diff --git a/tests/ci/Makefile b/tests/ci/Makefile
--- a/tests/ci/Makefile
+++ b/tests/ci/Makefile
@@ -28,6 +28,7 @@
 KERNCONF?=	GENERIC
 LOCALBASE?=	/usr/local
 EXTRA_MAKE_FLAGS?=
+SU_CMD?=	/usr/bin/su root -c
 
 .if !defined(TARGET) || empty(TARGET)
 TARGET=		${MACHINE}
@@ -185,14 +186,18 @@
 ci-buildimage: ${QEMUTGT} ci-buildkernel-${TARGET_ARCH:tl} .PHONY
 	@echo "Building ci image for ${TARGET_ARCH}"
 	mkdir -p ${.OBJDIR}/${.TARGET}
-	env TARGET=${TARGET} TARGET_ARCH=${TARGET_ARCH} SWAPSIZE=${SWAPSIZE} \
+	echo "===>  Switching to root credentials to run 'mk-vmimage.sh'"
+	${SU_CMD} 'env \
+		TARGET=${TARGET} TARGET_ARCH=${TARGET_ARCH} SWAPSIZE=${SWAPSIZE} \
 		QEMUSTATIC=${QEMUSTATIC} CITYPE=${CITYPE} \
 		${RELEASEDIR}/scripts/mk-vmimage.sh \
 		-C ${RELEASEDIR}/tools/vmimage.subr -d ${.OBJDIR}/${.TARGET} -F ${VMFS} \
 		-i ${.OBJDIR}/ci.img -s ${VMSIZE} -f ${FORMAT} \
 		-S ${WORLDDIR} -o ${.OBJDIR}/${CIIMAGE} -c ${CICONF} \
 		> ${.CURDIR}/_.${TARGET_ARCH}.${.TARGET} 2>&1 || \
-		(echo "${.TARGET} failed, check _.${TARGET_ARCH}.${.TARGET} for details" ; false)
+		(echo "${.TARGET} failed, check _.${TARGET_ARCH}.${.TARGET} for details" ; false) \
+	'
+	echo "===>  Returning to user credentials."
 	touch ${.TARGET}
 
 ci-set-smoke-var: .PHONY
@@ -207,28 +212,33 @@
 
 ci-extract-meta: .PHONY
 	tar xfv ${META_TAR} -C ${META_DIROUT}
+	rm -rf ${META_TAR} ${META_DIR}
 	@echo "Extracted kyua reports to ${META_DIROUT}"
 
 ci-runtest: ci-buildimage-${TARGET_ARCH:tl} portinstall .PHONY
 .if ${MACHINE} == "amd64" && ( ${TARGET_ARCH} == "amd64" || ${TARGET_ARCH} == "i386" ) && ( !defined(USE_QEMU) || empty(USE_QEMU) )
-	/usr/sbin/bhyvectl --vm=${TEST_VM_NAME} --destroy || true
-	expect -c "set timeout ${TIMEOUT_EXPECT}; \
-		spawn /usr/bin/timeout -k 5s 30s /usr/sbin/bhyveload \
-		-c stdio -m ${VM_MEM_SIZE} -d ${CIDISK} ${TEST_VM_NAME}; \
-		expect { eof }; \
-		exit [lindex [wait] 3]"
-	expect -c "set timeout ${TIMEOUT_EXPECT}; \
-		spawn /usr/bin/timeout -k 60 ${TIMEOUT_VM} /usr/sbin/bhyve \
-		-c ${PARALLEL_JOBS} -m ${VM_MEM_SIZE} -A -H -P \
-		-s 0:0,hostbridge \
-		-s 1:0,lpc \
-		-s 2:0,virtio-blk,${CIDISK} \
-		-s 3:0,virtio-blk,${META_TAR} \
-		${BHYVE_EXTRA_DISK_PARAM} \
-		-l com1,stdio \
-		${TEST_VM_NAME}; \
-		expect { eof }"
-	/usr/sbin/bhyvectl --vm=${TEST_VM_NAME} --destroy
+	echo "===>  Switching to root credentials to run bhyve commands."
+	${SU_CMD} '\
+		/usr/sbin/bhyvectl --vm=${TEST_VM_NAME} --destroy || true; \
+		expect -c "set timeout ${TIMEOUT_EXPECT}; \
+			spawn /usr/bin/timeout -k 5s 30s /usr/sbin/bhyveload \
+			-c stdio -m ${VM_MEM_SIZE} -d ${CIDISK} ${TEST_VM_NAME}; \
+			expect { eof }; \
+			exit [lindex [wait] 3]"; \
+		expect -c "set timeout ${TIMEOUT_EXPECT}; \
+			spawn /usr/bin/timeout -k 60 ${TIMEOUT_VM} /usr/sbin/bhyve \
+			-c ${PARALLEL_JOBS} -m ${VM_MEM_SIZE} -A -H -P \
+			-s 0:0,hostbridge \
+			-s 1:0,lpc \
+			-s 2:0,virtio-blk,${CIDISK} \
+			-s 3:0,virtio-blk,${META_TAR} \
+			${BHYVE_EXTRA_DISK_PARAM} \
+			-l com1,stdio \
+			${TEST_VM_NAME}; \
+			expect { eof }"; \
+		/usr/sbin/bhyvectl --vm=${TEST_VM_NAME} --destroy; \
+	'
+	echo "===>  Returning to user credentials."
 .else
 	timeout -k 60 ${TIMEOUT_VM} ${QEMUBIN} \
 		-machine ${QEMU_MACHINE} \
@@ -256,7 +266,7 @@
 
 ci-smoke: ci-set-smoke-var ci-create-meta ci-checktarget .WAIT ci-runtest-${TARGET_ARCH:tl} .PHONY
 
-ci-full: ci-set-full-var ci-create-meta ci-checktarget .WAIT ci-runtest-${TARGET_ARCH:tl} ci-extract-meta .PHONY
+ci-full: ci-set-full-var ci-create-meta ci-checktarget .WAIT ci-runtest-${TARGET_ARCH:tl} .WAIT ci-extract-meta .PHONY
 
 ci: ci-${CITYPE:tl} .PHONY