diff --git a/ansible/files/adminapi.service.j2 b/ansible/files/adminapi.service.j2
index 4e956703a5..9bd2a20e73 100644
--- a/ansible/files/adminapi.service.j2
+++ b/ansible/files/adminapi.service.j2
@@ -14,9 +14,9 @@ Restart=always
 RestartSec=3
 TimeoutStopSec=10
 Environment="AWS_USE_DUALSTACK_ENDPOINT=true"
-{% if qemu %}
-Environment="AWS_SDK_LOAD_CONFIG=true"
-{% endif %}
+{% for env in adminapi_extra_env %}
+Environment="{{ env }}"
+{% endfor %}
 StandardOutput=journal
 StandardError=journal
 
diff --git a/ansible/files/gotrue.service.j2 b/ansible/files/gotrue.service.j2
index 4105e92c66..80c044f4d0 100644
--- a/ansible/files/gotrue.service.j2
+++ b/ansible/files/gotrue.service.j2
@@ -90,15 +90,10 @@ Environment=GOTRUE_RELOADING_POLLER_ENABLED=false
 # ensures only 1 reload operation occurs during a burst of config updates.
 Environment=GOTRUE_RELOADING_GRACE_PERIOD_INTERVAL=2s
 
-{% if qemu %}
-# v3 does not use filesystem notifications for config reloads.
-Environment=GOTRUE_RELOADING_NOTIFY_ENABLED=false
-{% else %}
-# v2 currently relies on notify support, so we will enable it until both v2 / v3
-# have migrated to strictly use signals across all projects. The default is true
-# in gotrue but we will set it defensively here.
-Environment=GOTRUE_RELOADING_NOTIFY_ENABLED=true
-{% endif %}
+# v3 does not use filesystem notifications for config reloads. v2 relies on
+# notify support until both have migrated to strictly use signals. The default
+# is true in gotrue, but it is set explicitly here.
+Environment=GOTRUE_RELOADING_NOTIFY_ENABLED={{ gotrue_reloading_notify_enabled | lower }}
 
 Slice=services.slice
 
diff --git a/ansible/files/postgres_exporter.service.j2 b/ansible/files/postgres_exporter.service.j2
index 3dc57ef093..4e55f9689d 100644
--- a/ansible/files/postgres_exporter.service.j2
+++ b/ansible/files/postgres_exporter.service.j2
@@ -6,8 +6,7 @@ StartLimitBurst=0
 
 [Service]
 Type=simple
-ExecStart=/opt/postgres_exporter/postgres_exporter --disable-settings-metrics --extend.query-path="/opt/postgres_exporter/queries.yml" --disable-default-metrics --no-collector.locks --no-collector.replication --no-collector.replication_slot --no-collector.stat_bgwriter --no-collector.stat_database --no-collector.stat_user_tables --no-collector.statio_user_tables --no-collector.wal --collector.database_wraparound {% if qemu %}--no-collector.database {% endif %}
-
+ExecStart=/opt/postgres_exporter/postgres_exporter --disable-settings-metrics --extend.query-path="/opt/postgres_exporter/queries.yml" --disable-default-metrics --no-collector.locks --no-collector.replication --no-collector.replication_slot --no-collector.stat_bgwriter --no-collector.stat_database --no-collector.stat_user_tables --no-collector.statio_user_tables --no-collector.wal --collector.database_wraparound{% for flag in postgres_exporter_extra_flags %} {{ flag }}{% endfor %} 
 User=postgres
 Group=postgres
 Restart=always
diff --git a/ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.service.j2 b/ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.service.j2
index d5647c8865..922042accd 100644
--- a/ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.service.j2
+++ b/ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.service.j2
@@ -6,15 +6,9 @@ Requires=local-fs.target
 
 [Service]
 Type=oneshot
-{% if qemu %}
-ExecStart=/opt/supabase-admin-agent/supabase-admin-agent --config /opt/supabase-admin-agent/config.yaml salt --apply --store-result --targets-key  targetsv3-main.yaml
-User=root
-Group=root
-{% else %}
-ExecStart=/opt/supabase-admin-agent/supabase-admin-agent --config /opt/supabase-admin-agent/config.yaml salt --apply --store-result
-User=supabase-admin-agent
-Group=supabase-admin-agent
-{% endif %}
+ExecStart=/opt/supabase-admin-agent/supabase-admin-agent --config /opt/supabase-admin-agent/config.yaml {{ supabase_admin_agent_salt.args }}
+User={{ supabase_admin_agent_salt.user }}
+Group={{ supabase_admin_agent_salt.group }}
 StandardOutput=journal
 StandardError=journal
 StateDirectory=supabase-admin-agent
diff --git a/ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.timer.j2 b/ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.timer.j2
index 52a4a81558..3b605cb63f 100644
--- a/ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.timer.j2
+++ b/ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.timer.j2
@@ -3,19 +3,13 @@ Description=Run Supabase supabase-admin-agent salt on a schedule
 Requires=supabase-admin-agent_salt.service
 
 [Timer]
-{# We're using a significantly lower frequency for triggering this agent on qemu images for the moment. Once we've performed additional validations re: the aggregate impact of running it more frequently, the frequency can be increased. #}
-{% if qemu %}
-OnCalendar=*-*-* 0,6,12,18:00:00
+OnCalendar={{ supabase_admin_agent_timer.on_calendar }}
 RandomizedDelaySec={{ supabase_admin_agent_splay }}
-AccuracySec=1h
-OnBootSec=5m
-Persistent=true
-{% else %}
-OnCalendar=*:0/10
-RandomizedDelaySec={{ supabase_admin_agent_splay }}
-AccuracySec=1s
-Persistent=true
+AccuracySec={{ supabase_admin_agent_timer.accuracy_sec }}
+{% if supabase_admin_agent_timer.on_boot_sec %}
+OnBootSec={{ supabase_admin_agent_timer.on_boot_sec }}
 {% endif %}
+Persistent=true
 
 [Install]
 WantedBy=timers.target
diff --git a/ansible/playbook.yml b/ansible/playbook.yml
index f35c1d7945..88c86e27cb 100644
--- a/ansible/playbook.yml
+++ b/ansible/playbook.yml
@@ -6,6 +6,7 @@
 
   vars_files:
     - ./vars.yml
+    - "./vars/{{ 'qemu' if qemu else 'aws' }}.yml"
 
   # Set facts only in here, never in any tasks.
   # This avoids redefining/duplicates or different values (buggy)
@@ -186,7 +187,7 @@
     - name: Run supascan baseline validation
       when: stage2
       shell: >-
-        baseline={{ 'ami' if not qemu else 'qemu' }}-build-{{ platform }}
+        baseline={{ supascan_baseline_prefix }}-build-{{ platform }}
         nix shell {{ nix_store_paths['supascan'] }} --command
         /tmp/ansible-playbook/ansible/files/supascan_ami.sh
         /tmp/ansible-playbook/audit-specs/baselines/$baseline
diff --git a/ansible/qemu-vars.yaml b/ansible/qemu-vars.yaml
deleted file mode 100644
index ad06a2a014..0000000000
--- a/ansible/qemu-vars.yaml
+++ /dev/null
@@ -1 +0,0 @@
-supabase_admin_agent_splay_secs: 2h
diff --git a/ansible/tasks/internal/admin-api.yml b/ansible/tasks/internal/admin-api.yml
index e7d30b71ee..99120a9829 100644
--- a/ansible/tasks/internal/admin-api.yml
+++ b/ansible/tasks/internal/admin-api.yml
@@ -7,7 +7,7 @@
 - name: adminapi - system user
   ansible.builtin.user:
     name: adminapi
-    uid: "{{ 1006 if not qemu else 1007 }}"
+    uid: "{{ uids.adminapi }}"
     group: adminapi
     groups: admin,envoy,gotrue,kong,pgbouncer,postgres,postgrest,root,systemd-journal,vector,wal-g
 
diff --git a/ansible/tasks/internal/supabase-admin-agent.yml b/ansible/tasks/internal/supabase-admin-agent.yml
index fb32321749..b94952121e 100644
--- a/ansible/tasks/internal/supabase-admin-agent.yml
+++ b/ansible/tasks/internal/supabase-admin-agent.yml
@@ -1,7 +1,7 @@
 - name: supabase-admin-agent - system group
   ansible.builtin.group:
     name: supabase-admin-agent
-    gid: "{{ 987 if not qemu else 988 }}"
+    gid: "{{ gids.supabase_admin_agent }}"
     system: yes
 
