diff --git a/02_configure_host.sh b/02_configure_host.sh
index 1b1ff9264..a23dc9997 100755
--- a/02_configure_host.sh
+++ b/02_configure_host.sh
@@ -97,6 +97,29 @@ if [[ "${NODES_PLATFORM}" == "baremetal" ]]; then
 
     switch_to_internal_dns
 
+    # Add a /etc/hosts entry for $LOCAL_REGISTRY_DNS_NAME
+    sudo sed -i "/${LOCAL_REGISTRY_DNS_NAME}/d" /etc/hosts
+    echo "${PROVISIONING_HOST_EXTERNAL_IP} ${LOCAL_REGISTRY_DNS_NAME}" | sudo tee -a /etc/hosts
+
+    # When MIRROR_IMAGES is configured, the local registry must be running
+    # before 04_setup_ironic.sh attempts to mirror release images into it.
+    # This covers virtual-baremetal (sushy-emulator) CI environments that
+    # set NODES_PLATFORM=baremetal together with MIRROR_IMAGES=true.
+    if use_registry "podman"; then
+        setup_local_registry
+        rm -f "${REGISTRY_CREDS}"
+        sudo podman login --authfile "${REGISTRY_CREDS}" \
+            -u "${REGISTRY_USER}" -p "${REGISTRY_PASS}" \
+            "${LOCAL_REGISTRY_DNS_NAME}":"${LOCAL_REGISTRY_PORT}"
+    elif use_registry ""; then
+        setup_local_registry
+    else
+        echo '{}' | sudo dd of="${REGISTRY_CREDS}"
+    fi
+    if [ -f "${REGISTRY_CREDS}" ]; then
+        sudo chown "$USER":"$USER" "${REGISTRY_CREDS}"
+    fi
+
     exit 0
 fi
 
diff --git a/utils.sh b/utils.sh
index 6044a13ce..aa7fb803d 100755
--- a/utils.sh
+++ b/utils.sh
@@ -1009,8 +1009,12 @@ function write_pull_secret() {
     if [ "${OPENSHIFT_CI}" == true ]; then
         # We don't need to fetch a personal pull secret with the
         # token, but we still need to merge what we're given with the
-        # credentials for the local reigstry.
-        jq -s '.[0] * .[1]' "${REGISTRY_CREDS}" "${PERSONAL_PULL_SECRET}" > "${PULL_SECRET_FILE}"
+        # credentials for the local registry when mirroring is enabled.
+        if use_registry ""; then
+            jq -s '.[0] * .[1]' "${REGISTRY_CREDS}" "${PERSONAL_PULL_SECRET}" > "${PULL_SECRET_FILE}"
+        else
+            cp "${PERSONAL_PULL_SECRET}" "${PULL_SECRET_FILE}"
+        fi
         return
     fi
 
@@ -1025,9 +1029,13 @@ function write_pull_secret() {
     _tmpfiles="$_tmpfiles $tmppullsecret"
     oc registry login --kubeconfig="$tmpkubeconfig" --to="$tmppullsecret"
 
-    # Combine the personal pull secret with the ones for the CI
-    # registry and the local registry credentials.
-    jq -s '.[0] * .[1] * .[2]' "${PERSONAL_PULL_SECRET}" "${REGISTRY_CREDS}" "${tmppullsecret}" > "${PULL_SECRET_FILE}"
+    # Combine the personal pull secret with the CI registry credentials,
+    # and with the local registry credentials only when mirroring is enabled.
+    if use_registry ""; then
+        jq -s '.[0] * .[1] * .[2]' "${PERSONAL_PULL_SECRET}" "${REGISTRY_CREDS}" "${tmppullsecret}" > "${PULL_SECRET_FILE}"
+    else
+        jq -s '.[0] * .[1]' "${PERSONAL_PULL_SECRET}" "${tmppullsecret}" > "${PULL_SECRET_FILE}"
+    fi
 }
 
 function switch_to_internal_dns() {