diff --git a/ipatests/pytest_ipa/integration/tasks.py b/ipatests/pytest_ipa/integration/tasks.py
index f82866b75..81f64f793 100755
--- a/ipatests/pytest_ipa/integration/tasks.py
+++ b/ipatests/pytest_ipa/integration/tasks.py
@@ -2462,6 +2462,18 @@ def get_platform(host):
     return result.stdout_text.strip()
 
 
+def get_platform_version(host):
+    result = host.run_command([
+        'python3', '-c',
+        'from ipaplatform.osinfo import OSInfo; print(OSInfo().version_number)'
+    ], raiseonerr=False)
+    assert result.returncode == 0
+    # stdout_text is a str in format "(X, Y)" and needs to be
+    # converted back to a functional tuple. This approach works with
+    # any number of version numbers filled, e.g. (34, ) or (8, 6) etc.
+    return tuple(map(int, re.findall(r'[0-9]+', result.stdout_text.strip())))
+
+
 def install_packages(host, pkgs):
     """Install packages on a remote host.
     :param host: the host where the installation takes place
diff --git a/ipatests/test_integration/test_replica_promotion.py b/ipatests/test_integration/test_replica_promotion.py
index bb1480c50..28fd72d1c 100644
--- a/ipatests/test_integration/test_replica_promotion.py
+++ b/ipatests/test_integration/test_replica_promotion.py
@@ -31,6 +31,7 @@ from ipatests.test_integration.test_dns_locations import (
 )
 from ipapython.dnsutil import DNSName
 from ipalib.constants import IPA_CA_RECORD
+from ipatests.util import xfail_context
 
 config = get_global_config()
 
@@ -1031,13 +1032,14 @@ class TestHiddenReplicaPromotion(IntegrationTest):
         self._check_dnsrecords([self.master], [self.replicas[0]])
         self._check_config([self.master], [self.replicas[0]])
 
-    @pytest.mark.xfail(
-        reason='https://pagure.io/freeipa/issue/8582', strict=True
-    )
     def test_ipahealthcheck_hidden_replica(self):
         """Ensure that ipa-healthcheck runs successfully on all members
         of an IPA cluster that includes a hidden replica.
         """
+        os_version = (tasks.get_platform(self.master),
+                      tasks.get_platform_version(self.master))
+        pki_version = tasks.get_pki_version(self.master)
+
         # verify state
         self._check_config([self.master], [self.replicas[0]])
         # A DNA range is needed on the replica for ipa-healthcheck to work.
@@ -1049,7 +1051,18 @@ class TestHiddenReplicaPromotion(IntegrationTest):
                 srv,
                 failures_only=True
             )
-            assert returncode == 0
+            pki_too_old = \
+                (os_version[0] == 'fedora'
+                    and pki_version < tasks.parse_version('11.1.0'))\
+                or (os_version[0] == 'rhel'
+                    and os_version[1][0] == 8
+                    and pki_version < tasks.parse_version('10.12.0'))\
+                or (os_version[0] == 'rhel'
+                    and os_version[1][0] == 9
+                    and pki_version < tasks.parse_version('11.0.4'))
+            with xfail_context(pki_too_old,
+                               'https://pagure.io/freeipa/issue/8582'):
+                assert returncode == 0
 
     def test_hide_last_visible_server_fails(self):
         # verify state