diff --git a/inventory/host_vars/openqa-p09-worker01.iad2.fedoraproject.org b/inventory/host_vars/openqa-p09-worker01.iad2.fedoraproject.org
new file mode 100644
index 0000000000..e566c72415
--- /dev/null
+++ b/inventory/host_vars/openqa-p09-worker01.iad2.fedoraproject.org
@@ -0,0 +1,42 @@
+---
+freezes: false
+# eth0 is default network
+# eth1 is disabled/nothing
+# eth2 is disabled/nothing
+ansible_ifcfg_infra_net_devices: ['eth0']
+gw: 10.3.174.254
+dns: 10.3.163.33
+eth0_ip: 10.3.174.42
+eth0_nm: 255.255.255.0
+datacenter: iad2
+fas_client_groups: sysadmin-qa,sysadmin-main,sysadmin-noc,fi-apprentice,sysadmin-veteran
+nrpe_procs_warn: 250
+nrpe_procs_crit: 300
+
+sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
+
+# openQA tap worker hosts (like this one) do stuff with ifcfg that base
+# doesn't understand. terrible, terrible stuff. seriously - it doesn't
+# handle the openvswitch config well. so let's tell it to just configure
+# the regular interfaces (which on this system is eth0-eth2) for us,
+# disabling all but the one we want to use (eth0), and leave everything
+# else alone. We use a variable definition here so the firewall config
+# (in the openqa_tap_workers group_vars) can reuse it.
+openqa_tap_iface: eth0
+ansible_ifcfg_allowlist: ['eth0', '{{ openqa_tap_iface }}', 'eth2']
+ansible_ifcfg_disabled: ['eth1', 'eth2']
+
+# this is an IAD box, use IAD host
+openqa_hostname: openqa-stg01.iad2.fedoraproject.org
+
+# this is a powerful machine, can handle more openQA workers
+openqa_workers: 8
+# firewall ports for server->worker websockets connections
+# this port is 'QEMUPORT plus 1'
+# QEMUPORT is:
+# $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002;
+# so for worker 1 it's 20012, for worker 2 it's 20022, etc etc
+tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083']
+
+# has an HW RNG, so let's have rngd
+openqa_rngd: True