diff --git a/xtask/src/ci/firecracker.rs b/xtask/src/ci/firecracker.rs
index f34eb019..726fca84 100644
--- a/xtask/src/ci/firecracker.rs
+++ b/xtask/src/ci/firecracker.rs
@@ -1,3 +1,4 @@
+use std::env;
 use std::path::Path;
 
 use anyhow::Result;
@@ -9,6 +10,10 @@ use crate::build::Build;
 /// Run hermit-rs images on Firecracker.
 #[derive(Args)]
 pub struct Firecracker {
+	/// Run Firecracker using `sudo`.
+	#[arg(long)]
+	sudo: bool,
+
 	#[command(flatten)]
 	build: Build,
 
@@ -34,9 +39,17 @@ impl Firecracker {
 		let config_path = Path::new("firecracker_vm_config.json");
 		sh.write_file(config_path, config)?;
 
+		let firecracker = env::var("FIRECRACKER").unwrap_or_else(|_| "firecracker".to_string());
+		let program = if self.sudo {
+			"sudo"
+		} else {
+			firecracker.as_str()
+		};
+		let arg = self.sudo.then_some(firecracker.as_str());
+
 		let log_path = Path::new("firecracker.log");
 		sh.write_file(log_path, "")?;
-		cmd!(sh, "firecracker --no-api --config-file {config_path} --log-path {log_path} --level Info --show-level --show-log-origin").run()?;
+		cmd!(sh, "{program} {arg...} --no-api --config-file {config_path} --log-path {log_path} --level Info --show-level --show-log-origin").run()?;
 		let log = sh.read_file(log_path)?;
 
 		eprintln!("firecracker log");
diff --git a/xtask/src/ci/qemu.rs b/xtask/src/ci/qemu.rs
index 91b2aa74..3b9e757e 100644
--- a/xtask/src/ci/qemu.rs
+++ b/xtask/src/ci/qemu.rs
@@ -16,6 +16,10 @@ pub struct Qemu {
 	#[arg(long)]
 	accel: bool,
 
+	/// Run QEMU using `sudo`.
+	#[arg(long)]
+	sudo: bool,
+
 	/// Enable the `microvm` machine type.
 	#[arg(long)]
 	microvm: bool,
@@ -60,9 +64,11 @@ impl Qemu {
 
 		let target = self.build.target();
 		let arch = target.arch();
-		let qemu = env::var_os("QEMU").unwrap_or_else(|| format!("qemu-system-{arch}").into());
+		let qemu = env::var("QEMU").unwrap_or_else(|_| format!("qemu-system-{arch}"));
+		let program = if self.sudo { "sudo" } else { qemu.as_str() };
+		let arg = self.sudo.then_some(qemu.as_str());
 
-		let qemu = cmd!(sh, "{qemu}")
+		let qemu = cmd!(sh, "{program} {arg...}")
 			.args(&["-display", "none"])
 			.args(&["-serial", "stdio"])
 			.args(self.machine_args())