diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 07d751ac1..6398c181a 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -51,6 +51,8 @@ RPM:
           - aws/rhel-8.4-aarch64
           - aws/rhel-8.5-x86_64
           - aws/rhel-8.5-aarch64
+          - aws/rhel-9.0-beta-nightly-x86_64
+          - aws/rhel-9.0-beta-nightly-aarch64
         INTERNAL_NETWORK: ["true"]
 
 Container:
diff --git a/schutzbot/mockbuild.sh b/schutzbot/mockbuild.sh
index f606f790f..19d450ee5 100755
--- a/schutzbot/mockbuild.sh
+++ b/schutzbot/mockbuild.sh
@@ -20,7 +20,7 @@ fi
 # Mock configuration file to use for building RPMs.
 MOCK_CONFIG="${ID}-${VERSION_ID%.*}-$(uname -m)"
 
-if [[ $ID == centos ]]; then
+if [[ $ID == centos && ${VERSION_ID%.*} == 8 ]]; then
   MOCK_CONFIG="centos-stream-8-$(uname -m)"
 fi
 
@@ -59,13 +59,19 @@ if curl --silent --fail --head --output /dev/null "${REPO_URL}/repodata/repomd.x
   exit 0
 fi
 
-# TODO: update to install correct version once epel-9 is out
 # Mock and s3cmd is only available in EPEL for RHEL.
-if [[ $ID == rhel || $ID == centos ]] && ! rpm -q epel-release; then
+if [[ $ID == rhel || $ID == centos ]] && [[ ${VERSION_ID%.*} == 8 ]] && ! rpm -q epel-release; then
     greenprint "📦 Setting up EPEL repository"
     curl -Ls --retry 5 --output /tmp/epel.rpm \
         https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
     sudo rpm -Uvh /tmp/epel.rpm
+elif [[ $ID == rhel || $ID == centos ]] && [[ ${VERSION_ID%.*} == 9 ]]; then
+    # we have our own small epel for EL9, let's install it
+
+    # install Red Hat certificate, otherwise dnf copr fails
+    curl -LO --insecure https://hdn.corp.redhat.com/rhel8-csb/RPMS/noarch/redhat-internal-cert-install-0.1-23.el7.csb.noarch.rpm
+    sudo dnf install -y ./redhat-internal-cert-install-0.1-23.el7.csb.noarch.rpm dnf-plugins-core
+    sudo dnf copr enable -y copr.devel.redhat.com/osbuild-team/epel-el9 "rhel-9.dev-$ARCH"
 fi
 
 # Install requirements for building RPMs in mock.
@@ -95,6 +101,10 @@ elif [[ $VERSION_ID == 8.5 ]]; then
     cat "$RHEL85_NIGHTLY_REPO" | sudo tee -a /etc/mock/templates/rhel-8.tpl > /dev/null
     # We need triple quotes at the end of the template to mark the end of the repo list.
     echo '"""' | sudo tee -a /etc/mock/templates/rhel-8.tpl
+elif [[ $VERSION_ID == 9.0 ]]; then
+    greenprint "📋 Inserting RHEL 9 mock template"
+    sudo cp schutzbot/rhel-9-mock-configs/templates/rhel-9.tpl /etc/mock/templates/
+    sudo cp schutzbot/rhel-9-mock-configs/*.cfg /etc/mock/
 fi
 