 - name: supabase-admin-agent - system user
diff --git a/ansible/tasks/setup-envoy.yml b/ansible/tasks/setup-envoy.yml
index 588b2bfb94..b6d697cc18 100644
--- a/ansible/tasks/setup-envoy.yml
+++ b/ansible/tasks/setup-envoy.yml
@@ -7,7 +7,7 @@
 - name: Envoy - user
   ansible.builtin.user:
     name: envoy
-    uid: "{{ 1003 if not qemu else 1004 }}"
+    uid: "{{ uids.envoy }}"
     group: envoy
     state: present
 
diff --git a/ansible/tasks/setup-gotrue.yml b/ansible/tasks/setup-gotrue.yml
index b3378de4d4..e126543628 100644
--- a/ansible/tasks/setup-gotrue.yml
+++ b/ansible/tasks/setup-gotrue.yml
@@ -13,7 +13,7 @@
 - name: Gotrue - system user
   ansible.builtin.user:
     name: gotrue
-    uid: "{{ 1001 if not qemu else 1002 }}"
+    uid: "{{ uids.gotrue }}"
     group: gotrue
     state: present
 
diff --git a/ansible/tasks/setup-kong.yml b/ansible/tasks/setup-kong.yml
index f904fef365..3dd5a0e826 100644
--- a/ansible/tasks/setup-kong.yml
+++ b/ansible/tasks/setup-kong.yml
@@ -7,7 +7,7 @@
 - name: Kong - user
   ansible.builtin.user:
     name: kong
-    uid: "{{ 1004 if not qemu else 1005 }}"
+    uid: "{{ uids.kong }}"
     group: kong
     state: present
 
diff --git a/ansible/tasks/setup-pgbouncer.yml b/ansible/tasks/setup-pgbouncer.yml
index a6ee5b90f1..fc453101be 100644
--- a/ansible/tasks/setup-pgbouncer.yml
+++ b/ansible/tasks/setup-pgbouncer.yml
@@ -8,7 +8,7 @@
 - name: Create pgbouncer user
   ansible.builtin.user:
     name: 'pgbouncer'
-    uid: "{{ 1000 if not qemu else 1001 }}"
+    uid: "{{ uids.pgbouncer }}"
     comment: 'PgBouncer user'
     group: pgbouncer
     groups: 'postgres,ssl-cert'
diff --git a/ansible/tasks/setup-postgrest.yml b/ansible/tasks/setup-postgrest.yml
index 2d31585c38..26d8c3e740 100644
--- a/ansible/tasks/setup-postgrest.yml
+++ b/ansible/tasks/setup-postgrest.yml
@@ -7,7 +7,7 @@
 - name: PostgREST - user
   ansible.builtin.user:
     name: postgrest
-    uid: "{{ 1002 if not qemu else 1003 }}"
+    uid: "{{ uids.postgrest }}"
     group: postgrest
     state: present
 
diff --git a/ansible/tasks/setup-supabase-internal.yml b/ansible/tasks/setup-supabase-internal.yml
index 871cbf6fc4..8c8e9ec7ad 100644
--- a/ansible/tasks/setup-supabase-internal.yml
+++ b/ansible/tasks/setup-supabase-internal.yml
@@ -23,7 +23,7 @@
 - name: add vector system group
   ansible.builtin.group:
     name: vector
-    gid: "{{ 989 if not qemu else 990 }}"
+    gid: "{{ gids.vector }}"
     system: yes
 
 - name: add vector system user
diff --git a/ansible/tasks/setup-system.yml b/ansible/tasks/setup-system.yml
index ab761f4dd8..807598c972 100644
--- a/ansible/tasks/setup-system.yml
+++ b/ansible/tasks/setup-system.yml
@@ -4,7 +4,7 @@
     - name: Create ubuntu primary group
       ansible.builtin.group:
         name: ubuntu
-        gid: "{{ 1014 if not qemu else 1000 }}"
+        gid: "{{ gids.ubuntu }}"
         state: present
 
     - name: Create ubuntu user supplementary groups # noqa: explicit-identity-id
@@ -19,7 +19,7 @@
     - name: Create ubuntu user
       ansible.builtin.user:
         name: ubuntu
-        uid: "{{ 1007 if not qemu else 1000 }}"
+        uid: "{{ uids.ubuntu }}"
         group: ubuntu
         groups:
           - adm
diff --git a/ansible/vars/aws.yml b/ansible/vars/aws.yml
new file mode 100644
index 0000000000..967df9a1a3
--- /dev/null
+++ b/ansible/vars/aws.yml
@@ -0,0 +1,30 @@
+---
+uids:
+  pgbouncer: 1000
+  gotrue: 1001
+  postgrest: 1002
+  envoy: 1003
+  kong: 1004
+  adminapi: 1006
+  ubuntu: 1007
+gids:
+  ubuntu: 1014
+  vector: 989
+  supabase_admin_agent: 987
+
+supascan_baseline_prefix: ami
+
+adminapi_extra_env: []
+
+gotrue_reloading_notify_enabled: true
+
+postgres_exporter_extra_flags: []
+
+supabase_admin_agent_salt:
+  args: salt --apply --store-result
+  user: supabase-admin-agent
+  group: supabase-admin-agent
+supabase_admin_agent_timer:
+  on_calendar: "*:0/10"
+  accuracy_sec: 1s
+  on_boot_sec: ""
diff --git a/ansible/vars/qemu.yml b/ansible/vars/qemu.yml
new file mode 100644
index 0000000000..97a5cbfb25
--- /dev/null
+++ b/ansible/vars/qemu.yml
@@ -0,0 +1,35 @@
+---
+uids:
+  pgbouncer: 1001
+  gotrue: 1002
+  postgrest: 1003
+  envoy: 1004
+  kong: 1005
+  adminapi: 1007
+  ubuntu: 1000
+gids:
+  ubuntu: 1000
+  vector: 990
+  supabase_admin_agent: 988
+
+supascan_baseline_prefix: qemu
+
+adminapi_extra_env:
+  - AWS_SDK_LOAD_CONFIG=true
+
+gotrue_reloading_notify_enabled: false
+
+postgres_exporter_extra_flags:
+  - --no-collector.database
+
+supabase_admin_agent_salt:
+  args: salt --apply --store-result --targets-key  targetsv3-main.yaml
+  user: root
+  group: root
+# We're using a significantly lower frequency for triggering this agent on qemu
+# images for the moment. Once we've performed additional validations re: the
+# aggregate impact of running it more frequently, the frequency can be increased.
+supabase_admin_agent_timer:
+  on_calendar: "*-*-* 0,6,12,18:00:00"
+  accuracy_sec: 1h
+  on_boot_sec: 5m
diff --git a/packer/qemu.pkr.hcl b/packer/qemu.pkr.hcl
index 2c2c9d6935..e307d37e07 100644
--- a/packer/qemu.pkr.hcl
+++ b/packer/qemu.pkr.hcl
@@ -104,6 +104,11 @@ build {
     destination = "/tmp/cleanup-qemu.sh"
   }
 
