diff --git a/Makefile-daemon.am b/Makefile-daemon.am
index b3a52b3d..3c38b949 100644
--- a/Makefile-daemon.am
+++ b/Makefile-daemon.am
@@ -89,8 +89,13 @@ dbusconfdir = ${sysconfdir}/dbus-1/system.d
 systemdunit_in_files = $(srcdir)/src/daemon/rpm-ostreed.service.in
 systemdunit_DATA     = $(systemdunit_in_files:.service.in=.service)
 systemdunitdir       = $(prefix)/lib/systemd/system/
-$(systemdunit_DATA):
-	$(SED_SUBST) $@.in > $@
+if BUILDOPT_ASAN
+daemon_asan_options = -e s,@SYSTEMD_ENVIRON\@,Environment=ASAN_OPTIONS=detect_leaks=false,
+else
+daemon_asan_options = -e /@SYSTEMD_ENVIRON\@/d
+endif
+$(systemdunit_DATA): Makefile
+	$(SED_SUBST) $(daemon_asan_options) $@.in > $@
 
 install-daemon-altname-hook:
 	mv $(DESTDIR)$(libexecdir)/rpm-ostreed $(DESTDIR)$(libexecdir)/$(primaryname)d
diff --git a/Makefile-tests.am b/Makefile-tests.am
index 66b22379..0ca30f74 100644
--- a/Makefile-tests.am
+++ b/Makefile-tests.am
@@ -15,6 +15,9 @@ AM_TESTS_ENVIRONMENT = \
 AM_TESTS_ENVIRONMENT += \
 	LD_LIBRARY_PATH=$(abs_builddir)/libdnf-build/libdnf \
 	$(NULL)
+if BUILDOPT_ASAN
+AM_TESTS_ENVIRONMENT += ASAN_OPTIONS=detect_leaks=false
+endif
 
 CLEANFILES += \
 	tests/common/compose/yum/repo \
diff --git a/configure.ac b/configure.ac
index 51576321..8b43a953 100644
--- a/configure.ac
+++ b/configure.ac
@@ -48,6 +48,15 @@ CC_CHECK_FLAGS_APPEND([WARN_CFLAGS], [CFLAGS], [\
 ])
 AC_SUBST(WARN_CFLAGS)
 
+AC_MSG_CHECKING([for -fsanitize=address in CFLAGS])
+if echo $CFLAGS | grep -q -e -fsanitize=address; then
+AC_MSG_RESULT([yes])
+using_asan=yes
+else
+AC_MSG_RESULT([no])
+fi
+AM_CONDITIONAL(BUILDOPT_ASAN, [test x$using_asan = xyes])
+
 # Initialize libtool
 LT_PREREQ([2.2.4])
 LT_INIT([disable-static])
diff --git a/src/daemon/rpm-ostreed.service.in b/src/daemon/rpm-ostreed.service.in
index c11c1053..2a68977b 100644
--- a/src/daemon/rpm-ostreed.service.in
+++ b/src/daemon/rpm-ostreed.service.in
@@ -5,4 +5,5 @@ ConditionPathExists=/ostree
 [Service]
 Type=dbus
 BusName=org.projectatomic.rpmostree1
+@SYSTEMD_ENVIRON@
 ExecStart=@libexecdir@/@primaryname@d
diff --git a/tests/common/libvm.sh b/tests/common/libvm.sh
index ef2d30c2..b6b11407 100644
--- a/tests/common/libvm.sh
+++ b/tests/common/libvm.sh
@@ -51,6 +51,12 @@ vm_cmd() {
   $SSH "$@"
 }
 
