diff --git a/tests/ci/Makefile b/tests/ci/Makefile
--- a/tests/ci/Makefile
+++ b/tests/ci/Makefile
@@ -28,6 +28,7 @@
 KERNCONF?=	GENERIC
 LOCALBASE?=	/usr/local
 EXTRA_MAKE_FLAGS?=
+SU_CMD?=	/usr/bin/su root -c
 
 .if !defined(TARGET) || empty(TARGET)
 TARGET=		${MACHINE}
@@ -72,17 +73,18 @@
 CIIMAGE=	ci-${OSRELEASE}-${GITREV}-${KERNCONF}.${FORMAT}
 CIDISK?=	${.OBJDIR}/${CIIMAGE}
 VMSIZE?=	6g
+KYUA_TEST_FILTERS?=
 CITYPE?=	full
-META_TAR!=mktemp /tmp/meta.XXXXXX
-META_DIR!=mktemp -d /tmp/meta.XXXXXX
-META_DIROUT!=mktemp -d /tmp/meta.XXXXXX
-DISC_CAM!=truncate -s 128m /tmp/disk-cam
+.if !defined(META_TAR)
+META_TAR!=	mktemp /tmp/freebsdci_report.tar.XXXXXX
+META_DIR!=	mktemp -d /tmp/freebsdci_meta.XXXXXX
+META_DIROUT!=	mktemp -d /tmp/freebsdci_report.XXXXXX
+.endif
 EXTRA_DISK_NUM?=5
 DISK_NUMBERS!=jot - 1 ${EXTRA_DISK_NUM}
 BHYVE_EXTRA_DISK_PARAM?=
 BHYVE_EXTRA_DISK_PARAM+=-s 4:0,ahci-hd,/tmp/disk-cam
 .for i in ${DISK_NUMBERS}
-NEW_DISK!=truncate -s 128m /tmp/disk${i}
 BHYVE_EXTRA_DISK_PARAM+=-s $$((${i} + 4)):0,virtio-blk,/tmp/disk${i}
 CLEANFILES+=/tmp/disk${i}
 .endfor
@@ -134,9 +136,10 @@
 .endif
 
 CLEANFILES+=	${.OBJDIR}/${CIIMAGE} ${.OBJDIR}/ci.img ${META_TAR}
-CLEANDIRS+=	${.OBJDIR}/ci-buildimage
+IMAGEDIR=	${.OBJDIR}/ci-buildimage
+CLEANDIRS+=	${IMAGEDIR}
 
-portinstall: portinstall-pkg portinstall-qemu portinstall-expect portinstall-${TARGET_ARCH:tl} .PHONY
+portinstall: portinstall-qemu portinstall-expect portinstall-${TARGET_ARCH:tl} .PHONY
 
 portinstall-pkg: .PHONY
 .if !exists(/usr/local/sbin/pkg-static)
@@ -157,7 +160,7 @@
 .endif
 
 beforeclean: .PHONY
-	chflags -R noschg ${.OBJDIR}/${.TARGET}
+	chflags -R noschg ${IMAGEDIR}
 
 .include <bsd.obj.mk>
 clean: beforeclean .PHONY
@@ -171,8 +174,7 @@
 		${EXTRA_MAKE_FLAGS} buildworld > ${.CURDIR}/_.${TARGET_ARCH}.${.TARGET} 2>&1 || \
 		(echo "${.TARGET} failed, check _.${TARGET_ARCH}.${.TARGET} for details" ; false)
 
-
-ci-buildkernel: ci-buildworld-${TARGET_ARCH:tl} .PHONY
+ci-buildkernel: .PHONY
 	@echo "Building kernel for ${TARGET_ARCH}"
 	${IMAKE} -j${PARALLEL_JOBS} -C ${WORLDDIR} ${METAMODE} \
 		${CROSS_TOOLCHAIN_PARAM} __MAKE_CONF=${MAKECONF} SRCCONF=${SRCCONF} \
@@ -180,7 +182,7 @@
 		buildkernel > ${.CURDIR}/_.${TARGET_ARCH}.${.TARGET} 2>&1 || \
 		(echo "${.TARGET} failed, check _.${TARGET_ARCH}.${.TARGET} for details" ; false)
 
-ci-buildimage: ${QEMUTGT} ci-buildkernel-${TARGET_ARCH:tl} .PHONY
+ci-buildimage: ${QEMUTGT} .PHONY
 	@echo "Building ci image for ${TARGET_ARCH}"
 	mkdir -p ${.OBJDIR}/${.TARGET}
 	env TARGET=${TARGET} TARGET_ARCH=${TARGET_ARCH} SWAPSIZE=${SWAPSIZE} \
@@ -205,11 +207,20 @@
 
 ci-extract-meta: .PHONY
 	tar xfv ${META_TAR} -C ${META_DIROUT}
+	rm -rf ${META_TAR} ${META_DIR}
 	@echo "Extracted kyua reports to ${META_DIROUT}"
 
