diff --git a/mkosi.build b/mkosi.build
index 6fed078fef5..7b50a60db75 100755
--- a/mkosi.build
+++ b/mkosi.build
@@ -5,9 +5,6 @@ set -e
 # This is a build script for OS image generation using mkosi (https://github.com/systemd/mkosi).
 # Simply invoke "mkosi" in the project directory to build an OS image.
 
-ASAN_OPTIONS=strict_string_checks=1:detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1:disable_coredump=0:use_madv_dontdump=1
-UBSAN_OPTIONS=print_stacktrace=1:print_summary=1:halt_on_error=1
-
 # If mkosi.builddir/ exists mkosi will set $BUILDDIR to it, let's then use it
 # as out-of-tree build dir. Otherwise, let's make up our own builddir.
 [ -z "$BUILDDIR" ] && BUILDDIR="$PWD"/build
@@ -153,8 +150,8 @@ cd "$BUILDDIR"
 ninja "$@"
 if [ "$WITH_TESTS" = 1 ] ; then
     if [ -n "$SANITIZERS" ]; then
-        export ASAN_OPTIONS="$ASAN_OPTIONS"
-        export UBSAN_OPTIONS="$UBSAN_OPTIONS"
+        export ASAN_OPTIONS="$MKOSI_ASAN_OPTIONS"
+        export UBSAN_OPTIONS="$MKOSI_UBSAN_OPTIONS"
         TIMEOUT_MULTIPLIER=3
     else
         TIMEOUT_MULTIPLIER=1
@@ -166,84 +163,6 @@ cd "$SRCDIR"
 
 meson install -C "$BUILDDIR" --quiet --no-rebuild --only-changed
 
-mkdir -p "$DESTDIR"/etc
-
-cat >"$DESTDIR"/etc/issue <<EOF
-\S (built from systemd tree)
-Kernel \r on an \m (\l)
-
-EOF
-
-if [ -n "$IMAGE_ID" ] ; then
-    mkdir -p "$DESTDIR"/usr/lib
-    sed -n \
-        -e '/^IMAGE_ID=/!p' \
-        -e "\$aIMAGE_ID=$IMAGE_ID" <"/usr/lib/os-release" >"${DESTDIR}/usr/lib/os-release"
-
-    OSRELEASEFILE="$DESTDIR"/usr/lib/os-release
-else
-    OSRELEASEFILE=/usr/lib/os-release
-fi
-
-
-if [ -n "$IMAGE_VERSION" ] ; then
-    mkdir -p "$DESTDIR"/usr/lib
-    sed -n \
-        -e '/^IMAGE_VERSION=/!p' \
-        -e "\$aIMAGE_VERSION=$IMAGE_VERSION" <$OSRELEASEFILE >"/tmp/os-release.tmp"
-
-    cat /tmp/os-release.tmp >"$DESTDIR"/usr/lib/os-release
-    rm /tmp/os-release.tmp
-fi
-
-# If $CI_BUILD is set, copy over the CI service which executes a service check
-# after boot and then shuts down the machine
-if [ -n "$CI_BUILD" ]; then
-    mkdir -p "$DESTDIR/usr/lib/systemd/system"
-    cp -v "$SRCDIR/test/mkosi-check-and-shutdown.service" "$DESTDIR/usr/lib/systemd/system/mkosi-check-and-shutdown.service"
-    cp -v "$SRCDIR/test/mkosi-check-and-shutdown.sh" "$DESTDIR/usr/lib/systemd/mkosi-check-and-shutdown.sh"
-    chmod +x "$DESTDIR/usr/lib/systemd/mkosi-check-and-shutdown.sh"
-fi
-
-if [ -n "$SANITIZERS" ]; then
-    LD_PRELOAD=$(ldd "$BUILDDIR"/systemd | grep libasan.so | awk '{print $3}')
-
-    mkdir -p "$DESTDIR/etc/systemd/system.conf.d"
-
-    cat >"$DESTDIR/etc/systemd/system.conf.d/10-asan.conf" <<EOF
-[Manager]
-ManagerEnvironment=ASAN_OPTIONS=$ASAN_OPTIONS\\
-                   UBSAN_OPTIONS=$UBSAN_OPTIONS\\
-                   LD_PRELOAD=$LD_PRELOAD
-DefaultEnvironment=ASAN_OPTIONS=$ASAN_OPTIONS\\
-                   UBSAN_OPTIONS=$UBSAN_OPTIONS\\
-                   LD_PRELOAD=$LD_PRELOAD
-EOF
-
-    # ASAN logs to stderr by default. However, journald's stderr is connected to /dev/null, so we lose
-    # all the ASAN logs. To rectify that, let's connect journald's stdout to the console so that any
-    # sanitizer failures appear directly on the user's console.
-    mkdir -p "$DESTDIR/etc/systemd/system/systemd-journald.service.d"
-
-    cat >"$DESTDIR/etc/systemd/system/systemd-journald.service.d/10-stdout-tty.conf" <<EOF
-[Service]
-StandardOutput=tty
-EOF
-
-    # Both systemd and util-linux's login call vhangup() on /dev/console which disconnects all users.
-    # This means systemd-journald can't log to /dev/console even if we configure `StandardOutput=tty`. As
-    # a workaround, we modify console-getty.service to disable systemd's vhangup() and disallow login
-    # from calling vhangup() so that journald's ASAN logs correctly end up in the console.
-
-    mkdir -p "$DESTDIR/etc/systemd/system/console-getty.service.d"
-
-    cat >"$DESTDIR/etc/systemd/system/console-getty.service.d/10-no-vhangup.conf" <<EOF
-[Service]
-TTYVHangup=no
-CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
-EOF
-fi
-
 if [ -d mkosi.kernel/ ]; then
     cd "$SRCDIR/mkosi.kernel"
     mkdir -p "$BUILDDIR/mkosi.kernel"
diff --git a/mkosi.conf.d/10-systemd.conf b/mkosi.conf.d/10-systemd.conf
index 57db7ecda90..0eeee89052a 100644
--- a/mkosi.conf.d/10-systemd.conf
+++ b/mkosi.conf.d/10-systemd.conf
@@ -4,8 +4,10 @@
 