+  provisioner "file" {
+    source      = "packer/scripts/provision-common.sh"
+    destination = "/tmp/provision-common.sh"
+  }
+
   provisioner "shell" {
     environment_vars = [
       "NIX_STORE_PATHS=${jsonencode({ nix_store_paths = var.nix_store_paths })}",
diff --git a/packer/scripts/chroot-bootstrap-nix.sh b/packer/scripts/chroot-bootstrap-nix.sh
index 4d02ff27e2..ddf5f2b310 100755
--- a/packer/scripts/chroot-bootstrap-nix.sh
+++ b/packer/scripts/chroot-bootstrap-nix.sh
@@ -8,20 +8,14 @@ set -o errexit
 set -o pipefail
 set -o xtrace
 
-function setup_apt {
-	export DEBIAN_FRONTEND=noninteractive
-}
+# shellcheck source=/dev/null
+source /tmp/provision-common.sh
 
-function cleanup_apt {
+function clean_apt_cache {
 	apt-get clean
 	apt-get autoremove --purge --yes
 }
 
-function update_and_upgrade_apt {
-	apt-get update --yes
-	apt-get dist-upgrade --yes
-}
-
 function install_initial_packages {
 	local packages=(
 		e2fsprogs
@@ -92,31 +86,6 @@ function install_initial_packages {
 	fi
 }
 
-function setup_locale {
-	cat >>/etc/locale.gen <<-EOF
-		en_US.UTF-8 UTF-8
-	EOF
-	cat >/etc/default/locale <<-EOF
-		LANG="C.UTF-8"
-		LC_CTYPE="C.UTF-8"
-	EOF
-	locale-gen en_US.UTF-8
-}
-
-function setup_postgesql_env {
-	# Create the directory if it doesn't exist
-	mkdir -p /etc/environment.d
-
-	# Define the contents of the PostgreSQL environment file
-	tee /etc/environment.d/postgresql.env >/dev/null <<-EOF
-		LOCALE_ARCHIVE=/usr/lib/locale/locale-archive
-		LANG="en_US.UTF-8"
-		LANGUAGE="en_US.UTF-8"
-		LC_ALL="en_US.UTF-8"
-		LC_CTYPE="en_US.UTF-8"
-	EOF
-}
-
 function setup_apparmor {
 	# Copy apparmor profiles
 	cp -rv /tmp/apparmor_profiles/* /etc/apparmor.d/
@@ -176,13 +145,6 @@ function setup_eth0_interface {
 	chmod 600 /etc/netplan/eth0.yaml
 }
 
-function disable_sshd_passwd_auth {
-	sed -i -E \
-		-e 's/^#?\s*PasswordAuthentication\s+(yes|no)\s*$/PasswordAuthentication no/g' \
-		-e 's/^#?\s*ChallengeResponseAuthentication\s+(yes|no)\s*$/ChallengeResponseAuthentication no/g' \
-		/etc/ssh/sshd_config
-}
-
 function create_admin_account {
 	groupadd admin
 }
@@ -224,5 +186,5 @@ set_default_target
 setup_eth0_interface
 disable_sshd_passwd_auth
 disable_fsck
-cleanup_apt
+clean_apt_cache
 enable_services
diff --git a/packer/scripts/cleanup-qemu.sh b/packer/scripts/cleanup-qemu.sh
index 9c79a981cd..3667a370f5 100755
--- a/packer/scripts/cleanup-qemu.sh
+++ b/packer/scripts/cleanup-qemu.sh
@@ -6,23 +6,19 @@
 
 set -ex
 
+# shellcheck source=/dev/null
+source /tmp/provision-common.sh
+
 # Ensure /tmp exists and has the proper permissions before
 # checking for security updates
 # https://github.com/digitalocean/marketplace-partners/issues/94
-if [[ ! -d /tmp ]]; then
-	mkdir /tmp
-fi
-chmod 1777 /tmp
+ensure_tmp_dir
 
 # Cleanup more packages
 packages=(
-	ansible
 	ansible-core
 	apport
 	appstream
-	autoconf
-	automake
-	autotools-dev
 	bash-completion
 	bcache-tools
 	bind9-dnsutils
@@ -31,11 +27,8 @@ packages=(
 	bolt
 	btrfs-progs
 	byobu
-	cmake-data
 	command-not-found
 	console-setup
-	cpp-10
-	cpp-9
 	distro-info
 	eject
 	'fonts-dejavu*'
@@ -44,19 +37,12 @@ packages=(
 	ftp
 	fwupd
 	gawk
-	gcc-10
-	gcc-9
 	gdisk
-	git
-	git-man
 	gnupg
 	keyboard-configuration
 	libc6-dev
-	libcgal-dev
 	libclang-cpp18
 	libevent-dev
-	libgcc-9-dev
-	libicu-dev
 	libicu74
 	libpcre3-dev
 	libssl-dev
@@ -101,47 +87,18 @@ packages=(
 	xfsprogs
 )
 
-if [[ $(uname -m) == aarch64 ]]; then
-	packages+=(libgcc-8-dev)
-fi
-
 apt-mark manual libevent-2.1-7t64
-apt-get --yes remove --purge "${packages[@]}"
-apt-get --yes autoremove
-apt-get --yes autoclean
-apt-get --yes update
-apt-get --yes upgrade
+purge_packages "${packages[@]}"
 
 systemctl set-default multi-user.target
 systemctl disable getty@tty1.service
 systemctl mask getty@tty1.service
 systemctl mask graphical.target
 
-rm -rf /tmp/* /var/tmp/*
-history -c
-cat /dev/null >/root/.bash_history
-unset HISTFILE
+scrub_history
 
 journalctl --rotate
 journalctl --vacuum-time=1s
-find /var/log -mtime -1 -type f -exec truncate -s 0 {} \;
-rm -rf /var/log/*.gz /var/log/*.[0-9] /var/log/*-????????
-rm -rf /var/lib/cloud/instances/*
-rm -f /root/.ssh/authorized_keys /etc/ssh/*key*
-touch /etc/ssh/revoked_keys
-chmod 600 /etc/ssh/revoked_keys
-
-cat /dev/null >/var/log/lastlog
-cat /dev/null >/var/log/wtmp
-
-dd if=/dev/zero of=/zerofile &
-PID=$!
-while [ -d /proc/$PID ]; do
-	printf "."
-	sleep 5
-done
-sync
-rm /zerofile
-sync
+scrub_logs_and_keys
 
