diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 42a419ffe..2ac6b6943 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -59,7 +59,7 @@ jobs:
             # Full suite: all OSes
             echo 'package_os_matrix=["fedora-43","fedora-44","fedora-45","centos-9","centos-10"]' >> "$GITHUB_OUTPUT"
             echo 'integration_os_matrix=["fedora-43","fedora-44","centos-9","centos-10"]' >> "$GITHUB_OUTPUT"
-            echo 'upgrade_os_matrix=["fedora-43","centos-10"]' >> "$GITHUB_OUTPUT"
+            echo 'upgrade_os_matrix=["fedora-44","centos-10"]' >> "$GITHUB_OUTPUT"
             echo 'run_heavy=true' >> "$GITHUB_OUTPUT"
           elif echo "$LABELS" | jq -e 'index("ci/tier-1")' > /dev/null; then
             # Tier-1 only: centos-10
diff --git a/crates/initramfs/dracut/module-setup.sh b/crates/initramfs/dracut/module-setup.sh
index 2e5187dfd..5250dffd3 100755
--- a/crates/initramfs/dracut/module-setup.sh
+++ b/crates/initramfs/dracut/module-setup.sh
@@ -14,7 +14,7 @@ install() {
     local service=bootc-root-setup.service
     dracut_install /usr/lib/bootc/initramfs-setup
     inst_simple "${systemdsystemunitdir}/${service}"
-    mkdir -p "${initdir}${systemdsystemconfdir}/initrd-root-fs.target.wants"
+    mkdir -p "${initdir}${systemdsystemunitdir}/initrd-root-fs.target.wants"
     ln_r "${systemdsystemunitdir}/${service}" \
-        "${systemdsystemconfdir}/initrd-root-fs.target.wants/${service}"
+        "${systemdsystemunitdir}/initrd-root-fs.target.wants/${service}"
 }
diff --git a/hack/provision-fetch.sh b/hack/provision-fetch.sh
index fb73b8695..35f6e8817 100755
--- a/hack/provision-fetch.sh
+++ b/hack/provision-fetch.sh
@@ -137,6 +137,44 @@ if ! rpm -q ostree 2>/dev/null | grep -q "2026\." ; then
     esac
 fi
 
+# Temporary: downgrade kernel to last 6.x when 7.0 or 7.1 is present.
+# Kernel 7.x broke composefs ("has no fs-verity digest"), fixed in 7.2.
+# xref https://github.com/bootc-dev/bootc/issues/2174
+# TODO: Remove once all base images ship kernel >= 7.2
+kernel_ver=$(rpm -q --qf '%{VERSION}' kernel 2>/dev/null || true)
+case "${kernel_ver}" in
+    7.0.*|7.1.*)
+        arch=$(uname -m)
+        koji_kver="6.19.10"
+        koji_krel="300.fc44"
+        koji_base="https://kojipkgs.fedoraproject.org/packages/kernel/${koji_kver}/${koji_krel}/${arch}"
+        kernel_td=$(mktemp -d)
+        trap 'rm -rf "${kernel_td}"' EXIT
+        for pkg in kernel kernel-core kernel-modules kernel-modules-core; do
+            curl --retry 5 --retry-delay 5 --retry-all-errors -fL \
+                "${koji_base}/${pkg}-${koji_kver}-${koji_krel}.${arch}.rpm" \
+                -o "${kernel_td}/${pkg}.rpm"
+        done
+        # Skip scriptlets: kernel-core's posttrans runs `kernel-install add`
+        # which calls rpm-ostree, and that fails inside a container build.
+        # We manually run depmod afterward since it's the only useful
+        # scriptlet the kernel packages would otherwise execute.
+        dnf -y install --allowerasing --setopt=tsflags=noscripts "${kernel_td}"/*.rpm
+        /sbin/depmod -a "${koji_kver}-${koji_krel}.$(uname -m)"
+        # Remove any leftover module directories for the old kernel (e.g.
+        # initramfs.img generated by the base image build is not RPM-owned
+        # so dnf does not clean it up).
+        for old_kmod_dir in /usr/lib/modules/*; do
+            kd_ver=$(basename "${old_kmod_dir}")
+            if [[ "${kd_ver}" != "${koji_kver}-"* ]]; then
+                rm -rf "${old_kmod_dir}"
+            fi
+        done
+        rm -rf "${kernel_td}"
+        trap - EXIT
+        ;;
+esac
+
 dnf clean all
 # Clean logs and caches
 rm /var/log/* /var/cache /var/lib/{dnf,rpm-state,rhsm} -rf
diff --git a/tmt/tests/Dockerfile.upgrade-source b/tmt/tests/Dockerfile.upgrade-source
index 5a3c2c8d1..8cc50eaa2 100644
--- a/tmt/tests/Dockerfile.upgrade-source
+++ b/tmt/tests/Dockerfile.upgrade-source
@@ -40,6 +40,16 @@ if [[ "${variant}" == composefs* ]]; then
     echo 'add_dracutmodules+=" bootc "' > /etc/dracut.conf.d/50-bootc-composefs.conf
     kver=$(cd /usr/lib/modules && echo *)
     dracut --force --kver "$kver" "/usr/lib/modules/$kver/initramfs.img"
+else
+    . /usr/lib/os-release
+
+    if [[ $ID == "fedora" && $VERSION_ID == "44" ]]; then
+        # We skip kernel postinstall in "provision-fetch" which would've generated
+        # the initrd, so we do it ourselves here
+        kver=$(cd /usr/lib/modules && echo *)
+        dracut --force --kver "$kver" "/usr/lib/modules/$kver/initramfs.img"
+    fi
 fi
+
 rm -rf /run/provision
 EORUN