 greenprint "🔧 Building source RPM"
diff --git a/schutzbot/rhel-9-mock-configs/rhel-9-aarch64.cfg b/schutzbot/rhel-9-mock-configs/rhel-9-aarch64.cfg
new file mode 100644
index 000000000..786f30a13
--- /dev/null
+++ b/schutzbot/rhel-9-mock-configs/rhel-9-aarch64.cfg
@@ -0,0 +1,4 @@
+include('templates/rhel-9.tpl')
+
+config_opts['target_arch'] = 'aarch64'
+config_opts['legal_host_arches'] = ('aarch64',)
diff --git a/schutzbot/rhel-9-mock-configs/rhel-9-x86_64.cfg b/schutzbot/rhel-9-mock-configs/rhel-9-x86_64.cfg
new file mode 100644
index 000000000..477c1a330
--- /dev/null
+++ b/schutzbot/rhel-9-mock-configs/rhel-9-x86_64.cfg
@@ -0,0 +1,4 @@
+include('templates/rhel-9.tpl')
+
+config_opts['target_arch'] = 'x86_64'
+config_opts['legal_host_arches'] = ('x86_64',)
diff --git a/schutzbot/rhel-9-mock-configs/templates/rhel-9.tpl b/schutzbot/rhel-9-mock-configs/templates/rhel-9.tpl
new file mode 100644
index 000000000..ca2ad10cf
--- /dev/null
+++ b/schutzbot/rhel-9-mock-configs/templates/rhel-9.tpl
@@ -0,0 +1,55 @@
+# inspired by https://gitlab.com/redhat/centos-stream/ci-cd/zuul/jobs/-/blob/master/playbooks/files/centos-stream9-x86_64.cfg
+
+config_opts['root'] = 'rhel-9-{{ target_arch }}'
+
+
+config_opts['chroot_setup_cmd'] = 'install tar gcc-c++ redhat-rpm-config redhat-release which xz sed make bzip2 gzip gcc coreutils unzip shadow-utils diffutils cpio bash gawk rpm-build info patch util-linux findutils grep'
+config_opts['dist'] = 'el8'  # only useful for --resultdir variable subst
+config_opts['releasever'] = '8'
+config_opts['package_manager'] = 'dnf'
+config_opts['extra_chroot_dirs'] = [ '/run/lock', ]
+config_opts['bootstrap_image'] = 'registry-proxy.engineering.redhat.com/rh-osbs/ubi9'
+
+config_opts['dnf.conf'] = """
+[main]
+keepcache=1
+debuglevel=2
+reposdir=/dev/null
+logfile=/var/log/yum.log
+retries=20
+obsoletes=1
+gpgcheck=0
+assumeyes=1
+syslog_ident=mock
+syslog_device=
+mdpolicy=group:primary
+best=1
+protected_packages=
+module_platform_id=platform:el9
+user_agent={{ user_agent }}
+
+[rhel9-baseos]
+name=RHEL 9 BaseOS
+baseurl=http://download.eng.bos.redhat.com/rhel-9/nightly/RHEL-9-Beta/latest-RHEL-9/compose/BaseOS/$basearch/os/
+enabled=1
+gpgcheck=0
+
+[rhel9-appstream]
+name=RHEL 9 AppStream
+baseurl=http://download.eng.bos.redhat.com/rhel-9/nightly/RHEL-9-Beta/latest-RHEL-9/compose/AppStream/$basearch/os/
+enabled=1
+gpgcheck=0
+
+[rhel9-crb]
+name=RHEL 9 CRB
+baseurl=http://download.eng.bos.redhat.com/rhel-9/nightly/RHEL-9-Beta/latest-RHEL-9/compose/CRB/$basearch/os/
+enabled=1
+gpgcheck=0
+
+[rhel9-buildroot]
+name=RHEL 9 Buildroot
+baseurl=http://download.eng.bos.redhat.com/rhel-9/nightly/BUILDROOT-9-Beta/latest-BUILDROOT-9/compose/Buildroot/$basearch/os
+enabled=1
+gpgcheck=0
+"""
+
diff --git a/schutzbot/terraform b/schutzbot/terraform
index 517a1ab23..110837a12 100644
--- a/schutzbot/terraform
+++ b/schutzbot/terraform
@@ -1 +1 @@
-a02b32c733d34f90c2b864a197d687c138c7ad27
+2f82efef1029ab3d0ca8161ccfb8212392a2395f