-fstrim /
+empty_login_records
diff --git a/packer/scripts/cleanup.sh b/packer/scripts/cleanup.sh
index f9a103fb02..247dd10117 100755
--- a/packer/scripts/cleanup.sh
+++ b/packer/scripts/cleanup.sh
@@ -6,67 +6,17 @@
 
 set -ex
 
+# shellcheck source=/dev/null
+source /tmp/provision-common.sh
+
 # Ensure /tmp exists and has the proper permissions before
 # checking for security updates
 # https://github.com/digitalocean/marketplace-partners/issues/94
-if [[ ! -d /tmp ]]; then
-	mkdir /tmp
-fi
-chmod 1777 /tmp
-
-# Cleanup more packages
-packages=(
-	ansible
-	ansible
-	autoconf
-	automake
-	autotools-dev
-	cmake-data
-	cpp-10
-	cpp-9
-	gcc-10
-	gcc-9
-	git
-	git-man
-	libcgal-dev
-	libgcc-9-dev
-	libicu-dev
-)
-
-apt-get --yes remove --purge "${packages[@]}"
-apt-get --yes autoremove
-apt-get --yes autoclean
-apt-get --yes update
-apt-get --yes upgrade
+ensure_tmp_dir
 
-rm -rf /tmp/* /var/tmp/*
-history -c
-cat /dev/null >/root/.bash_history
-unset HISTFILE
-find /var/log -mtime -1 -type f -exec truncate -s 0 {} \;
-rm -rf /var/log/*.gz /var/log/*.[0-9] /var/log/*-????????
-rm -rf /var/lib/cloud/instances/*
-rm -f /root/.ssh/authorized_keys /etc/ssh/*key*
-touch /etc/ssh/revoked_keys
-chmod 600 /etc/ssh/revoked_keys
+purge_packages
 
-# Securely erase the unused portion of the filesystem
-cat <<-EOF
-	Writing zeros to the remaining disk space to securely erase the unused portion of the file system.
-	Depending on your disk size this may take several minutes.
-	The secure erase will complete successfully when you see:
-	    dd: writing to '/zerofile': No space left on device
-	Beginning secure erase now
-EOF
+scrub_history
+scrub_logs_and_keys
 
-dd if=/dev/zero of=/zerofile &
-PID=$!
-while [ -d /proc/$PID ]; do
-	printf "."
-	sleep 5
-done
-sync
-rm /zerofile
-sync
-cat /dev/null >/var/log/lastlog
-cat /dev/null >/var/log/wtmp
+empty_login_records
diff --git a/packer/scripts/nix-provision.sh b/packer/scripts/nix-provision.sh
index c53569c753..87220a236b 100755
--- a/packer/scripts/nix-provision.sh
+++ b/packer/scripts/nix-provision.sh
@@ -5,98 +5,22 @@ set -o errexit
 set -o pipefail
 set -o xtrace
 
-exec 1>&2
-
-function setup_apt {
-	export DEBIAN_FRONTEND=noninteractive
-}
-
-function cleanup_apt {
-	apt-get clean
-	apt-get autoremove --purge --yes
-	rm -rf /var/lib/apt/lists/*
-}
-
-function update_and_upgrade_apt {
-	apt-get update --yes
-	apt-get dist-upgrade --yes
-}
-
-function install_packages {
-	apt-get install -y ansible
-	ansible-galaxy collection install community.general
-}
-
-function install_nix() {
-	local nix_version=2.35.3
-	local nix_installer_sha256=69d0fe8fba8fe88f94c98b09964691ac9950abc7ecbf2ba861dc0533cfd901e9
-	local nix_installer
-	nix_installer=$(mktemp)
-	curl -fsSL "https://releases.nixos.org/nix/nix-${nix_version}/install" -o "$nix_installer"
-	echo "${nix_installer_sha256}  ${nix_installer}" | sha256sum -c -
-	sh "$nix_installer" --yes --daemon --nix-extra-conf-file <(
-		cat <<-EOF
-			extra-experimental-features = nix-command flakes
-			extra-substituters = https://nix-postgres-artifacts.s3.amazonaws.com
-			extra-trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=
-		EOF
-	)
-	rm -f "$nix_installer"
-
-	#shellcheck disable=SC1091
-	. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-	nix --version
-}
-
-function execute_stage2_playbook {
-	echo "POSTGRES_MAJOR_VERSION: $POSTGRES_MAJOR_VERSION"
-	mkdir -p /etc/ansible
-	tee /etc/ansible/ansible.cfg <<-EOF
-		[defaults]
-		callbacks_enabled = timer, profile_tasks, profile_roles
-	EOF
-	sed -i 's/- hosts: all/- hosts: localhost/' /tmp/ansible-playbook/ansible/playbook.yml
-
-	# Run Ansible playbook
-	export ANSIBLE_LOG_PATH=/tmp/ansible.log
-	export ANSIBLE_REMOTE_TEMP=/tmp
+# shellcheck source=/dev/null
+source /tmp/provision-common.sh
 
-	ansible-playbook /tmp/ansible-playbook/ansible/playbook.yml \
-		--extra-vars '{"stage2":true, "qemu":false}' \
-		--extra-vars "$NIX_STORE_PATHS" \
-		--extra-vars "psql_version=psql_$POSTGRES_MAJOR_VERSION" \
-		--extra-vars "postgresql_version=postgresql_$POSTGRES_MAJOR_VERSION" \
-		--extra-vars "postgres_major_version=$POSTGRES_MAJOR_VERSION"
-}
+exec 1>&2
 