+ci-run-escalated: .PHONY
+	echo "===>  Switching to root credentials to run privilege escalated CI tasks."
+	${SU_CMD} "${IMAKE} -C ${.CURDIR} META_TAR=${META_TAR} META_DIR=${META_DIR} META_DIROUT=${META_DIROUT} ci-runtest-${TARGET_ARCH}"
+	echo "===>  Returning to user credentials."
+
 ci-runtest: ci-buildimage-${TARGET_ARCH:tl} portinstall .PHONY
 .if ${MACHINE} == "amd64" && ( ${TARGET_ARCH} == "amd64" || ${TARGET_ARCH} == "i386" ) && ( !defined(USE_QEMU) || empty(USE_QEMU) )
 	/usr/sbin/bhyvectl --vm=${TEST_VM_NAME} --destroy || true
+.for i in ${DISK_NUMBERS} -cam
+	truncate -s 128m /tmp/disk${i}
+.endfor
 	expect -c "set timeout ${TIMEOUT_EXPECT}; \
 		spawn /usr/bin/timeout -k 5s 30s /usr/sbin/bhyveload \
 		-c stdio -m ${VM_MEM_SIZE} -d ${CIDISK} ${TEST_VM_NAME}; \
@@ -252,10 +263,10 @@
 	@echo "Error: ${TARGET_ARCH} is not supported on ${TYPE} ${REVISION} ${BRANCH}"
 .endif
 
-ci-smoke: ci-set-smoke-var ci-create-meta ci-checktarget .WAIT ci-runtest-${TARGET_ARCH:tl} .PHONY
+ci-smoke: ci-set-smoke-var ci-create-meta ci-checktarget .WAIT ci-run-escalated .PHONY
 
-ci-full: ci-set-full-var ci-create-meta ci-checktarget .WAIT ci-runtest-${TARGET_ARCH:tl} ci-extract-meta .PHONY
+ci-full: ci-set-full-var ci-create-meta ci-checktarget .WAIT ci-run-escalated .WAIT ci-extract-meta .PHONY
 
-ci: ci-${CITYPE:tl} .PHONY
+ci: ci-buildworld-${TARGET_ARCH:tl} ci-buildkernel-${TARGET_ARCH:tl} ci-${CITYPE:tl} .PHONY
 
 .include "${RELEASEDIR}/Makefile.inc1"
diff --git a/tests/ci/tools/ci.conf b/tests/ci/tools/ci.conf
--- a/tests/ci/tools/ci.conf
+++ b/tests/ci/tools/ci.conf
@@ -11,11 +11,31 @@
 export VM_RC_LIST="auditd freebsdci"
 
 if [ "${CITYPE}" != "smoke" ]; then
-export VM_EXTRA_PACKAGES="coreutils devel/py-pytest gdb jq ksh93 net/py-dpkt net/scapy nist-kat nmap perl5 python python3 sudo sysutils/porch tcptestsuite"
-
-	if [ "${TARGET}" = "amd64" ]; then
-		export VM_EXTRA_PACKAGES="${VM_EXTRA_PACKAGES} linux-c7-ltp"
-	fi
+export VM_EXTRA_PACKAGES="
+archivers/gtar
+devel/git
+devel/gdb
+devel/py-pytest
+perl5
+lang/python
+lang/python3
+net/isc-dhcp44-server
+net/ndisc6
+net/py-dpkt
+net/scapy
+net/tcptestsuite
+security/nist-kat
+security/nmap
+security/openvpn
+security/sudo
+shells/ksh93
+sysutils/coreutils
+sysutils/porch
+sysutils/sg3_utils
+textproc/jq
+"
+# TODO waiting on packages to show up on 15-CURRENT
+#export VM_EXTRA_PACKAGES="${VM_EXTRA_PACKAGES} filesystems/ext2"
 fi
 
