diff --git a/configure.ac b/configure.ac
index 6896c19e8..8018119f1 100644
--- a/configure.ac
+++ b/configure.ac
@@ -76,6 +76,12 @@ AC_ARG_ENABLE(ssh, AS_HELP_STRING([--disable-ssh], [Disable cockpit-ssh build an
 AM_CONDITIONAL(WITH_COCKPIT_SSH, test "$enable_ssh" != "no")
 AC_MSG_RESULT(${enable_ssh:=yes})
 
+# --enable-pybridge
+AC_MSG_CHECKING([whether to install the python cockpit-bridge])
+AC_ARG_ENABLE(bridge, AS_HELP_STRING([--enable-pybridge], [Install python cockpit-bridge]))
+AM_CONDITIONAL(WITH_PYBRIDGE, test "$enable_pybridge" = "yes")
+AC_MSG_RESULT(${enable_pybridge:=no})
+
 
 # pkg-config
 GLIB_API_VERSION="GLIB_VERSION_2_56"
diff --git a/pkg/Makefile.am b/pkg/Makefile.am
index 3dd112352..ade78b1e3 100644
--- a/pkg/Makefile.am
+++ b/pkg/Makefile.am
@@ -43,7 +43,10 @@ EXTRA_DIST += build.js files.js package.json package-lock.json
 
 # This is how the qunit tests get included.  We need to prevent automake from
 # seeing them during ./autogen.sh, but need make to find them at compile time.
+# We don't run them in the pybridge case since they're part of `pytest`.
+if !WITH_PYBRIDGE
 -include $(wildcard pkg/Makefile.qunit*)
+endif
 
 install-data-hook::
 	cd $(srcdir)/dist; find */* -type f -exec install -D -m 644 '{}' '$(abspath $(DESTDIR)$(datadir))/cockpit/{}' \;
diff --git a/src/Makefile.am b/src/Makefile.am
index 1c9d8523c..187882d4d 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -20,6 +20,21 @@ pytest-cov: $(BUILT_SOURCES) $(DIST_STAMP) $(MANIFESTS)
 	$(MAKE) test-server
 	cd '$(srcdir)' && abs_builddir='$(abs_builddir)' pytest --cov
 
+if WITH_PYBRIDGE
+INSTALL_DATA_LOCAL_TARGETS += install-python
+install-python:
+	@# wheel-based installation with .dist-info.
+	@# This needs to work on RHEL8 up through modern Fedora, offline, with
+	@# system packages available to the build.
+	@rm -rf tmp/pybuild
+	'$(srcdir)'/tools/dist-setuptools '$(srcdir)' tmp/pybuild
+	cd tmp/pybuild && python3 -c 'from setuptools import setup; setup()' bdist_wheel
+	python3 -m pip install --no-index --force-reinstall --root='$(DESTDIR)/' --prefix='$(prefix)' tmp/pybuild/dist/*.whl
+	mkdir -p $(DESTDIR)$(libexecdir)
+	mv -t $(DESTDIR)$(libexecdir) $(DESTDIR)$(bindir)/cockpit-askpass
+endif
+
+
 # -----------------------------------------------------------------------------
 #  C
 
diff --git a/src/bridge/Makefile.am b/src/bridge/Makefile.am
index da0bec5d0..8376c8877 100644
--- a/src/bridge/Makefile.am
+++ b/src/bridge/Makefile.am
@@ -38,6 +38,8 @@ libcockpit_metrics_a_SOURCES = \
 	src/bridge/cockpitsamples.h \
 	$(NULL)
 
+if !WITH_PYBRIDGE
+
 # -----------------------------------------------------------------------------
 # libcockpit-bridge.a: code used in cockpit-bridge and its tests
 
@@ -227,6 +229,8 @@ dist_check_DATA += \
 	src/bridge/mock-server.key \
 	$(NULL)
 
+endif
+
 # -----------------------------------------------------------------------------
 # polkit
 
diff --git a/src/ws/Makefile-ws.am b/src/ws/Makefile-ws.am
index 3f2ed9abb..ff3819dd0 100644
--- a/src/ws/Makefile-ws.am
+++ b/src/ws/Makefile-ws.am
@@ -117,11 +117,6 @@ test_auth_CPPFLAGS = $(libcockpit_ws_a_CPPFLAGS) $(TEST_CPP)
 test_auth_LDADD = $(libcockpit_ws_a_LIBS) $(TEST_LIBS)
 test_auth_SOURCES = src/ws/test-auth.c
 
-TEST_PROGRAM += test-channelresponse
-test_channelresponse_CPPFLAGS = $(libcockpit_ws_a_CPPFLAGS) $(TEST_CPP)
-test_channelresponse_LDADD = $(libcockpit_ws_a_LIBS) $(TEST_LIBS)
-test_channelresponse_SOURCES = src/ws/test-channelresponse.c
-
 TEST_PROGRAM += test-compat
 test_compat_CPPFLAGS = $(libcockpit_ws_a_CPPFLAGS) $(TEST_CPP)
 test_compat_LDADD = $(libcockpit_ws_a_LIBS) $(TEST_LIBS)
@@ -132,16 +127,25 @@ test_creds_CPPFLAGS = $(libcockpit_ws_a_CPPFLAGS) $(TEST_CPP)
 test_creds_LDADD = $(libcockpit_ws_a_LIBS) $(TEST_LIBS)
 test_creds_SOURCES = src/ws/test-creds.c
 
-TEST_PROGRAM += test-handlers
-test_handlers_CPPFLAGS = $(libcockpit_ws_a_CPPFLAGS) $(TEST_CPP)
-test_handlers_LDADD = $(libcockpit_ws_a_LIBS) $(TEST_LIBS)
-test_handlers_SOURCES = src/ws/test-handlers.c
-
 TEST_PROGRAM += test-kerberos
 test_kerberos_CPPFLAGS = $(libcockpit_ws_a_CPPFLAGS) $(TEST_CPP)
 test_kerberos_LDADD = $(libcockpit_ws_a_LIBS) $(TEST_LIBS) $(krb5_LIBS)
 test_kerberos_SOURCES = src/ws/test-kerberos.c
 
+if !WITH_PYBRIDGE
+
+# These are -ws tests but they involve invoking ./cockpit-bridge.
+
+TEST_PROGRAM += test-channelresponse
+test_channelresponse_CPPFLAGS = $(libcockpit_ws_a_CPPFLAGS) $(TEST_CPP)
+test_channelresponse_LDADD = $(libcockpit_ws_a_LIBS) $(TEST_LIBS)
+test_channelresponse_SOURCES = src/ws/test-channelresponse.c
+
+TEST_PROGRAM += test-handlers
+test_handlers_CPPFLAGS = $(libcockpit_ws_a_CPPFLAGS) $(TEST_CPP)
+test_handlers_LDADD = $(libcockpit_ws_a_LIBS) $(TEST_LIBS)
+test_handlers_SOURCES = src/ws/test-handlers.c
+
 TEST_PROGRAM += test-webservice
 test_webservice_CPPFLAGS = $(libcockpit_ws_a_CPPFLAGS) $(TEST_CPP)
 test_webservice_LDADD = $(libcockpit_ws_a_LIBS) $(TEST_LIBS)
@@ -154,6 +158,7 @@ test_authssh_CPPFLAGS = $(libcockpit_ws_a_CPPFLAGS) $(TEST_CPP)
 test_authssh_LDADD = $(libcockpit_ws_a_LIBS) $(TEST_LIBS)
 test_authssh_SOURCES = src/ws/test-authssh.c
 
+endif
 endif
 
 noinst_PROGRAMS += mock-pam-conv-mod.so