 function cleanup_packages {
 	apt-get remove --purge --yes ansible
 }
 
-function cleanup_nix {
-	nix-collect-garbage -d
-	nix-store --optimise -v
-}
-
-function report_packages {
-	# shellcheck disable=SC2016
-	dpkg-query -W -f='${Package}\t${Version}\t${Architecture}\n' | LC_COLLATE=C.UTF-8 sort
-	find /nix/store -maxdepth 1 | LC_COLLATE=C.UTF-8 sort -t- -k2
-}
-
-function report_disk_usage {
-	read -r dub _ < <(du -sx -B1 /)
-	read -r duh _ < <(du -sx -h /)
-	printf '::notice::disk_usage bytes=%s human=%s\n' "$dub" "$duh" | tee -a /tmp/ansible.log
-}
-
 setup_apt
 update_and_upgrade_apt
-install_packages
+install_ansible
 install_nix
-execute_stage2_playbook
+run_playbook /tmp/ansible-playbook/ansible/playbook.yml /tmp true false localhost local --extra-vars "$NIX_STORE_PATHS"
 cleanup_packages
-cleanup_nix
+clean_nix
 update_and_upgrade_apt
 cleanup_apt
 report_packages
diff --git a/packer/scripts/provision-common.sh b/packer/scripts/provision-common.sh
new file mode 100644
index 0000000000..e1495827e9
--- /dev/null
+++ b/packer/scripts/provision-common.sh
@@ -0,0 +1,273 @@
+# shellcheck shell=bash
+
+function update_and_upgrade_apt {
+	apt-get update --yes
+	apt-get dist-upgrade --yes
+}
+
+function cleanup_apt {
+	apt-get clean
+	apt-get autoremove --purge --yes
+	rm -rf /var/lib/apt/lists/*
+}
+
+function install_ansible {
+	apt-get install --yes ansible
+	ansible-galaxy collection install community.general
+}
+
+function install_nix() {
+	local nix_version=2.35.3
+	local nix_installer_sha256=69d0fe8fba8fe88f94c98b09964691ac9950abc7ecbf2ba861dc0533cfd901e9
+	local nix_installer
+	nix_installer=$(mktemp)
+	curl -fsSL "https://releases.nixos.org/nix/nix-${nix_version}/install" -o "$nix_installer"
+	echo "${nix_installer_sha256}  ${nix_installer}" | sha256sum -c -
+	sh "$nix_installer" --yes --daemon --nix-extra-conf-file <(
+		cat <<-EOF
+			extra-experimental-features = nix-command flakes
+			extra-substituters = https://nix-postgres-artifacts.s3.amazonaws.com
+			extra-trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=
+		EOF
+	)
+	rm -f "$nix_installer"
+
+	# shellcheck disable=SC1091
+	. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+	nix --version
+}
+
+function run_playbook {
+	local playbook=$1 remote_tmp=$2 stage2=$3 qemu=$4 host=$5 connection=$6
+	shift 6
+
+	mkdir -p /etc/ansible
+	tee /etc/ansible/ansible.cfg <<-EOF
+		[defaults]
+		callbacks_enabled = timer, profile_tasks, profile_roles
+	EOF
+
+	export ANSIBLE_LOG_PATH=/tmp/ansible.log
+	export ANSIBLE_REMOTE_TEMP=$remote_tmp
+
+	ansible-playbook -c "$connection" -i "$host," "$playbook" \
+		--extra-vars "{\"stage2\":$stage2,\"qemu\":$qemu}" \
+		--extra-vars "psql_version=psql_$POSTGRES_MAJOR_VERSION" \
+		--extra-vars "postgres_major_version=$POSTGRES_MAJOR_VERSION" \
+		"$@"
+}
+
+function clean_nix {
+	nix-collect-garbage -d
+	nix-store --optimise -v
+}
+
+function report_packages {
+	# shellcheck disable=SC2016
+	dpkg-query -W -f='${Package}\t${Version}\t${Architecture}\n' | LC_COLLATE=C.UTF-8 sort
+	find /nix/store -maxdepth 1 | LC_COLLATE=C.UTF-8 sort -t- -k2
+}
+
+function report_disk_usage {
+	read -r dub _ < <(du -sx -B1 /)
+	read -r duh _ < <(du -sx -h /)
+	printf '::notice::disk_usage bytes=%s human=%s\n' "$dub" "$duh" | tee -a /tmp/ansible.log
+}
+
+function setup_locale {
+	cat >>/etc/locale.gen <<-EOF
+		en_US.UTF-8 UTF-8
+	EOF
+	cat >/etc/default/locale <<-EOF
+		LANG="C.UTF-8"
+		LC_CTYPE="C.UTF-8"
+	EOF
+	locale-gen en_US.UTF-8
+}
+
+function setup_postgesql_env {
+	mkdir -p /etc/environment.d
+
+	tee /etc/environment.d/postgresql.env >/dev/null <<-EOF
+		LOCALE_ARCHIVE=/usr/lib/locale/locale-archive
+		LANG="en_US.UTF-8"
+		LANGUAGE="en_US.UTF-8"
+		LC_ALL="en_US.UTF-8"
+		LC_CTYPE="en_US.UTF-8"
+	EOF
+}
+
+function disable_sshd_passwd_auth {
+	sed -i -E \
+		-e 's/^#?\s*PasswordAuthentication\s+(yes|no)\s*$/PasswordAuthentication no/g' \
+		-e 's/^#?\s*ChallengeResponseAuthentication\s+(yes|no)\s*$/ChallengeResponseAuthentication no/g' \
+		/etc/ssh/sshd_config
+}
+
+function ensure_tmp_dir {
+	# https://github.com/digitalocean/marketplace-partners/issues/94
+	if [[ ! -d /tmp ]]; then
+		mkdir /tmp
+	fi
+	chmod 1777 /tmp
+}
+
+function scrub_history {
+	rm -rf /tmp/* /var/tmp/*
+	history -c
+	cat /dev/null >/root/.bash_history
+	unset HISTFILE
+}
+
+function scrub_logs_and_keys {
+	find /var/log -mtime -1 -type f -exec truncate -s 0 {} \;
+	rm -rf /var/log/*.gz /var/log/*.[0-9] /var/log/*-????????
+	rm -rf /var/lib/cloud/instances/*
+	rm -f /root/.ssh/authorized_keys /etc/ssh/*key*
+	touch /etc/ssh/revoked_keys
+	chmod 600 /etc/ssh/revoked_keys
+}
+
+function zero_free_space {
+	local root=${1:-}
+
+	cat <<-EOF
+		Writing zeros to the remaining disk space to securely erase the unused portion of the file system.
+		Depending on your disk size this may take several minutes.
+		The secure erase will complete successfully when you see:
+		    dd: writing to '/zerofile': No space left on device
+		Beginning secure erase now
+	EOF
+
+	dd if=/dev/zero of="$root/zerofile" &
+	PID=$!
+	while [ -d /proc/$PID ]; do
+		printf "."
+		sleep 5
+	done
+	sync
+	rm "$root/zerofile"
+	sync
+}
+
+function finalize_disk {
+	local root=${1:-} zero=${2:-true} trim=${3:-true}
+
+	if [[ $zero == true ]]; then
+		zero_free_space "$root"
+	fi
+	if [[ $trim == true ]]; then
+		fstrim "${root:-/}"
+	fi
+}
+
+function empty_login_records {
+	cat /dev/null >/var/log/lastlog
+	cat /dev/null >/var/log/wtmp
+}
+
+function setup_image_logs {
+	local root=${1:-} run=()
+	if [[ -n $root ]]; then
+		run=(chroot "$root")
+	fi
+
+	rm -rf "$root"/var/log/*
+	# https://github.com/fail2ban/fail2ban/issues/1593
+	touch "$root/var/log/auth.log"
+
+	touch "$root/var/log/pgbouncer.log"
+	"${run[@]}" chown pgbouncer:postgres /var/log/pgbouncer.log
+
+	mkdir -p "$root/var/log/postgresql"
+	"${run[@]}" chown postgres:postgres /var/log/postgresql
+
+	mkdir "$root/var/log/wal-g"
+	touch "$root"/var/log/wal-g/{backup-push.log,backup-fetch.log,wal-push.log,wal-fetch.log,pitr.log}
+
+	mkdir "$root/var/log/sysstat"
+
+	"${run[@]}" chown -R postgres:postgres /var/log/wal-g
+	# vector reads pitr.log; modes match the salt vector formula
+	"${run[@]}" chmod -R 0310 /var/log/wal-g
+	"${run[@]}" chmod 0340 /var/log/wal-g/pitr.log
+
+	mkdir "$root/var/log/audit"
+}
+
+function setup_apt {
+	export DEBIAN_FRONTEND=noninteractive
+}
+
+function add_apt_mirror_fallback {
+	# This function assumes deb822 formatted sources are in use, which is the case in both qemu and aws images
+	# In aws cloud-init creates a sources file with regional mirrors for "default" Suites but keeps ubuntu for security suite
+	# So we grab the first (only) URI from security and append it to non-security's URI
+	# This ends up giving us fastest mirror for installs and falls back to ubuntu if there's an issue
+	#
+	# Note: Ubuntu amd64 mirrors have different hostnames for security vs non but aarch64 are the same, hence the amd64 specific line
+
+	# ensure deb822 format sources are in use
+	tail -n+1 /etc/apt/sources.list /etc/apt/sources.list.d/ubuntu.sources >&2
+
+	local sources defmirror ubumirror
+	sources=$(grep -e '^URIs\s*:' -e '^Suites\s*:' /etc/apt/sources.list.d/ubuntu.sources)
+	defmirror=$(grep -B1 "$CODENAME-updates" <<<"$sources" | awk '/URIs/ {print $2}')
+	ubumirror=$(grep -B1 "$CODENAME-security" <<<"$sources" | awk '/URIs/ {print $2}')
+	if [[ $ARCH == amd64 ]]; then
+		# amd64 hosts use security.ubuntu.com for security but archive.ubuntu.com for everything else
+		ubumirror=${ubumirror/security/archive}
+	fi
+
+	if [[ $ubumirror == "$defmirror" ]]; then
+		# Only using one mirror so nothing to add as fallback, not running in AWS maybe?
+		return
+	fi
+
+	if grep -q "^URIs:.*$defmirror.*$ubumirror" /etc/apt/sources.list.d/ubuntu.sources; then
+		echo "Ubuntu upstream is already a fallback, this is unexpected and needs source changes" >&2
+		exit 1
+	fi
+	sed -i "s|$defmirror|& $ubumirror|" /etc/apt/sources.list.d/ubuntu.sources
+}
+
+function waitfor_boot_finished {
+	while [[ ! -f /var/lib/cloud/instance/boot-finished ]]; do
+		echo 'Waiting for cloud-init...'
+		sleep 1
+	done
+}
+
+function remove_unwanted_files {
+	local root=${1:-}
+
+	rm -rf "$root"/root/.cache
+	rm -rf "$root"/root/.vpython*
+	rm -rf "$root"/root/go
+	rm -rf "$root"/usr/share/doc
+}
+
+function purge_packages {
+	local common=(
+		ansible
+		autoconf
+		automake
+		autotools-dev
+		cmake-data
+		cpp-10
+		cpp-9
+		gcc-10
+		gcc-9
+		git
+		git-man
+		libcgal-dev
+		libgcc-9-dev
+		libicu-dev
+	)
+
+	apt-get --yes remove --purge "${common[@]}" "$@"
+	apt-get --yes autoremove
+	apt-get --yes autoclean
+	apt-get --yes update
+	apt-get --yes upgrade
+}
diff --git a/packer/scripts/qemu-bootstrap-nix.sh b/packer/scripts/qemu-bootstrap-nix.sh
index 8305d0b31c..fdbe33bf04 100755
--- a/packer/scripts/qemu-bootstrap-nix.sh
+++ b/packer/scripts/qemu-bootstrap-nix.sh
@@ -4,66 +4,15 @@ set -o errexit
 set -o pipefail
 set -o xtrace
 
