diff --git a/.gitlab-ci/bare-metal/bm-init.sh b/.gitlab-ci/bare-metal/bm-init.sh
new file mode 100755
index 00000000000..6935957b2c6
--- /dev/null
+++ b/.gitlab-ci/bare-metal/bm-init.sh
@@ -0,0 +1,13 @@
+#!/bin/sh
+
+# Init entrypoint for bare-metal devices; calls common init code.
+
+# First stage: very basic setup to bring up network and /dev etc
+/init-stage1.sh
+
+# Second stage: run jobs
+test $? -eq 0 && /init-stage2.sh
+
+# Wait until the job would have timed out anyway, so we don't spew a "init
+# exited" panic.
+sleep 6000
diff --git a/.gitlab-ci/bare-metal/rootfs-setup.sh b/.gitlab-ci/bare-metal/rootfs-setup.sh
index 4d1cf83c5d0..796b9977f17 100644
--- a/.gitlab-ci/bare-metal/rootfs-setup.sh
+++ b/.gitlab-ci/bare-metal/rootfs-setup.sh
@@ -5,7 +5,8 @@ rootfs_dst=$1
 mkdir -p $rootfs_dst/results
 
 # Set up the init script that brings up the system.
-cp $CI_COMMON/init.sh $rootfs_dst/init
+cp $BM/bm-init.sh $rootfs_dst/init
+cp $CI_COMMON/init*.sh $rootfs_dst/
 
 cp $BM/capture-devcoredump.sh $rootfs_dst/
 
diff --git a/.gitlab-ci/common/init-stage1.sh b/.gitlab-ci/common/init-stage1.sh
new file mode 100755
index 00000000000..60b1e28366e
--- /dev/null
+++ b/.gitlab-ci/common/init-stage1.sh
@@ -0,0 +1,20 @@
+#!/bin/sh
+
+# Very early init, used to make sure devices and network are set up and
+# reachable.
+
+set -ex
+
+mount -t proc none /proc
+mount -t sysfs none /sys
+mount -t devtmpfs none /dev || echo possibly already mounted
+mkdir -p /dev/pts
+mount -t devpts devpts /dev/pts
+mount -t tmpfs tmpfs /tmp
+
+echo "nameserver 8.8.8.8" > /etc/resolv.conf
+[ -z "$NFS_SERVER_IP" ] || echo "$NFS_SERVER_IP caching-proxy" >> /etc/hosts
+
+# Set the time so we can validate certificates before we fetch anything;
+# however as not all DUTs have network, make this non-fatal.
+for i in 1 2 3; do sntp -sS pool.ntp.org && break || sleep 2; done || true
diff --git a/.gitlab-ci/common/init.sh b/.gitlab-ci/common/init-stage2.sh
similarity index 73%
rename from .gitlab-ci/common/init.sh
rename to .gitlab-ci/common/init-stage2.sh
index c9938ed91cc..3f5207d0e0a 100755
--- a/.gitlab-ci/common/init.sh
+++ b/.gitlab-ci/common/init-stage2.sh
@@ -1,23 +1,12 @@
 #!/bin/sh
 
-set -ex
-
-mount -t proc none /proc
-mount -t sysfs none /sys
-mount -t devtmpfs none /dev || echo possibly already mounted
-mkdir -p /dev/pts
-mount -t devpts devpts /dev/pts
-mount -t tmpfs tmpfs /tmp
-
-echo "nameserver 8.8.8.8" > /etc/resolv.conf
-[ -z "$NFS_SERVER_IP" ] || echo "$NFS_SERVER_IP caching-proxy" >> /etc/hosts
-
-# Set the time so we can validate certificates before we fetch anything;
-# however as not all DUTs have network, make this non-fatal.
-for i in 1 2 3; do sntp -sS pool.ntp.org && break || sleep 2; done || true
+# Second-stage init, used to set up devices and our job environment before
+# running tests.
 
 . /set-job-env-vars.sh
 
+set -ex
+
 # Set up any devices required by the jobs
 [ -z "$HWCI_KERNEL_MODULES" ] || (echo -n $HWCI_KERNEL_MODULES | xargs -d, -n1 /usr/sbin/modprobe)
 
@@ -73,7 +62,3 @@ if [ $OK -eq 1 ]; then
 else
     echo "bare-metal result: fail"
 fi
-
-# Wait until the job would have timed out anyway, so we don't spew a "init
-# exited" panic.
-sleep 6000