diff --git a/boot/boot-stage-2-init.sh b/boot/boot-stage-2-init.sh
index a29b874c032..02e33b91912 100644
--- a/boot/boot-stage-2-init.sh
+++ b/boot/boot-stage-2-init.sh
@@ -59,6 +59,9 @@ for o in $(cat /proc/cmdline); do
             # !!! argh, can't pass a startup event to Upstart yet.
             exec @shell@
             ;;
+        safemode)
+            safeMode=1
+            ;;
     esac
 done
 
@@ -75,6 +78,10 @@ needWritableDir /root 0700
 # Miscellaneous boot time cleanup.
 rm -rf /var/run
 
+if test -n "$safeMode"; then
+    touch /var/run/safemode
+fi
+
 
 # Create the minimal device nodes needed before we run udev.
 mknod -m 0666 /dev/null c 1 3
diff --git a/configuration/options.nix b/configuration/options.nix
index d128f6c8e33..aaafca84e99 100644
--- a/configuration/options.nix
+++ b/configuration/options.nix
@@ -84,6 +84,33 @@
   }
 
 
+  {
+    name = ["boot" "hardwareScan"];
+    default = true;
+    description = "
+      Whether to try to load kernel modules for all detected hardware.
+      Usually this does a good job of providing you with the modules
+      you need, but sometimes it can crash the system or cause other
+      nasty effects.  If the hardware scan is turned on, it can be
+      disabled at boot time by adding the <literal>safemode</literal>
+      parameter to the kernel command line.
+    ";
+  }
+
+
+  {
+    name = ["boot" "kernelModules"];
+    default = [];
+    description = "
+      The set of kernel modules to be loaded in the second stage of
+      the boot process.  That is, these modules are not included in
+      the initial ramdisk, so they'd better not be required for
+      mounting the root file system.  Add them to
+      <option>boot.initrd.extraKernelModules</options> if they are.
+    ";
+  }
+
+
   {
     name = ["boot" "initrd" "kernelModules"];
     default = ["ide-cd" "ide-disk" "ide-generic" "ext3"];
@@ -106,7 +133,10 @@
     name = ["boot" "initrd" "extraKernelModules"];
     default = [];
     description = "
-      Additional kernel modules for the initial ramdisk.
+      Additional kernel modules for the initial ramdisk.  These are
+      loaded before the modules listed in
+      <option>boot.initrd.kernelModules</options>, so they take
+      precedence.
     ";
   }
 
diff --git a/configuration/system.nix b/configuration/system.nix
index e4b102d8f0c..385800bf936 100644
--- a/configuration/system.nix
+++ b/configuration/system.nix
@@ -37,8 +37,8 @@ rec {
 
 
   rootModules = 
-    (config.get ["boot" "initrd" "kernelModules"]) ++
-    (config.get ["boot" "initrd" "extraKernelModules"]);
+    (config.get ["boot" "initrd" "extraKernelModules"]) ++
+    (config.get ["boot" "initrd" "kernelModules"]);
 
 
   # Determine the set of modules that we need to mount the root FS.
diff --git a/configuration/upstart.nix b/configuration/upstart.nix
index e3e2dabadcc..bf2120968de 100644
--- a/configuration/upstart.nix
+++ b/configuration/upstart.nix
@@ -29,6 +29,8 @@ import ../upstart-jobs/gather.nix {
     # Hardware scan; loads modules for PCI devices.
     (import ../upstart-jobs/hardware-scan.nix {
       inherit (pkgs) kernel module_init_tools;
+      doHardwareScan = config.get ["boot" "hardwareScan"];
+      kernelModules = config.get ["boot" "kernelModules"];
     })
       
     # Mount file systems.
diff --git a/upstart-jobs/hardware-scan.nix b/upstart-jobs/hardware-scan.nix
index bfa44798bdb..6cca5f7562f 100644
--- a/upstart-jobs/hardware-scan.nix
+++ b/upstart-jobs/hardware-scan.nix
@@ -1,5 +1,5 @@
 # !!! Don't like it that I have to pass the kernel here.
-{kernel, module_init_tools}:
+{kernel, module_init_tools, doHardwareScan, kernelModules}:
 
 {
   name = "hardware-scan";
@@ -9,13 +9,22 @@ start on udev
 
 script
     export MODULE_DIR=${kernel}/lib/modules/
-    
-    # Try to load modules for all PCI devices.
-    for i in /sys/bus/pci/devices/*/modalias; do
-        echo \"Trying to load a module for $(basename $(dirname $i))...\"
-        ${module_init_tools}/sbin/modprobe $(cat $i) || true
-        echo \"\"
+
+    for i in ${toString kernelModules}; do
+        echo \"Loading kernel module $i...\"
+        ${module_init_tools}/sbin/modprobe $i || true
     done
+
+    if test -n \"${toString doHardwareScan}\" -a ! -e /var/run/safemode; then
+    
+        # Try to load modules for all PCI devices.
+        for i in /sys/bus/pci/devices/*/modalias; do
+            echo \"Trying to load a module for $(basename $(dirname $i))...\"
+            ${module_init_tools}/sbin/modprobe $(cat $i) || true
+            echo \"\"
+        done
+
+    fi
 end script
 
   ";