+# shellcheck source=/dev/null
+source /tmp/provision-common.sh
+
 #################
 # stage1 things #
 #################
 
-function setup_apt {
-	export DEBIAN_FRONTEND=noninteractive
-
-	# This function assumes deb822 formatted sources are in use, which is the case in both qemu and aws images
-	# In aws cloud-init creates a sources file with regional mirrors for "default" Suites but keeps ubuntu for security suite
-	# So we grab the first (only) URI from security and append it to non-security's URI
-	# This ends up giving us fastest mirror for installs and falls back to ubuntu if there's an issue
-	#
-	# Note: Ubuntu amd64 mirrors have different hostnames for security vs non but aarch64 are the same, hence the amd64 specific line
-
-	# ensure deb822 format sources are in use
-	tail -n+1 /etc/apt/sources.list /etc/apt/sources.list.d/ubuntu.sources >&2
-
-	local sources defmirror ubumirror
-	sources=$(grep -e '^URIs\s*:' -e '^Suites\s*:' /etc/apt/sources.list.d/ubuntu.sources)
-	defmirror=$(grep -B1 "$CODENAME-updates" <<<"$sources" | awk '/URIs/ {print $2}')
-	ubumirror=$(grep -B1 "$CODENAME-security" <<<"$sources" | awk '/URIs/ {print $2}')
-	if [[ $ARCH == amd64 ]]; then
-		# amd64 hosts use security.ubuntu.com for security but archive.ubuntu.com for everything else
-		ubumirror=${ubumirror/security/archive}
-	fi
-
-	if [[ $ubumirror == "$defmirror" ]]; then
-		# Only using one mirror so nothing to add as fallback, not running in AWS maybe?
-		return
-	fi
-
-	if grep -q "^URIs:.*$defmirror.*$ubumirror" /etc/apt/sources.list.d/ubuntu.sources; then
-		echo "Ubuntu upstream is already a fallback, this is unexpected and needs source changes" >&2
-		exit 1
-	fi
-	sed -i "s|$defmirror|& $ubumirror|" /etc/apt/sources.list.d/ubuntu.sources
-}
-
-function cleanup_apt {
-	apt-get clean
-	apt-get autoremove --purge --yes
-	rm -rf /var/lib/apt/lists/*
-}
-
-function update_and_upgrade_apt {
-	apt-get update --yes
-	apt-get dist-upgrade --yes
-}
-
-function waitfor_boot_finished {
-	# Wait for cloudinit on the surrogate to complete before making progress
-	while [[ ! -f /var/lib/cloud/instance/boot-finished ]]; do
-		echo 'Waiting for cloud-init...'
-		sleep 1
-	done
-}
-
 function install_packages {
 	packages=(
-		ansible
 		arptables
 		e2fsprogs
 		ebtables
@@ -77,99 +26,24 @@ function install_packages {
 		ufw
 	)
 	apt-get install --yes "${packages[@]}"
-	ansible-galaxy collection install community.general
+	install_ansible
 }
 
 function execute_playbook {
-	sed -i 's/- hosts: all/- hosts: localhost/' ansible/playbook.yml
-
-	mkdir -p /etc/ansible
-	tee /etc/ansible/ansible.cfg <<-EOF
-		[defaults]
-		callbacks_enabled = timer, profile_tasks, profile_roles
-	EOF
-
-	# Run Ansible playbook
-	export ANSIBLE_LOG_PATH=/tmp/ansible.log && export ANSIBLE_REMOTE_TEMP=/mnt/tmp
-	ansible-playbook ./ansible/playbook.yml --extra-vars '{"stage2": false, "qemu": true}' \
-		--extra-vars "postgresql_version=postgresql_$POSTGRES_MAJOR_VERSION" \
-		--extra-vars "postgres_major_version=$POSTGRES_MAJOR_VERSION" \
-		--extra-vars "psql_version=psql_$POSTGRES_MAJOR_VERSION" \
-		--extra-vars @./ansible/qemu-vars.yaml
-}
-
-function setup_postgesql_env {
-	# Create the directory if it doesn't exist
-	mkdir -p /etc/environment.d
-
-	# Define the contents of the PostgreSQL environment file
-	tee /etc/environment.d/postgresql.env >/dev/null <<-EOF
-		LOCALE_ARCHIVE=/usr/lib/locale/locale-archive
-		LANG="en_US.UTF-8"
-		LANGUAGE="en_US.UTF-8"
-		LC_ALL="en_US.UTF-8"
-		LC_CTYPE="en_US.UTF-8"
-	EOF
-}
-
-function setup_locale {
-	cat >>/etc/locale.gen <<-EOF
-		en_US.UTF-8 UTF-8
-	EOF
-
-	cat >/etc/default/locale <<-EOF
-		LANG="C.UTF-8"
-		LC_CTYPE="C.UTF-8"
-	EOF
-	locale-gen en_US.UTF-8
+	run_playbook ./ansible/playbook.yml /mnt/tmp false true localhost local
 }
 
