diff --git a/debian/postinst b/debian/postinst
index 4679ad2..0e30b14 100755
--- a/debian/postinst
+++ b/debian/postinst
@@ -1,43 +1,7 @@
 #!/bin/sh -e
 
-# Remove leftover bootstrap log files.
-rm -f /var/log/bootstrap.log
-
-# Fix up our hostname and make sure it can be resolved to something sane
-echo mendel >/etc/hostname
-echo 127.0.0.1 mendel >>/etc/hosts
-
 # We need spidev stuff loaded so that we get SPI access
 # XXX: Should this live here? Seems specific to a particular board.
 echo spidev >> /etc/modules
 
-# Choose a locale and regenerate it to eliminate LC warnings.
-echo en_US.UTF-8 UTF-8 >/etc/locale.gen
-locale-gen
-echo LANG=en_US.UTF-8 >/etc/locale.conf
-
-# Add the mendel user and give them all the access they need.
-if ! grep -qE '^mendel:' /etc/passwd; then
-    adduser mendel --home /home/mendel --shell /bin/bash --disabled-password --gecos ""
-
-    mkdir -p /home/mendel
-    chown mendel:mendel /home/mendel
-    echo 'mendel:mendel' |chpasswd
-fi
-
-# Create group apex to give mendel user r/w privileges to apex devices
-if ! grep -qE '^apex:' /etc/group; then
-    groupadd apex
-fi
-
-GROUPS="adm audio bluetooth games i2c input plugdev staff sudo users video netdev systemd-journal apex"
-
-for group in $GROUPS; do
-	adduser mendel $group
-done
-
-if ! grep -q mendel /etc/sudoers; then
-    echo 'mendel ALL=(ALL) NOPASSWD: ALL' >>/etc/sudoers
-fi
-
 #DEBHELPER#
diff --git a/etc/runonce.d/00-rootfs-cleanups b/etc/runonce.d/00-rootfs-cleanups
new file mode 100755
index 0000000..d7ca1ad
--- /dev/null
+++ b/etc/runonce.d/00-rootfs-cleanups
@@ -0,0 +1,30 @@
+#!/bin/bash -e
+
+# Remove leftover bootstrap log files.
+rm -f /var/log/bootstrap.log  >>/var/log/rootfs-cleanups.log
+
+# Choose a locale and regenerate it to eliminate LC warnings.
+echo en_US.UTF-8 UTF-8 >/etc/locale.gen
+locale-gen 2>&1 >>/var/log/rootfs-cleanups.log
+echo LANG=en_US.UTF-8 >/etc/locale.conf
+
+# Add the mendel user and give them all the access they need.
+if ! grep -qE '^mendel:' /etc/passwd; then
+    adduser mendel --home /home/mendel --shell /bin/bash --disabled-password --gecos ""  2>&1 >>/var/log/rootfs-cleanups.log
+
+    mkdir -p /home/mendel  2>&1 >>/var/log/rootfs-cleanups.log
+    chown mendel:mendel /home/mendel  2>&1 >>/var/log/rootfs-cleanups.log
+    echo 'mendel:mendel' |chpasswd  2>&1 >>/var/log/rootfs-cleanups.log
+fi
+
+# Create group apex to give mendel user r/w privileges to apex devices
+if ! grep -qE '^apex:' /etc/group; then
+    groupadd apex 2>&1 >>/var/log/rootfs-cleanups.log
+fi
+
+MENDEL_GROUPS="adm audio bluetooth games i2c input plugdev staff sudo users video netdev systemd-journal apex"
+
+for i in $MENDEL_GROUPS; do
+    echo "runonce: adding mendel to $i" 2>&1 >>/var/log/rootfs-cleanups.log
+	adduser mendel $i 2>&1 >>/var/log/rootfs-cleanups.log
+done
diff --git a/etc/runonce.d/99-mendel-sudo b/etc/runonce.d/99-mendel-sudo
new file mode 100755
index 0000000..94e24ec
--- /dev/null
+++ b/etc/runonce.d/99-mendel-sudo
@@ -0,0 +1,6 @@
+#!/bin/bash
+
+# Add the mendel user to the sudoers file if they're not there
+if ! grep -q mendel /etc/sudoers; then
+    echo 'mendel ALL=(ALL) NOPASSWD: ALL' >>/etc/sudoers
+fi