 [Output]
 Bootable=yes
-# Prevent ASAN warnings when building the image
+# Prevent ASAN warnings when building the image and ship the real ASAN options prefixed with MKOSI_.
 Environment=ASAN_OPTIONS=verify_asan_link_order=false
+            MKOSI_ASAN_OPTIONS=strict_string_checks=1:detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1:disable_coredump=0:use_madv_dontdump=1
+            MKOSI_UBSAN_OPTIONS=print_stacktrace=1:print_summary=1:halt_on_error=1
 OutputDirectory=mkosi.output
 
 [Content]
diff --git a/mkosi.extra/etc/issue b/mkosi.extra/etc/issue
new file mode 100644
index 00000000000..6aa6fc0ec06
--- /dev/null
+++ b/mkosi.extra/etc/issue
@@ -0,0 +1,2 @@
+\S (built from systemd tree)
+Kernel \r on an \m (\l)
diff --git a/test/mkosi-check-and-shutdown.service b/mkosi.extra/etc/systemd/system/mkosi-check-and-shutdown.service
similarity index 100%
rename from test/mkosi-check-and-shutdown.service
rename to mkosi.extra/etc/systemd/system/mkosi-check-and-shutdown.service
diff --git a/test/mkosi-check-and-shutdown.sh b/mkosi.extra/etc/systemd/system/mkosi-check-and-shutdown.sh
old mode 100644
new mode 100755
similarity index 100%
rename from test/mkosi-check-and-shutdown.sh
rename to mkosi.extra/etc/systemd/system/mkosi-check-and-shutdown.sh
diff --git a/mkosi.extra/root/.gdbinit b/mkosi.extra/root/.gdbinit
new file mode 100644
index 00000000000..522e1fecb65
--- /dev/null
+++ b/mkosi.extra/root/.gdbinit
@@ -0,0 +1,2 @@
+set debuginfod enabled off
+set build-id-verbose 0
diff --git a/mkosi.postinst b/mkosi.postinst
index fc2aeabf4e7..0a6946e6002 100755
--- a/mkosi.postinst
+++ b/mkosi.postinst
@@ -2,12 +2,41 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 
 if [ "$1" = "final" ]; then
-    cat >>/root/.gdbinit <<EOF
-set debuginfod enabled off
-set build-id-verbose 0
+    if [ -n "$SANITIZERS" ]; then
+        LD_PRELOAD=$(ldd /usr/lib/systemd/systemd | grep libasan.so | awk '{print $3}')
+
+        mkdir -p /etc/systemd/system.conf.d
+
+        cat >/etc/systemd/system.conf.d/10-asan.conf <<EOF
+[Manager]
+ManagerEnvironment=ASAN_OPTIONS=$MKOSI_ASAN_OPTIONS\\
+                   UBSAN_OPTIONS=$MKOSI_UBSAN_OPTIONS\\
+                   LD_PRELOAD=$LD_PRELOAD
+DefaultEnvironment=ASAN_OPTIONS=$MKOSI_ASAN_OPTIONS\\
+                   UBSAN_OPTIONS=$MKOSI_UBSAN_OPTIONS\\
+                   LD_PRELOAD=$LD_PRELOAD
 EOF
 
-    if [ -n "$SANITIZERS" ]; then
+        # ASAN logs to stderr by default. However, journald's stderr is connected to /dev/null, so we lose
+        # all the ASAN logs. To rectify that, let's connect journald's stdout to the console so that any
+        # sanitizer failures appear directly on the user's console.
+        mkdir -p /etc/systemd/system/systemd-journald.service.d
+        cat >/etc/systemd/system/systemd-journald.service.d/10-stdout-tty.conf <<EOF
+[Service]
+StandardOutput=tty
+EOF
+
+        # Both systemd and util-linux's login call vhangup() on /dev/console which disconnects all users.
+        # This means systemd-journald can't log to /dev/console even if we configure `StandardOutput=tty`. As
+        # a workaround, we modify console-getty.service to disable systemd's vhangup() and disallow login
+        # from calling vhangup() so that journald's ASAN logs correctly end up in the console.
+
+        mkdir -p /etc/systemd/system/console-getty.service.d
+        cat >/etc/systemd/system/console-getty.service.d/10-no-vhangup.conf <<EOF
+[Service]
+TTYVHangup=no
+CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
+EOF
         # ASAN and syscall filters aren't compatible with each other.
         find / -name '*.service' -type f -exec sed -i 's/^\(MemoryDeny\|SystemCall\)/# \1/' {} +
 
@@ -17,4 +46,20 @@ EOF
 
     # Make sure dnsmasq.service doesn't start on boot on Debian/Ubuntu.
     rm -f /etc/systemd/system/multi-user.target.wants/dnsmasq.service
+
+    if [ -n "$IMAGE_ID" ] ; then
+        sed -n \
+            -i \
+            -e '/^IMAGE_ID=/!p' \
+            -e "\$aIMAGE_ID=$IMAGE_ID" \
+            /usr/lib/os-release
+    fi
+
+    if [ -n "$IMAGE_VERSION" ] ; then
+        sed -n \
+            -i \
+            -e '/^IMAGE_VERSION=/!p' \
+            -e "\$aIMAGE_VERSION=$IMAGE_VERSION" \
+            /usr/lib/os-release
+    fi
 fi