 #################
 # stage2 things #
 #################
 
-function install_nix() {
-	local nix_version=2.35.3
-	local nix_installer_sha256=69d0fe8fba8fe88f94c98b09964691ac9950abc7ecbf2ba861dc0533cfd901e9
-	local nix_installer
-	nix_installer=$(mktemp)
-	curl -fsSL "https://releases.nixos.org/nix/nix-${nix_version}/install" -o "$nix_installer"
-	echo "${nix_installer_sha256}  ${nix_installer}" | sha256sum -c -
-	sh "$nix_installer" --yes --daemon --nix-extra-conf-file <(
-		cat <<-EOF
-			extra-experimental-features = nix-command flakes
-			extra-substituters = https://nix-postgres-artifacts.s3.amazonaws.com
-			extra-trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=
-		EOF
-	)
-	rm -f "$nix_installer"
-
-	# shellcheck disable=SC1091
-	. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-	nix --version
-}
-
 function execute_stage2_playbook {
-	mkdir -p /etc/ansible
-	tee /etc/ansible/ansible.cfg <<-EOF
-		[defaults]
-		callbacks_enabled = timer, profile_tasks, profile_roles
-	EOF
-
-	# Run Ansible playbook
-	export ANSIBLE_LOG_PATH=/tmp/ansible.log && export ANSIBLE_REMOTE_TEMP=/tmp
-	ansible-playbook ./ansible/playbook.yml \
-		--extra-vars '{"stage2": true, "qemu": true}' \
-		--extra-vars "$NIX_STORE_PATHS" \
-		--extra-vars "postgresql_version=postgresql_$POSTGRES_MAJOR_VERSION" \
-		--extra-vars "postgres_major_version=$POSTGRES_MAJOR_VERSION" \
-		--extra-vars "psql_version=psql_$POSTGRES_MAJOR_VERSION" \
-		--extra-vars @./ansible/qemu-vars.yaml
+	run_playbook ./ansible/playbook.yml /tmp true true localhost local --extra-vars "$NIX_STORE_PATHS"
 }
 
 function clean_legacy_things {
 	# removes things that are bundled for legacy reasons, but we can start without for our newer artifacts
-	apt-mark auto zlib1g* # TODO (darora): need to make sure that there aren't other things that still need this
+	apt-mark auto zlib1g zlib1g-dev
 	apt-get purge --yes kong
 }
 
@@ -183,37 +57,9 @@ function clean_system {
 	chmod +x /tmp/cleanup-qemu.sh
 	/tmp/cleanup-qemu.sh
 
-	# Cleanup logs
-	rm -rf /var/log/*
-	# https://github.com/fail2ban/fail2ban/issues/1593
-	touch /var/log/auth.log
-
-	touch /var/log/pgbouncer.log
-	chown pgbouncer:postgres /var/log/pgbouncer.log
+	setup_image_logs
 
-	# Setup postgresql logs
-	mkdir -p /var/log/postgresql
-	chown postgres:postgres /var/log/postgresql
-	# Setup wal-g logs
-	mkdir /var/log/wal-g
-	touch /var/log/wal-g/{backup-push.log,backup-fetch.log,wal-push.log,wal-fetch.log,pitr.log}
-
-	# Creatre Sysstat directory for SAR
-	mkdir /var/log/sysstat
-
-	chown -R postgres:postgres /var/log/wal-g
-	# moving up fixes from init scripts
-	chmod -R 0310 /var/log/wal-g
-	chmod 0340 /var/log/wal-g/pitr.log
-
-	# audit logs directory for apparmor
-	mkdir /var/log/audit
-
-	# unwanted files
-	rm -rf /root/.cache
-	rm -rf /root/.vpython*
-	rm -rf /root/go
-	rm -rf /mnt/usr/share/doc
+	remove_unwanted_files
 
 	# remove passwords in user-data-cloudimg.img (required for Packer login)
 	usermod -p '*' ubuntu
@@ -221,10 +67,7 @@ function clean_system {
 
 	# Ensure that PasswordAuthentication is off
 	# From chroot-boostrap-nix.sh
-	sed -i -E \
-		-e 's/^#?\s*PasswordAuthentication\s+(yes|no)\s*$/PasswordAuthentication no/g' \
-		-e 's/^#?\s*ChallengeResponseAuthentication\s+(yes|no)\s*$/ChallengeResponseAuthentication no/g' \
-		/etc/ssh/sshd_config
+	disable_sshd_passwd_auth
 
 	if ! grep -qE "^PasswordAuthentication\s+no" /etc/ssh/sshd_config; then
 		echo "ERROR: PasswordAuthentication is not disabled in sshd_config"
@@ -232,23 +75,6 @@ function clean_system {
 	fi
 }
 
-function clean_nix {
-	nix-collect-garbage -d
-	nix-store --optimise -v
-}
-
-function report_packages {
-	# shellcheck disable=SC2016
-	dpkg-query -W -f='${Package}\t${Version}\t${Architecture}\n' | LC_COLLATE=C.UTF-8 sort
-	find /nix/store -maxdepth 1 | LC_COLLATE=C.UTF-8 sort -t- -k2
-}
-
-function report_disk_usage {
-	read -r dub _ < <(du -sx -B1 /)
-	read -r duh _ < <(du -sx -h /)
-	printf '::notice::disk_usage bytes=%s human=%s\n' "$dub" "$duh" | tee -a /tmp/ansible.log
-}
-
 #################
 # stage1 things #
 #################
@@ -261,6 +87,7 @@ CODENAME=$(source /etc/os-release && echo "$VERSION_CODENAME")
 
 waitfor_boot_finished
 setup_apt
+add_apt_mirror_fallback
 update_and_upgrade_apt
 install_packages
 setup_postgesql_env
@@ -279,3 +106,4 @@ clean_nix
 cleanup_apt
 report_packages
 report_disk_usage
+finalize_disk
diff --git a/packer/scripts/surrogate-bootstrap-nix.sh b/packer/scripts/surrogate-bootstrap-nix.sh
index 62351d1df2..625ee565da 100755
--- a/packer/scripts/surrogate-bootstrap-nix.sh
+++ b/packer/scripts/surrogate-bootstrap-nix.sh
@@ -10,64 +10,20 @@ set -o errexit
 set -o pipefail
 set -o xtrace
 
-exec 1>&2
-
-function setup_apt {
-	export DEBIAN_FRONTEND=noninteractive
-
-	# This function assumes deb822 formatted sources are in use, which is the case in both qemu and aws images
-	# In aws cloud-init creates a sources file with regional mirrors for "default" Suites but keeps ubuntu for security suite
-	# So we grab the first (only) URI from security and append it to non-security's URI
-	# This ends up giving us fastest mirror for installs and falls back to ubuntu if there's an issue
-	#
-	# Note: Ubuntu amd64 mirrors have different hostnames for security vs non but aarch64 are the same, hence the amd64 specific line
-
-	# ensure deb822 format sources are in use
-	tail -n+1 /etc/apt/sources.list /etc/apt/sources.list.d/ubuntu.sources >&2
-
-	local sources defmirror ubumirror
-	sources=$(grep -e '^URIs\s*:' -e '^Suites\s*:' /etc/apt/sources.list.d/ubuntu.sources)
-	defmirror=$(grep -B1 "$CODENAME-updates" <<<"$sources" | awk '/URIs/ {print $2}')
-	ubumirror=$(grep -B1 "$CODENAME-security" <<<"$sources" | awk '/URIs/ {print $2}')
-	if [[ $ARCH == amd64 ]]; then
-		# amd64 hosts use security.ubuntu.com for security but archive.ubuntu.com for everything else
-		ubumirror=${ubumirror/security/archive}
-	fi
-
-	if [[ $ubumirror == "$defmirror" ]]; then
-		# Only using one mirror so nothing to add as fallback, not running in AWS maybe?
-		return
-	fi
-
-	if grep -q "^URIs:.*$defmirror.*$ubumirror" /etc/apt/sources.list.d/ubuntu.sources; then
-		echo "Ubuntu upstream is already a fallback, this is unexpected and needs source changes" >&2
-		exit 1
-	fi
-	sed -i "s|$defmirror|& $ubumirror|" /etc/apt/sources.list.d/ubuntu.sources
-}
-
-function update_and_upgrade_apt {
-	apt-get update --yes
-	apt-get dist-upgrade --yes
-}
+# shellcheck source=/dev/null
+source /tmp/provision-common.sh
 
