diff --git a/docs/kola/external-tests.md b/docs/kola/external-tests.md
index 0d94f3d0a3..7dc2e72fb5 100644
--- a/docs/kola/external-tests.md
+++ b/docs/kola/external-tests.md
@@ -264,6 +264,12 @@ is simple and is not expected to conflict with other tests, it should be marked
 `exclusive: false`. When the `exclusive` key is not provided, tests are marked
 `exclusive: true` by default.
 
+The `isolation` key can take two values: `readonly` and `dynamicuser`.  These
+are thin wrappers for the equivalent systemd options; `readonly` equals `ProtectSystem=strict`,
+and `dynamicuser` means `DynamicUser=yes`.  Setting either of these options
+also implies `exclusive: false`.  Use these for tests that are mostly about
+read-only system inspection.
+
 The `conflicts` key takes a list of test names that conflict with this test.
 This key can only be specified if `exclusive` is marked `false` since
 `exclusive: true` tests are run exclusively in their own VM.  At runtime,
diff --git a/mantle/kola/harness.go b/mantle/kola/harness.go
index 2894a4da07..56906dc09c 100644
--- a/mantle/kola/harness.go
+++ b/mantle/kola/harness.go
@@ -826,6 +826,7 @@ type externalTestMeta struct {
 	AppendKernelArgs          string   `json:"appendKernelArgs,omitempty"`
 	AppendFirstbootKernelArgs string   `json:"appendFirstbootKernelArgs,omitempty"`
 	Exclusive                 bool     `json:"exclusive"`
+	Isolation                 string   `json:"isolation"`
 	TimeoutMin                int      `json:"timeoutMin"`
 	Conflicts                 []string `json:"conflicts"`
 	AllowConfigWarnings       bool     `json:"allowConfigWarnings"`
@@ -952,6 +953,16 @@ func registerExternalTest(testname, executable, dependencydir string, userdata *
 		return errors.Wrapf(err, "Parsing config.ign")
 	}
 
+	switch targetMeta.Isolation {
+	case "readonly":
+	case "dynamicuser":
+		targetMeta.Exclusive = false
+	case "":
+		break
+	default:
+		return fmt.Errorf("test %v specifies unknown isolation=%v", testname, targetMeta.Isolation)
+	}
+
 	// Services that are exclusive will be marked by a 0 at the end of the name
 	num := 0
 	unitName := fmt.Sprintf("%s.service", KoletExtTestUnit)
@@ -980,6 +991,16 @@ Environment=KOLA_TEST_EXE=%s
 Environment=%s=%s
 ExecStart=%s
 `, unitName, testname, base, kolaExtBinDataEnv, destDataDir, remotepath)
+	switch targetMeta.Isolation {
+	case "readonly":
+		unit += "ProtectSystem=strict\nPrivateTmp=yes\n"
+	case "dynamicuser":
+		unit += "DynamicUser=yes\n"
+	case "":
+		break
+	default:
+		return fmt.Errorf("test %v specifies unknown isolation=%v", testname, targetMeta.Isolation)
+	}
 	if targetMeta.InjectContainer {
 		if CosaBuild == nil {
 			return fmt.Errorf("test %v uses injectContainer, but no cosa build found", testname)
diff --git a/tests/kola-ci-self/tests/kola/exclusive-readonly b/tests/kola-ci-self/tests/kola/exclusive-readonly
new file mode 100755
index 0000000000..ec97514cb5
--- /dev/null
+++ b/tests/kola-ci-self/tests/kola/exclusive-readonly
@@ -0,0 +1,7 @@
+#!/bin/bash
+# kola: { "isolation": "dynamicuser" }
+set -xeuo pipefail
+
+id=$(id -u)
+test "$id" '!=' 0
+echo "ok dynamicuser"