 vm_extra_pre_umount() {
@@ -37,39 +57,47 @@
 test_suites.FreeBSD.cam_test_device = '/dev/ada0'
 test_suites.FreeBSD.disks = '/dev/vtbd2 /dev/vtbd3 /dev/vtbd4 /dev/vtbd5 /dev/vtbd6'
 EOF
-cat << EOF >> ${DESTDIR}/etc/rc.conf
 kld_list=""				# Load modules needed by tests
+kld_list="${kld_list} accf_data"	# sys/kern/socket_accf
+kld_list="${kld_list} accf_dns"		# sys/kern/socket_accf
+kld_list="${kld_list} accf_http"	# sys/kern/socket_accf
+kld_list="${kld_list} accf_tls"		# sys/kern/socket_accf
 kld_list="${kld_list} blake2"		# sys/opencrypto
+kld_list="${kld_list} carp"		# sys/netinet/carp
 kld_list="${kld_list} cryptodev"	# sys/opencrypto
 kld_list="${kld_list} dummymbuf"	# sys/netpfil
+kld_list="${kld_list} dummynet"		# sys/netpfil/common
 kld_list="${kld_list} fusefs"		# sys/fs/fusefs
+kld_list="${kld_list} if_bridge"	# sys/net/if_bridge_test
+kld_list="${kld_list} if_enc"		# sys/netpfil/pf
+kld_list="${kld_list} if_epair"		# sys/net/if_epair_test
+kld_list="${kld_list} if_ovpn"		# sys/net/if_ovpn
+kld_list="${kld_list} if_stf"		# sys/net/if_stf
+kld_list="${kld_list} ipdivert"		# sys/netinet (loads ipdivert)
+kld_list="${kld_list} ipfw"		# sys/netpfil/ipfw (loads ipfw)
+kld_list="${kld_list} ipfw_nat"		# sys/netpfil/ipfw (loads ipfw_nat)
+kld_list="${kld_list} ipl"		# sys/sbin/ipf (loads ipfilter)
 kld_list="${kld_list} ipsec"		# sys/netipsec
+kld_list="${kld_list} mac_ipacl"	# sys/mac/ipacl
 kld_list="${kld_list} mac_portacl"	# sys/mac/portacl
 kld_list="${kld_list} mqueuefs"		# sys/kern/mqueue_test
+kld_list="${kld_list} pf"		# sys/netpfil/pf
+kld_list="${kld_list} pflog"		# sys/netpfil/pf
+kld_list="${kld_list} pflow"		# sys/netpfil/pf
 kld_list="${kld_list} pfsync"		# sys/netpfil/pf (loads pf)
-kld_list="${kld_list} pflog"		# sys/netpfil/pf
-kld_list="${kld_list} ipl"		# sys/sbin/ipf (loads ipfilter)
-kld_list="${kld_list} ipfw"		# sys/netpfil/ipfw (loads ipfw)
-kld_list="${kld_list} ipfw_nat"		# sys/netpfil/ipfw (loads ipfw_nat)
-kld_list="${kld_list} ipdivert"		# sys/netinet (loads ipdivert)
-kld_list="${kld_list} dummynet"		# sys/netpfil/common
-kld_list="${kld_list} carp"		# sys/netinet/carp
-kld_list="${kld_list} if_stf"		# sys/net/if_stf
-background_fsck="NO"
-sendmail_enable="NONE"
-cron_enable="NO"
-syslogd_enable="NO"
-newsyslog_enable="NO"
-EOF
-if [ "${CITYPE}" = "smoke" ]; then
-cat << EOF >> ${DESTDIR}/etc/rc.conf
-freebsdci_type="smoke"
-EOF
-elif [ "${CITYPE}" = "full" ]; then
-cat << EOF >> ${DESTDIR}/etc/rc.conf
-freebsdci_type="full"
-EOF
-fi
+kld_list="${kld_list} sctp"		# sys/netpfil/pf
+kld_list="${kld_list} tarfs"		# sys/fs/tarfs
+kld_list="${kld_list} tcpmd5"		# sys/netinet
+sysrc -f ${DESTDIR}/etc/rc.conf \
+	kld_list="${kld_list}" \
+	background_fsck="NO" \
+	sendmail_enable="NONE" \
+	cron_enable="NO" \
+	syslogd_enable="NO" \
+	newsyslog_enable="NO" \
+	freebsdci_type="${CITYPE}" \
+	freebsdci_test_filters="${KYUA_TEST_FILTERS}"
+
 cat << EOF >> ${DESTDIR}/etc/sysctl.conf
 kern.cryptodevallowsoft=1
 kern.ipc.tls.enable=1
diff --git a/tests/ci/tools/freebsdci b/tests/ci/tools/freebsdci
--- a/tests/ci/tools/freebsdci
+++ b/tests/ci/tools/freebsdci
@@ -25,9 +25,6 @@
 
 . /etc/rc.subr
 
-: ${freebsdci_enable:="NO"}
-: ${freebsdci_type:="full"}
-
 name="freebsdci"
 desc="Run FreeBSD CI"
 rcvar=freebsdci_enable
@@ -39,6 +36,12 @@
 metadir=/meta
 istar=$(file -s ${tardev} | grep "POSIX tar archive" | wc -l)
 
+load_rc_config $name
+: ${freebsdci_enable:="NO"}
+: ${freebsdci_type:="full"}
+: ${freebsdci_test_filters:=""}
+PATH="${PATH}:/usr/local/sbin:/usr/local/bin"
+
 auto_shutdown()
 {
 	# NOTE: Currently RISC-V kernels lack the ability to
@@ -75,7 +78,9 @@
 		tar xvf ${tardev} -C ${metadir}
 		cd /usr/tests
 		set +e
-		kyua -v parallelism=${parallelism} test
+		kyua \
+			-v parallelism=${parallelism} \
+			test ${freebsdci_test_filters}
 		rc=$?
 		set -e
 		if [ ${rc} -ne 0 ] && [ ${rc} -ne 1 ]; then
@@ -105,5 +110,4 @@
 	auto_shutdown
 }
 
-load_rc_config $name
 run_rc_command "$1"