-function waitfor_boot_finished {
-	while [[ ! -f /var/lib/cloud/instance/boot-finished ]]; do
-		echo 'Waiting for cloud-init...'
-		sleep 1
-	done
-}
+exec 1>&2
 
 function install_packages {
 	packages=(
-		ansible
 		debootstrap
 		e2fsprogs
 		gdisk
 		nvme-cli
 	)
 	apt-get install --yes "${packages[@]}"
-	ansible-galaxy collection install community.general
+	install_ansible
 }
 
 # Partition the new root EBS volume
@@ -207,6 +163,7 @@ function setup_chroot_environment {
 	cp -r /tmp/migrations /mnt/tmp/
 
 	# Copy the bootstrap script into place and execute inside chroot
+	cp /tmp/provision-common.sh /mnt/tmp/provision-common.sh
 	cp /tmp/chroot-bootstrap-nix.sh /mnt/tmp/chroot-bootstrap-nix.sh
 	chroot /mnt /tmp/chroot-bootstrap-nix.sh
 	rm -f /mnt/tmp/chroot-bootstrap-nix.sh
@@ -234,24 +191,9 @@ function setup_chroot_environment {
 }
 
 function execute_playbook {
-	mkdir -p /etc/ansible
-	tee /etc/ansible/ansible.cfg <<-EOF
-		[defaults]
-		callbacks_enabled = timer, profile_tasks, profile_roles
-		pipelining = True
-	EOF
+	export ANSIBLE_PIPELINING=True
 
-	# Run Ansible playbook
-	# export ANSIBLE_DEBUG=True
-	export ANSIBLE_LOG_PATH=/tmp/ansible.log
-	export ANSIBLE_REMOTE_TEMP=/mnt/tmp
-
-	# shellcheck disable=SC2086
-	ansible-playbook -c chroot -i '/mnt,' /tmp/ansible-playbook/ansible/playbook.yml \
-		--extra-vars '{"stage2":false, "qemu":false} ' \
-		--extra-vars "postgres_major_version=$POSTGRES_MAJOR_VERSION" \
-		--extra-vars "psql_version=psql_$POSTGRES_MAJOR_VERSION" \
-		;
+	run_playbook /tmp/ansible-playbook/ansible/playbook.yml /mnt/tmp false false /mnt chroot
 }
 
 function update_systemd_services {
@@ -271,50 +213,19 @@ function update_systemd_services {
 
 function clean_system {
 	# Copy cleanup scripts
+	cp -v /tmp/provision-common.sh /mnt/tmp
 	cp -v /tmp/cleanup.sh /mnt/tmp
 	chmod +x /mnt/tmp/cleanup.sh
 	chroot /mnt /tmp/cleanup.sh
 
-	# Cleanup logs
-	rm -rf /mnt/var/log/*
-	# https://github.com/fail2ban/fail2ban/issues/1593
-	touch /mnt/var/log/auth.log
-
-	touch /mnt/var/log/pgbouncer.log
-	if [[ -f /usr/bin/chown ]]; then
-		chroot /mnt /usr/bin/chown pgbouncer:postgres /var/log/pgbouncer.log
-	fi
-
-	# Setup postgresql logs
-	mkdir -p /mnt/var/log/postgresql
-	if [[ -f /usr/bin/chown ]]; then
-		chroot /mnt /usr/bin/chown postgres:postgres /var/log/postgresql
-	fi
-
-	# Setup wal-g logs
-	mkdir /mnt/var/log/wal-g
-	touch /mnt/var/log/wal-g/{backup-push.log,backup-fetch.log,wal-push.log,wal-fetch.log,pitr.log}
-
-	#Creatre Sysstat directory for SAR
-	mkdir /mnt/var/log/sysstat
-
-	if [[ -f /usr/bin/chown ]]; then
-		chroot /mnt /usr/bin/chown -R postgres:postgres /var/log/wal-g
-		chroot /mnt /usr/bin/chmod -R 0300 /var/log/wal-g
-	fi
-
-	# audit logs directory for apparmor
-	mkdir /mnt/var/log/audit
+	setup_image_logs /mnt
 
-	# unwanted files
 	rm -rf /mnt/var/lib/apt/lists/*
-	rm -rf /mnt/root/.cache
-	rm -rf /mnt/root/.vpython*
-	rm -rf /mnt/root/go
-	rm -rf /mnt/usr/share/doc
+	remove_unwanted_files /mnt
+	finalize_disk /mnt true false
 }
 
-function report_packages {
+function report_chroot_packages {
 	# shellcheck disable=SC2016
 	chroot /mnt dpkg-query -W -f='${Package}\t${Version}\t${Architecture}\n' | LC_COLLATE=C.UTF-8 sort
 }
@@ -347,6 +258,7 @@ CODENAME=$(source /etc/os-release && echo "$VERSION_CODENAME")
 
 waitfor_boot_finished
 setup_apt
+add_apt_mirror_fallback
 update_and_upgrade_apt
 install_packages
 device_partition_mappings
@@ -356,5 +268,5 @@ setup_chroot_environment
 execute_playbook
 update_systemd_services
 clean_system
-report_packages
+report_chroot_packages
 umount_reset_mappings
diff --git a/packer/stage1-nix.pkr.hcl b/packer/stage1-nix.pkr.hcl
index 0129fc1a1a..7ee3c0b993 100644
--- a/packer/stage1-nix.pkr.hcl
+++ b/packer/stage1-nix.pkr.hcl
@@ -184,6 +184,11 @@ build {
     destination = "/tmp/70-ec2-nvme-devices.rules"
   }
 
+  provisioner "file" {
+    source      = "packer/scripts/provision-common.sh"
+    destination = "/tmp/provision-common.sh"
+  }
+
   provisioner "file" {
     source      = "packer/scripts/chroot-bootstrap-nix.sh"
     destination = "/tmp/chroot-bootstrap-nix.sh"
diff --git a/packer/stage2-nix.pkr.hcl b/packer/stage2-nix.pkr.hcl
index 8914050771..a181e25221 100644
--- a/packer/stage2-nix.pkr.hcl
+++ b/packer/stage2-nix.pkr.hcl
@@ -142,6 +142,11 @@ build {
     destination = "/tmp/ansible-playbook"
   }
 
+  provisioner "file" {
+    source      = "packer/scripts/provision-common.sh"
+    destination = "/tmp/provision-common.sh"
+  }
+
   provisioner "shell" {
     environment_vars = [
       "NIX_STORE_PATHS=${jsonencode({ nix_store_paths = var.nix_store_paths })}",