+# run rpm-ostree in vm
+# - $@    args
+vm_rpmostree() {
+    $SSH env ASAN_OPTIONS=detect_leaks=false rpm-ostree "$@"
+}
+
 # copy files to a directory in the vm
 # - $1    target directory
 # - $2..  files & dirs to copy
@@ -135,7 +141,7 @@ vm_has_packages() {
 # - $1   key to retrieve
 vm_get_booted_deployment_info() {
   key=$1
-  vm_cmd rpm-ostree status --json | \
+  vm_rpmostree status --json | \
     python -c "
 import sys, json
 deployments = json.load(sys.stdin)[\"deployments\"]
diff --git a/tests/vmcheck/test-layering-basic.sh b/tests/vmcheck/test-layering-basic.sh
index adee115c..2d49bff3 100755
--- a/tests/vmcheck/test-layering-basic.sh
+++ b/tests/vmcheck/test-layering-basic.sh
@@ -40,7 +40,7 @@ if vm_cmd "runuser -u bin rpm-ostree pkg-add foo-1.0"; then
     assert_not_reached "Was able to install a package as non-root!"
 fi
 
-vm_cmd rpm-ostree pkg-add foo-1.0
+vm_rpmostree pkg-add foo-1.0
 echo "ok pkg-add foo"
 
 vm_reboot
@@ -53,7 +53,7 @@ if ! vm_cmd /usr/bin/foo | grep "Happy foobing!"; then
 fi
 echo "ok correct output"
 
-vm_cmd rpm-ostree pkg-remove foo-1.0
+vm_rpmostree pkg-remove foo-1.0
 echo "ok pkg-remove foo"
 
 vm_reboot
diff --git a/tests/vmcheck/test-layering-non-root-caps.sh b/tests/vmcheck/test-layering-non-root-caps.sh
index a7a4faa3..aa9991c8 100755
--- a/tests/vmcheck/test-layering-non-root-caps.sh
+++ b/tests/vmcheck/test-layering-non-root-caps.sh
@@ -31,7 +31,7 @@ vm_send_test_repo
 # make sure the package is not already layered
 vm_assert_layered_pkg nonrootcap absent
 
-vm_cmd rpm-ostree install nonrootcap
+vm_rpmostree install nonrootcap
 echo "ok install nonrootcap"
 
 vm_reboot
diff --git a/tests/vmcheck/test-layering-relayer.sh b/tests/vmcheck/test-layering-relayer.sh
index 7aed0b6f..564fad10 100755
--- a/tests/vmcheck/test-layering-relayer.sh
+++ b/tests/vmcheck/test-layering-relayer.sh
@@ -35,7 +35,7 @@ vm_send_test_repo
 # make sure the package is not already layered
 vm_assert_layered_pkg foo absent
 
-vm_cmd rpm-ostree pkg-add foo
+vm_rpmostree pkg-add foo
 echo "ok pkg-add foo"
 
 vm_reboot
@@ -55,7 +55,7 @@ reboot_and_assert_base() {
 
 # let's synthesize an upgrade
 commit=$(vm_cmd ostree commit -b vmcheck --tree=ref=vmcheck)
-vm_cmd rpm-ostree upgrade
+vm_rpmostree upgrade
 reboot_and_assert_base $commit
 echo "ok upgrade"
 
@@ -66,7 +66,7 @@ echo "ok pkg foo relayered on upgrade"
 
 commit=$(vm_cmd ostree commit -b vmcheck \
            --tree=ref=vmcheck --add-metadata-string=version=my-commit)
-vm_cmd rpm-ostree deploy my-commit
+vm_rpmostree deploy my-commit
 reboot_and_assert_base $commit
 echo "ok deploy"
 
@@ -76,7 +76,7 @@ echo "ok pkg foo relayered on deploy"
 # REBASE
 
 commit=$(vm_cmd ostree commit -b rebase_test --tree=ref=vmcheck)
-vm_cmd rpm-ostree rebase rebase_test
+vm_rpmostree rebase rebase_test
 reboot_and_assert_base $commit
 echo "ok rebase"
 
diff --git a/tests/vmcheck/test-layering-rpmdb.sh b/tests/vmcheck/test-layering-rpmdb.sh
index faebb0b4..cda0f1b4 100755
--- a/tests/vmcheck/test-layering-rpmdb.sh
+++ b/tests/vmcheck/test-layering-rpmdb.sh
@@ -39,7 +39,7 @@ vm_send_test_repo
 # make sure the package is not already layered
 vm_assert_layered_pkg foo absent
 
