diff --git a/playbooks/buildset-registry/pre-test.yaml b/playbooks/buildset-registry/pre-test.yaml
new file mode 100644
index 0000000..05d45d9
--- /dev/null
+++ b/playbooks/buildset-registry/pre-test.yaml
@@ -0,0 +1,34 @@
+- hosts: all
+  tasks:
+    - name: Install docker
+      include_role:
+        name: install-docker
+    - name: Open the IPv4 port for the buildset registry
+      become: true
+      iptables:
+        action: insert
+        chain: openstack-INPUT
+        destination_port: '5000:5001'
+        jump: ACCEPT
+        match: tcp
+        ctstate: NEW
+        protocol: tcp
+        ip_version: ipv4
+    - name: Open the IPv6 port for the buildset registry
+      become: true
+      iptables:
+        action: insert
+        chain: openstack-INPUT
+        destination_port: '5000:5001'
+        jump: ACCEPT
+        match: tcp
+        ctstate: NEW
+        protocol: tcp
+        ip_version: ipv6
+    - name: Run buildset registry (if not already running)
+      when: buildset_registry is not defined
+      include_role:
+        name: run-buildset-registry
+    - name: Use buildset registry
+      include_role:
+        name: use-buildset-registry
diff --git a/playbooks/docker-image/pre.yaml b/playbooks/docker-image/pre.yaml
new file mode 100644
index 0000000..4d952ed
--- /dev/null
+++ b/playbooks/docker-image/pre.yaml
@@ -0,0 +1,3 @@
+- hosts: localhost
+  roles:
+    - pull-from-intermediate-registry
diff --git a/zuul.d/jobs.yaml b/zuul.d/jobs.yaml
index 72e0cbf..50321c7 100644
--- a/zuul.d/jobs.yaml
+++ b/zuul.d/jobs.yaml
@@ -142,6 +142,60 @@
           +v5Gg5Wb07OWvBjg0jcL9IvNwQXgWh39y4uq4TmKcYXHL6RnICtN5Hp4Gc7xDxNvp2+uC
           Na/OOailVlvkWMcpO/l77/qFtNXoRxFTDWYqp5rE3fGmdq09hCiflFWgMMre08=
 
+- job:
+    name: opendev-buildset-registry-test
+    description: |
+      Starts a buildset registry which interacts with the intermediate
+      CI registry to share speculative container images between
+      projects.
+
+      Configure any jobs which require the use of a buildset registry
+      to depend on this job using the "dependencies" job attribute.
+
+      This job will pause after starting the registry so that it is
+      available to any jobs which depend on it.  Once all such jobs
+      are complete, this job will finish.
+    pre-run: playbooks/buildset-registry/pre-test.yaml
+    run: playbooks/buildset-registry/run.yaml
+    post-run: playbooks/buildset-registry/post.yaml
+    secrets:
+      - secret: opendev-intermediate-registry
+        name: intermediate_registry
+    requires: docker-image
+
+- job:
+    name: opendev-build-docker-image-base
+    parent: opendev-buildset-registry-test
+    description: |
+      This is a parent for an image build job which expects a
+      buildset registry to be running and pulls images from the
+      intermediate registry into it.  It mostly exists so that
+      the intermediate registry secret need not be supplied to the
+      image build playbook.
+    pre-run: playbooks/docker-image/pre.yaml
+    secrets:
+      - secret: opendev-intermediate-registry
+        name: intermediate_registry
+
+- job:
+    name: opendev-build-docker-image-test
+    parent: opendev-build-docker-image-base
+    description: |
+      Starts a buildset registry (if one has not already been started,
+      e.g., by invoking :zuul:job:`opendev-buildset-registry` and
+      specifying it as a dependency) and builds one or more docker
+      images.
+
+      Analog of build-docker-image job, but with a buildset registry.
+
+      This job will pause after starting the registry so that it is
+      available to any jobs which depend on it.  Once all such jobs
+      are complete, this job will finish.
+
+      .. include:: ../../playbooks/docker-image/README.rst
+    run: playbooks/docker-image/run.yaml
+    provides: docker-image
+
 - job:
     name: opendev-buildset-registry
     description: |