diff --git a/lib/fedorabase.pm b/lib/fedorabase.pm
--- a/lib/fedorabase.pm
+++ b/lib/fedorabase.pm
@@ -224,6 +224,15 @@
     return @forwards;
 }
 
+sub boot_decrypt {
+    # decrypt storage during boot; arg is timeout (in seconds)
+    my $self = shift;
+    my $timeout = shift || 60;
+    assert_screen "boot_enter_passphrase", $timeout; #
+    type_string get_var("ENCRYPT_PASSWORD");
+    send_key "ret";
+}
+
 1;
 
 # vim: set sw=4 et:
diff --git a/needles/console/boot_enter_passphrase-20160705.json b/needles/console/boot_enter_passphrase-20160705.json
new file mode 100644
--- /dev/null
+++ b/needles/console/boot_enter_passphrase-20160705.json
@@ -0,0 +1,15 @@
+{
+  "area": [
+    {
+      "width": 207,
+      "xpos": 0,
+      "ypos": 169,
+      "type": "match",
+      "height": 31
+    }
+  ],
+  "tags": [
+    "boot_enter_passphrase"
+  ],
+  "properties": []
+}
\ No newline at end of file
diff --git a/needles/console/boot_enter_passphrase-20160705.png b/needles/console/boot_enter_passphrase-20160705.png
new file mode 100644
index 0000000000000000000000000000000000000000..0000000000000000000000000000000000000000
GIT binary patch
diff --git a/needles/console/boot_enter_passphrase-graphical.json b/needles/console/boot_enter_passphrase-graphical.json
new file mode 100644
--- /dev/null
+++ b/needles/console/boot_enter_passphrase-graphical.json
@@ -0,0 +1,15 @@
+{
+  "area": [
+    {
+      "xpos": 395,
+      "ypos": 362,
+      "width": 33,
+      "height": 40,
+      "type": "match"
+    }
+  ],
+  "properties": [],
+  "tags": [
+    "boot_enter_passphrase"
+  ]
+}
\ No newline at end of file
diff --git a/needles/console/boot_enter_passphrase-graphical.png b/needles/console/boot_enter_passphrase-graphical.png
new file mode 100644
index 0000000000000000000000000000000000000000..0000000000000000000000000000000000000000
GIT binary patch
diff --git a/templates b/templates
--- a/templates
+++ b/templates
@@ -811,6 +811,17 @@
                     },
                     {
                       machine    => { name => "64bit" },
+                      prio       => 30,
+                      product    => {
+                                      arch    => "x86_64",
+                                      distri  => "fedora",
+                                      flavor  => "universal",
+                                      version => "*",
+                                    },
+                      test_suite => { name => "upgrade_desktop_encrypted_64bit" },
+                    },
+                    {
+                      machine    => { name => "64bit" },
                       prio       => 50,
                       product    => {
                                       arch    => "x86_64",
@@ -855,6 +866,17 @@
                     },
                     {
                       machine    => { name => "64bit" },
+                      prio       => 50,
+                      product    => {
+                                      arch    => "x86_64",
+                                      distri  => "fedora",
+                                      flavor  => "universal",
+                                      version => "*",
+                                    },
+                      test_suite => { name => "upgrade_2_desktop_encrypted_64bit" },
+                    },
+                    {
+                      machine    => { name => "64bit" },
                       prio       => 40,
                       product    => {
                                       arch    => "x86_64",
@@ -1578,6 +1600,19 @@
                       ],
                     },
                     {
+                      name => "upgrade_desktop_encrypted_64bit",
+                      settings => [
+                        { key => "ROOT_PASSWORD", value => "weakpassword" },
+                        { key => "USER_LOGIN", value => "test" },
+                        { key => "USER_PASSWORD", value => "weakpassword" },
+                        { key => "BOOTFROM", value => "c" },
+                        { key => "HDD_1", value => "disk_f%CURRREL%_desktopencrypt_x86_64.img" },
+                        { key => "UPGRADE", value => "1" },
+                        { key => "DESKTOP", value => "gnome" },
+                        { key => "ENCRYPT_PASSWORD", value => "weakpassword" },
+                      ],
+                    },
+                    {
                       name => "upgrade_2_minimal_64bit",
                       settings => [
                         { key => "ROOT_PASSWORD", value => "weakpassword" },
@@ -1624,6 +1659,19 @@
                       ],
                     },
                     {
+                      name => "upgrade_2_desktop_encrypted_64bit",
+                      settings => [
+                        { key => "ROOT_PASSWORD", value => "weakpassword" },
+                        { key => "USER_LOGIN", value => "test" },
+                        { key => "USER_PASSWORD", value => "weakpassword" },
+                        { key => "BOOTFROM", value => "c" },
+                        { key => "HDD_1", value => "disk_f%PREVREL%_desktopencrypt_x86_64.img" },
+                        { key => "UPGRADE", value => "1" },
+                        { key => "DESKTOP", value => "gnome" },
+                        { key => "ENCRYPT_PASSWORD", value => "weakpassword" },
+                      ],
+                    },
+                    {
                       name => "upgrade_desktop_32bit",
                       settings => [
                         { key => "ROOT_PASSWORD", value => "weakpassword" },
diff --git a/tests/_graphical_wait_login.pm b/tests/_graphical_wait_login.pm
--- a/tests/_graphical_wait_login.pm
+++ b/tests/_graphical_wait_login.pm
@@ -5,9 +5,11 @@
 sub run {
     # If KICKSTART is set, then the wait_time needs to consider the
     # install time. if UPGRADE, we have to wait for the entire upgrade
+    # unless ENCRYPT_PASSWORD is set (in which case the postinstall
+    # test does the waiting)
     my $wait_time = 300;
     $wait_time = 1800 if (get_var("KICKSTART"));
-    $wait_time = 6000 if (get_var("UPGRADE"));
+    $wait_time = 6000 if (get_var("UPGRADE") && !get_var("ENCRYPT_PASSWORD"));
 
