diff --git a/run.py b/run.py
index 610d6aea43..692b06b678 100755
--- a/run.py
+++ b/run.py
@@ -279,6 +279,7 @@ def __init__(self, version):
         self.version = version
         self.features = set()
         self.config = {}
+        self.extra_set = []
         self.load_build_info()
 
     def load_build_info(self):
@@ -374,6 +375,14 @@ def check_requires(requires, suricata_config: SuricataConfig, test_dir=None):
                 if not env in os.environ:
                     raise UnsatisfiedRequirementError(
                         "requires env var %s" % (env))
+        elif key == "skip-env":
+            # Inverse of "env": skip the test when the variable is set. Lets a
+            # test opt out of a specific run configuration without every other
+            # run having to set a variable to opt in.
+            for env in requires["skip-env"]:
+                if env in os.environ:
+                    raise UnsatisfiedRequirementError(
+                        "skipped because env var %s is set" % (env))
         elif key == "files":
             for filename in requires["files"]:
                 if test_dir and not os.path.isabs(filename):
@@ -1050,6 +1059,12 @@ def default_args(self):
 
         args += ["-c", self.get_suricata_yaml_path()]
 
+        # Extra command line arguments provided on the run.py command
+        # line. Added late so they take precedence over the values set
+        # above.
+        for keyvalue in self.suricata_config.extra_set:
+            args += ["--set", keyvalue]
+
         # Find pcaps.
         if "pcap" in self.config:
             pcap_path = os.path.join(self.directory, self.config["pcap"])
@@ -1266,6 +1281,9 @@ def main():
                         help="Outputs to custom directory")
     parser.add_argument("--valgrind", dest="valgrind", action="store_true",
                         help="Run tests in with valgrind")
+    parser.add_argument("--set", dest="extra_set", action="append", default=[],
+                        metavar="KEY=VALUE",
+                        help="Pass --set KEY=VALUE to Suricata (may be used multiple times)")
     parser.add_argument("--self-test", action="store_true",
                         help="Run self tests")
     parser.add_argument("--debug-failed", dest="debugfailed", action="store_true",
@@ -1333,6 +1351,7 @@ def main():
             print("error: suricatasc binary is missing")
 
     suricata_config.valgrind = args.valgrind
+    suricata_config.extra_set = args.extra_set
     tdir = os.path.join(TOPDIR, "tests")
     if args.testdir:
         tdir = os.path.abspath(args.testdir)
diff --git a/tests/datasets/datasets-absolute-allowed/test.yaml b/tests/datasets/datasets-absolute-allowed/test.yaml
index 788538014e..126033d8b6 100644
--- a/tests/datasets/datasets-absolute-allowed/test.yaml
+++ b/tests/datasets/datasets-absolute-allowed/test.yaml
@@ -4,6 +4,11 @@ pcap: ../../datasets/datasets-parent-path/one-packet.pcap
 requires:
   min-version: 8
   lambda: sys.platform != "win32"
+  # The dataset state/save files are absolute paths under /tmp, which is
+  # outside anything the Landlock sandbox grants, so the rules are rejected
+  # when it is enabled.
+  skip-env:
+    - SV_LANDLOCK
 
 args:
   - -vvv
diff --git a/tests/lua-output-streaming/test.yaml b/tests/lua-output-streaming/test.yaml
index 9008f2ff1d..827aaca3f5 100644
--- a/tests/lua-output-streaming/test.yaml
+++ b/tests/lua-output-streaming/test.yaml
@@ -2,6 +2,12 @@ requires:
   features:
     - HAVE_LUA
   min-version: 8
+  # The Lua script builds its output filename at runtime, so Suricata cannot
+  # declare it and the Landlock sandbox denies the write. Running under
+  # Landlock needs the output directory in security.landlock.directories.write,
+  # which the test does not control.
+  skip-env:
+    - SV_LANDLOCK
 
 pcap: ../filestore-v2.1-forced/suricata-update-pdf.pcap