diff --git a/release/tools/azure.conf b/release/tools/azure.conf
index e13b63067fee..7975e1db0822 100644
--- a/release/tools/azure.conf
+++ b/release/tools/azure.conf
@@ -1,56 +1,62 @@
 #!/bin/sh
 #
 #
 
 # Convention of Linux type VM on Azure is 30G
 export VMSIZE=30g
 
 # Set to a list of packages to install.
 export VM_EXTRA_PACKAGES="azure-agent python python3 firstboot-freebsd-update firstboot-pkgs"
 
 # Set to a list of third-party software to enable in rc.conf(5).
 export VM_RC_LIST="ntpd sshd waagent firstboot_freebsd_update firstboot_pkgs"
 
 # No swap space; waagent will allocate swap space on the resource disk.
 # See ResourceDisk.EnableSwap and ResourceDisk.SwapSizeMB in waagent.conf
 export NOSWAP=YES
 
 # https://learn.microsoft.com/en-us/partner-center/marketplace/azure-vm-certification-faq#vm-images-must-have-1-mb-of-free-space
 export VM_BOOTPARTSOFFSET=1M
 
 vm_extra_pre_umount() {
-	mount -t devfs devfs ${DESTDIR}/dev
-
-	# The firstboot_pkgs rc.d script will download the repository
-	# catalogue and install or update pkg when the instance first
-	# launches, so these files would just be replaced anyway; removing
-	# them from the image allows it to boot faster.
-	chroot ${DESTDIR} ${EMULATOR} env ASSUME_ALWAYS_YES=yes \
-		/usr/sbin/pkg delete -f -y pkg
-	rm -r ${DESTDIR}/var/db/pkg/repos/FreeBSD-ports
-	rm -r ${DESTDIR}/var/db/pkg/repos/FreeBSD-ports-kmods
-
-	chroot ${DESTDIR} ${EMULATOR} pw usermod root -h -
-
-	umount ${DESTDIR}/dev
+	# Remove the pkg package and repo databases as they will likely
+	# be out of date by the time the image is used.  In unprivileged
+	# builds this is unnecessary as pkg will not be installed to
+	# begin with.
+	if [ -z "${NO_ROOT}" ]; then
+		mount -t devfs devfs ${DESTDIR}/dev
+
+		# The firstboot_pkgs rc.d script will download the repository
+		# catalogue and install or update pkg when the instance first
+		# launches, so these files would just be replaced anyway; removing
+		# them from the image allows it to boot faster.
+		chroot ${DESTDIR} ${EMULATOR} env ASSUME_ALWAYS_YES=yes \
+			/usr/sbin/pkg delete -f -y pkg
+		umount ${DESTDIR}/dev
+		rm -r ${DESTDIR}/var/db/pkg/repos/FreeBSD-ports
+		rm -r ${DESTDIR}/var/db/pkg/repos/FreeBSD-ports-kmods
+	fi
+
+	pw -R ${DESTDIR} usermod root -h -
 
 	cat << EOF >> ${DESTDIR}/etc/rc.conf
 ifconfig_hn0="SYNCDHCP"
 ntpd_sync_on_start="YES"
 EOF
 
 	cat << EOF >> ${DESTDIR}/boot/loader.conf
 autoboot_delay="-1"
 beastie_disable="YES"
 loader_logo="none"
 hw.memtest.tests="0"
 console="comconsole efi vidconsole"
 comconsole_speed="115200"
 boot_multicons="YES"
 boot_serial="YES"
 mlx4en_load="YES"
 mlx5en_load="YES"
 EOF
+	metalog_add_data ./boot/loader.conf
 
 	return 0
 }