     # Wait for the login screen
     assert_screen "graphical_login", $wait_time;
diff --git a/tests/disk_guided_encrypted_postinstall.pm b/tests/disk_guided_encrypted_postinstall.pm
--- a/tests/disk_guided_encrypted_postinstall.pm
+++ b/tests/disk_guided_encrypted_postinstall.pm
@@ -3,10 +3,13 @@
 use testapi;
 
 sub run {
+    my $self = shift;
+    my $wait_time = 300;
+    # if we're running an upgrade, we must wait for the entire upgrade
+    # process to run
+    $wait_time = 6000 if (get_var("UPGRADE"));
     # decrypt disks during boot
-    assert_screen "boot_enter_passphrase", 300; #
-    type_string get_var("ENCRYPT_PASSWORD");
-    send_key "ret";
+    $self->boot_decrypt($wait_time);
 }
 
 sub test_flags {
diff --git a/tests/upgrade_preinstall.pm b/tests/upgrade_preinstall.pm
--- a/tests/upgrade_preinstall.pm
+++ b/tests/upgrade_preinstall.pm
@@ -4,6 +4,10 @@
 
 sub run {
     my $self = shift;
+    # decrypt disks during boot if necessary
+    if (get_var("ENCRYPT_PASSWORD")) {
+        $self->boot_decrypt(60);
+    }
 
     # wait for either graphical or text login
     if (get_var('DESKTOP')) {
@@ -22,6 +26,11 @@
 
     script_run "reboot";
 
+    # decrypt if necessary
+    if (get_var("ENCRYPT_PASSWORD")) {
+        $self->boot_decrypt(60);
+    }
+
     if (get_var('DESKTOP')) {
         $self->boot_to_login_screen("graphical_login", 30, 90); # DM takes time to load
     } else {
diff --git a/tests/upgrade_run.pm b/tests/upgrade_run.pm
--- a/tests/upgrade_run.pm
+++ b/tests/upgrade_run.pm
@@ -23,16 +23,31 @@
 
     script_run "dnf system-upgrade reboot";
     # fail immediately if we see a DNF error message
-    die "DNF reported failure" if (check_screen "upgrade_fail");
+    die "DNF reported failure" if (check_screen "upgrade_fail", 15);
+    if (get_var("ENCRYPT_PASSWORD")) {
+        $self->boot_decrypt(60);
+    }
     # try and catch if we hit RHBZ #1349721 and work around it
     if (check_screen "bootloader") {
         # wait some secs for the screen to clear
         sleep 10;
+        if (get_var("ENCRYPT_PASSWORD")) {
+            $self->boot_decrypt(60);
+        }
         if (check_screen "bootloader") {
             record_soft_failure;
             $self->do_bootloader(postinstall=>1, params=>"enforcing=0");
+            if (get_var("ENCRYPT_PASSWORD")) {
+                $self->boot_decrypt(60);
+            }
         }
     }
+    # in encrypted case we need to wait a bit so postinstall test
+    # doesn't bogus match on the encryption prompt we just completed
+    # before it disappears from view
+    if (get_var("ENCRYPT_PASSWORD")) {
+        sleep 5;
+    }
 }
 
 

