diff --git a/sysprep/sysprep_operation.ml b/sysprep/sysprep_operation.ml
index 6d878b8dc..f9cd021d9 100644
--- a/sysprep/sysprep_operation.ml
+++ b/sysprep/sysprep_operation.ml
@@ -36,6 +36,7 @@ class device_side_effects = object end
 type 'a callback = Guestfs.guestfs -> string -> 'a -> unit
 
 type operation = {
+  order : int;
   name : string;
   enabled_by_default : bool;
   heading : string;
@@ -51,9 +52,8 @@ and extra_arg = {
   extra_pod_description : string;
 }
 
-let compare_operations { name = n1 } { name = n2 } = compare n1 n2
-
 let defaults = {
+  order = 0;
   name = "";
   enabled_by_default = false;
   heading = "";
@@ -112,6 +112,9 @@ let register_operation op =
 
 let baked = ref false
 let rec bake () =
+  (* Note we actually want all_operations to be sorted by name,
+   * ignoring the order field.
+   *)
   let ops =
     List.sort (fun { name = a } { name = b } -> compare a b) !all_operations in
   check_no_dupes ops;
@@ -269,6 +272,10 @@ let list_operations () =
         op.heading
   ) !all_operations
 
+let compare_operations { order = o1; name = n1 } { order = o2; name = n2 } =
+  let i = compare o1 o2 in
+  if i <> 0 then i else compare n1 n2
+
 let perform_operations_on_filesystems ?operations ?(quiet = false) g root
     side_effects =
   assert !baked;
diff --git a/sysprep/sysprep_operation.mli b/sysprep/sysprep_operation.mli
index ade0f8f52..89812d2c6 100644
--- a/sysprep/sysprep_operation.mli
+++ b/sysprep/sysprep_operation.mli
@@ -38,6 +38,13 @@ type 'side_effects callback = Guestfs.guestfs -> string -> 'side_effects -> unit
 
 (** Structure used to describe sysprep operations. *)
 type operation = {
+  order : int;
+  (** This is used to control the order in which operations run.  The
+      default is [0], so most operations run in alphabetical order at
+      the same level.  You can make an operation run after others by
+      giving it a [>0] order.  You can make an operation run before
+      others by giving it a [<0] order. *)
+
   name : string;
   (** Operation name, also used to enable the operation on the command
       line.  Must contain only alphanumeric and '-' (dash)