/templates/iptables/iptables.kojibuilder
index 433f911a6e..a24963309a 100644
--- a/roles/base/templates/iptables/iptables.kojibuilder
+++ b/roles/base/templates/iptables/iptables.kojibuilder
@@ -30,6 +30,9 @@
 # kojipkgs
 -A OUTPUT -p tcp -m tcp -d 10.5.125.36 --dport 80 -j ACCEPT
 -A OUTPUT -p tcp -m tcp -d 10.5.125.36 --dport 443 -j ACCEPT
+{% if host in groups['buildvm-s390x'] %}
+-A OUTPUT -p tcp -m tcp -d 10.16.0.17 --dport 80 -j ACCEPT
+{% endif %}
 
 #koji.fp.o
 -A OUTPUT -p tcp -m tcp -d 10.5.125.63 --dport 80 -j ACCEPT
diff --git a/roles/koji_builder/templates/kojid.conf b/roles/koji_builder/templates/kojid.conf
index e1594b932f..fa4a362d44 100644
--- a/roles/koji_builder/templates/kojid.conf
+++ b/roles/koji_builder/templates/kojid.conf
@@ -18,7 +18,10 @@ rpmbuild_timeout=172800
 
 use_createrepo_c=True
 
-{% if koji_topurl == 'https://kojipkgs.fedoraproject.org/' %}
+{% if host in groups['buildvm-s390x'] %}
+# s390x builders use a local varnish cache
+topurl = http://kojipkgs-cache01.s390.fedoraproject.org https://kojipkgs01.fedoraproject.org https://kojipkgs02.fedoraproject.org
+{% elif koji_topurl == 'https://kojipkgs.fedoraproject.org/' %}
 ; add some additional urls for failover
 topurl = {{koji_topurl}} https://kojipkgs01.fedoraproject.org https://kojipkgs02.fedoraproject.org
 {% else %}