-vm_cmd rpm-ostree pkg-add foo
+vm_rpmostree pkg-add foo
 echo "ok pkg-add foo"
 
 vm_reboot
@@ -52,7 +52,7 @@ echo "ok pkg foo added"
 csum=$(vm_cmd ostree commit -b vmcheck --tree=ref=$(vm_get_booted_csum))
 
 # check that upgrading to it will elide the layered pkg from the origin
-vm_cmd rpm-ostree upgrade | tee out.txt
+vm_rpmostree upgrade | tee out.txt
 assert_file_has_content out.txt "'foo' .* will no longer be layered"
 echo "ok layered pkg foo elision msg"
 
@@ -69,46 +69,46 @@ elif vm_has_layered_packages foo; then
 fi
 echo "ok layered pkg foo elision"
 
-if vm_cmd rpm-ostree pkg-add foo; then
+if vm_rpmostree pkg-add foo; then
   assert_not_reached "pkg-add foo succeeded even though it's already in rpmdb"
 fi
 echo "ok can't layer pkg already in base"
 
-if vm_cmd rpm-ostree pkg-add bar; then
+if vm_rpmostree pkg-add bar; then
   assert_not_reached "pkg-add bar succeeded but it conflicts with foo in base"
 fi
 echo "ok can't layer conflicting pkg in base"
 
 # let's go back to that first depl in which foo is really layered
-vm_cmd rpm-ostree rollback
+vm_rpmostree rollback
 vm_reboot
 vm_assert_layered_pkg foo present
 
-if vm_cmd rpm-ostree pkg-add foo; then
+if vm_rpmostree pkg-add foo; then
   assert_not_reached "pkg-add foo succeeded even though it's already layered"
 fi
 echo "ok can't layer pkg already layered"
 
-if vm_cmd rpm-ostree pkg-add bar; then
+if vm_rpmostree pkg-add bar; then
   assert_not_reached "pkg-add bar succeeded but it conflicts with layered foo"
 fi
 echo "ok can't layer conflicting pkg already layered"
 
 # let's go back to the original depl without anything
 # XXX: this would be simpler if we had an --onto here
-vm_cmd rpm-ostree pkg-remove foo
+vm_rpmostree pkg-remove foo
 vm_reboot
 vm_assert_layered_pkg foo absent
 echo "ok pkg-remove foo"
 
-vm_cmd rpm-ostree pkg-add bar
+vm_rpmostree pkg-add bar
 vm_reboot
 vm_assert_layered_pkg bar present
 echo "ok pkg-add bar"
 
 # now let's try to do an upgrade -- the latest commit there is still the one we
 # created at the beginning of this test, containing foo in the base
-if vm_cmd rpm-ostree upgrade; then
+if vm_rpmostree upgrade; then
   assert_not_reached "upgrade succeeded but new base has conflicting pkg foo"
 fi
 echo "ok can't upgrade with conflicting layered pkg"
diff --git a/tests/vmcheck/test-layering-scripts.sh b/tests/vmcheck/test-layering-scripts.sh
index 86a2ec1e..4b13ba40 100755
--- a/tests/vmcheck/test-layering-scripts.sh
+++ b/tests/vmcheck/test-layering-scripts.sh
@@ -31,7 +31,7 @@ vm_send_test_repo
 # make sure the package is not already layered
 vm_assert_layered_pkg scriptpkg1 absent
 
-vm_cmd rpm-ostree pkg-add scriptpkg1
+vm_rpmostree pkg-add scriptpkg1
 echo "ok pkg-add scriptpkg1"
 
 vm_reboot
@@ -44,6 +44,6 @@ vm_cmd getent group scriptpkg1
 echo "ok group scriptpkg1 active"
 
 # And now, things that should fail
-if vm_cmd rpm-ostree install test-post-rofiles-violation; then
+if vm_rpmostree install test-post-rofiles-violation; then
     assert_not_reached "installed test-post-rofiles-violation!"
 fi