diff --git a/playbooks/buildset-registry/post.yaml b/playbooks/buildset-registry/post.yaml
new file mode 100644
index 0000000000..c64e8ef331
--- /dev/null
+++ b/playbooks/buildset-registry/post.yaml
@@ -0,0 +1,3 @@
+- hosts: localhost
+  roles:
+    - push-to-intermediate-registry
diff --git a/playbooks/buildset-registry/pre.yaml b/playbooks/buildset-registry/pre.yaml
new file mode 100644
index 0000000000..68ba76617b
--- /dev/null
+++ b/playbooks/buildset-registry/pre.yaml
@@ -0,0 +1,21 @@
+- hosts: all
+  roles:
+    - install-docker
+    - run-buildset-registry
+    - use-buildset-registry
+  tasks:
+    - name: Open iptables port for registry
+      become: true
+      iptables:
+        chain: openstack-INPUT
+        protocol: tcp
+        match: state
+        ctstate: NEW
+        destination_port: 5000
+        jump: ACCEPT
+        rule_num: 7
+        action: insert
+
+- hosts: localhost
+  roles:
+    - pull-from-intermediate-registry
diff --git a/zuul.d/jobs.yaml b/zuul.d/jobs.yaml
index 551d29bf68..da1555137b 100644
--- a/zuul.d/jobs.yaml
+++ b/zuul.d/jobs.yaml
@@ -1198,3 +1198,15 @@
 
       The testing is done for Ubuntu Xenial.
     nodeset: ubuntu-xenial
+
+- job:
+    name: openstack-buildset-registry
+    description: |
+      Inherit from this job to get a buildset registry which interacts
+      with the intermediate CI registry to share speculative container
+      images between projects.
+    pre-run: playbooks/buildset-registry/pre.yaml
+    post-run: playbooks/buildset-registry/post.yaml
+    secrets:
+      - secret: opendev-intermediate-registry
+        name: intermediate_registry
diff --git a/zuul.d/secrets.yaml b/zuul.d/secrets.yaml
index ab2108ca23..dced503c8c 100644
--- a/zuul.d/secrets.yaml
+++ b/zuul.d/secrets.yaml
@@ -695,3 +695,21 @@
           nn55Gx/femCxzSo8zrQs85Zd2YzpSYLnB+6gaKixlscSUrikw0nkJx2B4fIN8NQbrgmg+
           ODMSny15rZBLGHFBgL7xhMJIBfYfkKE8Yk2EtvAptNUJcv5FXDjbgNzPqcHbfF/MEZCSR
           QubWk7hfS9a0kRiES8zSrUv8EJTBj2LOJx+9RFRklcd1STyhwkxJQZTI5Re3yE=
+
+- secret:
+    name: opendev-intermediate-registry
+    data:
+      host: insecure-ci-registry.opendev.org
+      port: 5000
+      username: zuul
+      password: !encrypted/pkcs1-oaep
+        - T7Apjf8G4N40dsoM8XKbOeMQBqWSi9OxGxrTfQvQ3AqB6amFEF1ZR+ESFhrLJpizO4bb4
+          NR7lpKOivBXUzIc3f5Oz6oyFeitzKeropP8IuQBzHaFhL9XzBJZRRTFwA/jSn/iBDl2KT
+          A9n1nXMMbc1tpulISgWMy+I94Nei5crwvyozLn0wjgCO34WpU094oC12P1ijWrx1NXwqL
+          FoYg+UCSMb/3WmjvzaEZEQcqg1tF3vc+BA6TgqflF40LZdPyPoLUzts5okQHrDhPl8KBl
+          fR1KQgYJLlEfHufW5KWEFiFAzQK3QCeAMFIcTDXyRJRujgdgyBgtuv7G+JnqrZt6HXdcG
+          qtJrPlfMTxw9lba/9h5lm4HMfKr52bAoIYJ2n1keh4mMBmLBf+tyoTk/FbZF0vgSN4dWZ
+          yd1ZT610oAWfliiIOf+JHc9EkPapMdrieFk65HZ0lqeDfZAvsQf18BW9AW6hI1SGrDz4n
+          JLPyS7s2bHn9UEzZt2PFtJQAerCMDwnzE4uc7M/A6UoDTbizm72qcpcHSYMXas7Nsrmcz
+          MvxZWy/Np/osLkQ+PRYBv0Bbd0xJkYkBtTEaE8zPkglOkYwqx6l4F0D6rJbjs5F/FDF2I
+          0AEx56fn26W0LFC3h/JtnjmL9mmLHQ0YS6LMujsDEUonV5UoDHNrviTNLMuEy0=