diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 7359b0bd46..0a32c27ca5 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -4,6 +4,7 @@ variables:
   DOCKER_DRIVER: overlay2
   CI_REGISTRY_IMAGE: registry.gitlab.isc.org/isc-projects/images/bind9
   CCACHE_DIR: "/ccache"
+  SOFTHSM2_CONF: "/var/tmp/softhsm2/softhsm2.conf"
 
 stages:
   - precheck
@@ -125,9 +126,7 @@ stages:
   before_script:
     - rm -rf .ccache
     - bash -x bin/tests/system/ifconfig.sh up
-    - export SOFTHSM_CONF="/tmp/softhsm.conf"
-    - echo "0:/tmp/softhsm.db" > $SOFTHSM_CONF
-    - if command -v softhsm2-util >/dev/null; then softhsm2-util --init-token --free --pin 0000 --so-pin 0000 --label "softhsm"; fi
+    - bash -x util/prepare-softhsm2.sh
   script:
     - ( cd bin/tests && make -j${TEST_PARALLEL_JOBS:-1} -k test V=1 )
     - test -s bin/tests/system/systests.output
@@ -140,9 +139,7 @@ stages:
   stage: test
   before_script:
     - export KYUA_RESULT="$CI_PROJECT_DIR/kyua.results"
-    - export SOFTHSM_CONF="/tmp/softhsm.conf"
-    - echo "0:/tmp/softhsm.db" > $SOFTHSM_CONF
-    - if command -v softhsm2-util >/dev/null; then softhsm2-util --init-token --free --pin 0000 --so-pin 0000 --label "softhsm"; fi
+    - bash -x util/prepare-softhsm2.sh
   script:
     - make unit
   after_script:
diff --git a/util/copyrights b/util/copyrights
index 4ca29f714b..42f83b1a3a 100644
--- a/util/copyrights
+++ b/util/copyrights
@@ -4271,6 +4271,7 @@
 ./util/nanny.pl					PERL	2000,2001,2004,2007,2012,2016,2018
 ./util/new-func					PERL	2005,2007,2012,2016,2018
 ./util/nt-kit					SH	1999,2000,2001,2004,2007,2012,2016,2018
+./util/prepare-softhsm2.sh			X	2018
 ./util/spacewhack.pl				PERL	2000,2001,2004,2007,2012,2016,2018
 ./util/tabify-changes				SH	2004,2007,2012,2016,2018
 ./util/update-drafts.pl				PERL	2000,2001,2004,2007,2012,2016,2018
diff --git a/util/prepare-softhsm2.sh b/util/prepare-softhsm2.sh
new file mode 100644
index 0000000000..24c7f17c1a
--- /dev/null
+++ b/util/prepare-softhsm2.sh
@@ -0,0 +1,10 @@
+#!/bin/sh
+if [ -n "${SOFTHSM2_CONF}" ] && command -v softhsm2-util >/dev/null; then
+    SOFTHSM2_DIR=$(dirname "$SOFTHSM2_CONF")
+    mkdir -p "${SOFTHSM2_DIR}/tokens"
+    echo "directories.tokendir = ${SOFTHSM2_DIR}/tokens" > "${SOFTHSM2_CONF}"
+    echo "objectstore.backend = file" >> "${SOFTHSM2_CONF}"
+    echo "log.level = DEBUG" >> "${SOFTHSM2_CONF}"
+    softhsm2-util --init-token --free --pin 0000 --so-pin 0000 --label "softhsm2";
+fi
+exit 0