diff --git a/.buildkite/hooks/pre-command b/.buildkite/hooks/pre-command
index 53225aeaf..a64a82e73 100644
--- a/.buildkite/hooks/pre-command
+++ b/.buildkite/hooks/pre-command
@@ -13,8 +13,8 @@ function install_pkgs() {
   done
 }
 install_pkgs make linux-libc-dev graphviz jq curl binutils gnupg gnupg-agent \
-  gcc pkg-config apt-transport-https ca-certificates software-properties-common \
-  rsync kmod
+  gcc pkg-config apt-transport-https ca-certificates \
+  software-properties-common rsync kmod systemd
 
 # Install headers, only if available.
 if test -n "$(apt-cache search --names-only "^linux-headers-$(uname -r)$")"; then
@@ -34,9 +34,20 @@ export TOTAL_PARTITIONS=${BUILDKITE_PARALLEL_JOB_COUNT:-1}
 export RUNTIME="${BUILDKITE_BRANCH}-${BUILDKITE_BUILD_ID}"
 
 # Ensure Docker has experimental enabled.
-EXPERIMENTAL=$(sudo docker version --format='{{.Server.Experimental}}')
-make sudo TARGETS=//runsc:runsc \
-  ARGS="install --experimental=true --runtime=${RUNTIME} -- ${RUNTIME_ARGS:-}"
+if [[ -n "${STAGED_BINARIES:-}" ]]; then
+  # Used `runsc` from STAGED_BINARIES instead of building it from scratch.
+  tmpdir="$(mktemp -d)"
+  gsutil cat "$(STAGED_BINARIES)" | tar -C "$tmpdir" -zxvf - runsc
+  chmod +x "$tmpdir/runsc"
+  "$tmpdir/runsc" install --experimental=true --runtime="${RUNTIME}" \
+    -- "${RUNTIME_ARGS:-}"
+  rm -rf "$tmpdir"
+else
+  make sudo TARGETS=//runsc:runsc \
+    ARGS="install --experimental=true --runtime=${RUNTIME} -- ${RUNTIME_ARGS:-}"
+fi
+# WARNING: We may be running in a container when this command executes.
+# This only makes sense if Docker's `live-restore` feature is enabled.
 sudo systemctl restart docker
 
 # Helper for benchmarks, based on the branch.
diff --git a/tools/bazel.mk b/tools/bazel.mk
index 37d9ea9de..4d3a71bc8 100644
--- a/tools/bazel.mk
+++ b/tools/bazel.mk
@@ -111,6 +111,16 @@ DOCKER_RUN_OPTIONS += -v "$(KERNEL_HEADERS_DIR_LINKED):$(KERNEL_HEADERS_DIR_LINK
 endif
 endif
 
+# Same for systemd-related files and directories. This allows control of systemd
+# from within the container, which is useful for tests that need to e.g. restart
+# docker.
+ifneq (,$(wildcard /run/systemd/system))
+DOCKER_RUN_OPTIONS += -v "/run/systemd/system:/run/systemd/system"
+endif
+ifneq (,$(wildcard /var/run/dbus/system_bus_socket))
+DOCKER_RUN_OPTIONS += -v "/var/run/dbus/system_bus_socket:/var/run/dbus/system_bus_socket"
+endif
+
 # Add basic UID/GID options.
 #
 # Note that USERADD_DOCKER and GROUPADD_DOCKER are both defined as "deferred"