diff --git a/README.md b/README.md
index 1e2c87af..6e6b04a6 100644
--- a/README.md
+++ b/README.md
@@ -695,6 +695,18 @@ python manage.py test
 
 `TEST_LIBVIRT_GUEST_IMAGE` enables the tests that need a guest OS (disk and NIC hot-unplug, vCPU hotplug, guest agent, ACPI power off). It must be an installed, BIOS-bootable Linux qcow2 image with qemu-guest-agent, in a storage pool of the host other than `wvc-test`; the tests boot copies of it from overlays and only read the image. Shut down any VM using it first.
 
+Two disposable compute nodes for these tests come from the `Vagrantfile`: AlmaLinux 10 with nested KVM, set up by `dev/libvirt-bootstrap.sh` (with this checkout's gstfsd), a SASL user for TCP (`wvc`, password `wvc-test`) and your `~/.ssh/id_ed25519.pub` for root; migration runs between them. It needs Vagrant with the `vagrant-libvirt` plugin, a KVM host with `qemu-kvm` and `cyrus-sasl-md5`, and a user in the `libvirt` group. On a host that also runs Docker, let the VMs' network (the bridge of `virsh net-info vagrant-libvirt`, `virbr1` here) through Docker's forward rules (`sudo iptables -I DOCKER-USER -i virbr1 -j ACCEPT` and `sudo iptables -I DOCKER-USER -o virbr1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT`).
+
+```bash
+vagrant up --provider=libvirt
+C1=$(vagrant ssh compute1 -c "hostname -I" | awk '{print $1}') C2=$(vagrant ssh compute2 -c "hostname -I" | awk '{print $1}')
+for h in $C1 $C2; do ssh-keygen -R $h; ssh -o StrictHostKeyChecking=accept-new root@$h true; done   # new VMs, new host keys
+export TEST_LIBVIRT_HOST=$C1 TEST_LIBVIRT_TYPE=1 TEST_LIBVIRT_LOGIN=wvc TEST_LIBVIRT_PASSWORD=wvc-test
+export TEST_LIBVIRT_SSH_HOST=$C2 TEST_LIBVIRT_SSH_LOGIN=root TEST_LIBVIRT_MIGRATE_ADDRESS=$C2
+python manage.py test
+vagrant destroy -f
+```
+
 ## License
 
 WebVirtCloud is licensed under the [Apache Licence, Version 2.0](http://www.apache.org/licenses/LICENSE-2.0.html).
diff --git a/Vagrantfile b/Vagrantfile
index ca52857e..b86ed227 100644
--- a/Vagrantfile
+++ b/Vagrantfile
@@ -1,55 +1,31 @@
-# -*- mode: ruby -*-
-# vi: set ft=ruby :
+# Two disposable compute nodes for the live tests (README: Running tests), so
+# that migration runs between them: AlmaLinux 10 with nested KVM, set up by
+# dev/libvirt-bootstrap.sh, with a SASL user for TCP and the host user's SSH
+# key for root (SASL user wvc, password wvc-test).
 
 Vagrant.configure(2) do |config|
-  # Default machine, if name not specified...
-  config.vm.define "dev", primary: true do |dev|
-    dev.vm.box =  "ubuntu/bionic64"
-    dev.vm.hostname = "webvirtcloud"
-    dev.vm.network "private_network", ip: "192.168.33.10"
-    dev.vm.provision "shell", inline: <<-SHELL
-     sudo sh /vagrant/dev/libvirt-bootstrap.sh
-     sudo sed -i 's/auth_tcp = \"sasl\"/auth_tcp = \"none\"/g' /etc/libvirt/libvirtd.conf
-     sudo service libvirt-bin restart
-     sudo adduser vagrant libvirtd
-     sudo apt-get -y install python3-virtualenv virtualenv python3-pip python3-dev python3-lxml libvirt-dev zlib1g-dev python3-guestfs
-     virtualenv -p python3 /vagrant/venv
-     source /vagrant/venv/bin/activate
-     pip3 install -r /vagrant/dev/requirements.txt
-    SHELL
+  config.vm.box = "almalinux/10"
+  %w[compute1 compute2].each do |name|
+    config.vm.define(name) { |node| node.vm.hostname = "wvc-#{name}" }
   end
-  # To start this machine run "vagrant up prod"
-  # To enter this machine run "vagrant ssh prod"
-  config.vm.define "prod",  autostart: false do |prod|
-    prod.vm.box = "ubuntu/bionic64"
-    prod.vm.hostname = "webvirtcloud"
-    prod.vm.network "private_network", ip: "192.168.33.11"
-    prod.vm.network "forwarded_port", guest: 80, host: 8081
-    #prod.vm.synced_folder ".", "/srv/webvirtcloud"
-    prod.vm.provision "shell", inline: <<-SHELL
-     sudo mkdir /srv/webvirtcloud
-     sudo cp -R /vagrant/* /srv/webvirtcloud
-     sudo sh /srv/webvirtcloud/dev/libvirt-bootstrap.sh
-     sudo sed -i 's/auth_tcp = \"sasl\"/auth_tcp = \"none\"/g' /etc/libvirt/libvirtd.conf
-     sudo service libvirt-bin restart
-     sudo adduser vagrant libvirtd
-     sudo chown -R vagrant:vagrant /srv/webvirtcloud
-     sudo apt-get -y install python3-virtualenv python3-dev python3-lxml python3-pip virtualenv libvirt-dev zlib1g-dev libxslt1-dev nginx supervisor libsasl2-modules gcc pkg-config python3-guestfs
-     virtualenv -p python3 /srv/webvirtcloud/venv
-     source /srv/webvirtcloud/venv/bin/activate
-     pip3 install -r /srv/webvirtcloud/requirements.txt
-     sudo cp /srv/webvirtcloud/conf/supervisor/webvirtcloud.conf /etc/supervisor/conf.d
-     sudo cp /srv/webvirtcloud/conf/nginx/webvirtcloud.conf /etc/nginx/conf.d
-     sudo cp /srv/webvirtcloud/webvirtcloud/settings.py.template /srv/webvirtcloud/webvirtcloud/settings.py
-     sudo sed "s/SECRET_KEY = ''/SECRET_KEY = '"`python3 /srv/webvirtcloud/conf/runit/secret_generator.py`"'/" -i /srv/webvirtcloud/webvirtcloud/settings.py
-     python3 /srv/webvirtcloud/manage.py migrate
-     python3 /srv/webvirtcloud/manage.py collectstatic --noinput
-     sudo rm /etc/nginx/sites-enabled/default
-     sudo chown -R www-data:www-data /srv/webvirtcloud
-     sudo service nginx restart
-     sudo service supervisor restart
-    SHELL
+  config.vm.synced_folder ".", "/vagrant", disabled: true
+  config.vm.provider :libvirt do |v|
+    v.memory = 4096
+    v.cpus = 2
+    v.nested = true
+    v.cpu_mode = "host-passthrough"
+    v.video_type = "virtio"  # EL10 hosts have no cirrus
   end
+  # the bootstrap installs this checkout's gstfsd
+  config.vm.provision "file", source: "dev", destination: "/tmp/wvc/dev"
+  config.vm.provision "file", source: "conf", destination: "/tmp/wvc/conf"
+  config.vm.provision "file", source: "~/.ssh/id_ed25519.pub", destination: "/tmp/wvc/key.pub"
+  config.vm.provision "shell", inline: <<-SHELL
+    set -e
+    sh /tmp/wvc/dev/libvirt-bootstrap.sh
+    virsh pool-info default > /dev/null 2>&1 || { virsh pool-define-as default dir --target /var/lib/libvirt/images && virsh pool-autostart default && virsh pool-start default; }
+    echo wvc-test | saslpasswd2 -a libvirt -p wvc
+    install -d -m 700 /root/.ssh
+    cat /tmp/wvc/key.pub >> /root/.ssh/authorized_keys
+  SHELL
 end
-
-