diff --git a/.github/workflows/boards_build.yml b/.github/workflows/boards_build.yml
index 50a29d5..cdece92 100644
--- a/.github/workflows/boards_build.yml
+++ b/.github/workflows/boards_build.yml
@@ -16,6 +16,8 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v2
+      - name: Set up submodules
+        run: ./setup-submodules.sh
       - uses: actions-rs/toolchain@v1
         with:
           target: thumbv7em-none-eabi
diff --git a/.github/workflows/cargo_audit.yml b/.github/workflows/cargo_audit.yml
index 25e8ff2..4b73fa2 100644
--- a/.github/workflows/cargo_audit.yml
+++ b/.github/workflows/cargo_audit.yml
@@ -9,6 +9,8 @@ jobs:
     if: github.repository == 'google/OpenSK'
     steps:
       - uses: actions/checkout@v2
+      - name: Set up submodules
+        run: ./setup-submodules.sh
       - uses: actions-rs/toolchain@v1
         with:
           target: thumbv7em-none-eabi
diff --git a/.github/workflows/cargo_check.yml b/.github/workflows/cargo_check.yml
index 07c1c0a..7789a51 100644
--- a/.github/workflows/cargo_check.yml
+++ b/.github/workflows/cargo_check.yml
@@ -17,6 +17,8 @@ jobs:
     runs-on: ubuntu-18.04
     steps:
       - uses: actions/checkout@v2
+      - name: Set up submodules
+        run: ./setup-submodules.sh
       - uses: actions-rs/toolchain@v1
         with:
           target: thumbv7em-none-eabi
diff --git a/.github/workflows/cargo_fmt.yml b/.github/workflows/cargo_fmt.yml
index 72dec08..dff9551 100644
--- a/.github/workflows/cargo_fmt.yml
+++ b/.github/workflows/cargo_fmt.yml
@@ -18,6 +18,8 @@ jobs:
     runs-on: ubuntu-18.04
     steps:
       - uses: actions/checkout@v2
+      - name: Set up submodules
+        run: ./setup-submodules.sh
       - uses: actions-rs/toolchain@v1
         with:
           target: thumbv7em-none-eabi
diff --git a/.github/workflows/cbor_test.yml b/.github/workflows/cbor_test.yml
index 84625c8..1f595aa 100644
--- a/.github/workflows/cbor_test.yml
+++ b/.github/workflows/cbor_test.yml
@@ -12,6 +12,8 @@ jobs:
     runs-on: ubuntu-18.04
     steps:
       - uses: actions/checkout@v2
+      - name: Set up submodules
+        run: ./setup-submodules.sh
       - uses: actions-rs/toolchain@v1
         with:
           target: thumbv7em-none-eabi
diff --git a/.github/workflows/crypto_test.yml b/.github/workflows/crypto_test.yml
index a879661..ad0cdab 100644
--- a/.github/workflows/crypto_test.yml
+++ b/.github/workflows/crypto_test.yml
@@ -14,6 +14,8 @@ jobs:
     runs-on: ubuntu-18.04
     steps:
       - uses: actions/checkout@v2
+      - name: Set up submodules
+        run: ./setup-submodules.sh
       - uses: actions-rs/toolchain@v1
         with:
           target: thumbv7em-none-eabi
diff --git a/.github/workflows/opensk_build.yml b/.github/workflows/opensk_build.yml
index f51637d..9c35073 100644
--- a/.github/workflows/opensk_build.yml
+++ b/.github/workflows/opensk_build.yml
@@ -13,6 +13,8 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v2
+      - name: Set up submodules
+        run: ./setup-submodules.sh
       - uses: actions-rs/toolchain@v1
         with:
           target: thumbv7em-none-eabi
diff --git a/.github/workflows/opensk_test.yml b/.github/workflows/opensk_test.yml
index ece41e7..8c75538 100644
--- a/.github/workflows/opensk_test.yml
+++ b/.github/workflows/opensk_test.yml
@@ -14,6 +14,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v2
+      - name: Set up submodules
+        run: ./setup-submodules.sh
       - uses: actions-rs/toolchain@v1
         with:
           target: thumbv7em-none-eabi
diff --git a/.github/workflows/reproducible.yml b/.github/workflows/reproducible.yml
index 4489a93..0d57d9a 100644
--- a/.github/workflows/reproducible.yml
+++ b/.github/workflows/reproducible.yml
@@ -14,6 +14,8 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v2
+      - name: Set up submodules
+        run: ./setup-submodules.sh
       - uses: actions-rs/toolchain@v1
         with:
           target: thumbv7em-none-eabi
diff --git a/setup-submodules.sh b/setup-submodules.sh
new file mode 100755
index 0000000..e767b78
--- /dev/null
+++ b/setup-submodules.sh
@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# Copyright 2020 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Ensure the script doesn't fail on Github workflows
+export TERM=${TERM:-vt100}
+done_text="$(tput bold)DONE.$(tput sgr0)"
+
+set -e
+
+# Ensure the submodules are pulled and up-to-date
+git submodule update --init
+
+patch_conflict_detected () {
+  cat <<EOF
+
+This script cannot be run twice without reverting the patches.
+
+To do so, follow these instructions:
+1. Commit any changes you want to save.
+2. Run the ./reset.sh script to revert all uncommitted changes.
+3. Run the ./setup.sh script again.
+EOF
+  exit 1
+}
+
+# Copy additional boards to the kernel.
+echo -n '[-] Copying additional boards to Tock... '
+cp -r boards/* third_party/tock/boards
+echo $done_text
+
+# Apply patches to kernel. Do that in a sub-shell.
+(
+  cd third_party/tock/ && \
+  for p in ../../patches/tock/[0-9][0-9]-*.patch
+  do
+    echo -n '[-] Applying patch "'$(basename $p)'"... '
+    if git apply "$p"
+    then
+      echo $done_text
+    else
+      patch_conflict_detected
+    fi
+  done
+)
+
+# Now apply patches to libtock-rs. Do that in a sub-shell.
+#
+# Commented out as there are not patches at the moment, and the pattern fails in
+# that case.
+#(
+#  cd third_party/libtock-rs/ && \
+#  for p in ../../patches/libtock-rs/[0-9][0-9]-*.patch
+#  do
+#    echo -n '[-] Applying patch "'$(basename $p)'"... '
+#    if git apply "$p"
+#    then
+#      echo $done_text
+#    else
+#      patch_conflict_detected
+#    fi
+#  done
+#)
diff --git a/setup.sh b/setup.sh
index 621ce0f..a910ec0 100755
--- a/setup.sh
+++ b/setup.sh
@@ -19,6 +19,9 @@ done_text="$(tput bold)DONE.$(tput sgr0)"
 
 set -e
 
+# Ensure the submodules are pulled and up-to-date, and apply patches
+./setup-submodules.sh
+
 # Check that rustup and pip3 are installed
 check_command () {
   if ! which "$1" >/dev/null
@@ -30,60 +33,6 @@ check_command () {
 check_command rustup " Follow the steps under https://rustup.rs/ to install it."
 check_command pip3
 
-# Ensure the submodules are pulled and up-to-date
-git submodule update --init
-
-patch_conflict_detected () {
-  cat <<EOF
-
-This script cannot be run twice without reverting the patches.
-
-To do so, follow these instructions:
-1. Commit any changes you want to save.
-2. Run the ./reset.sh script to revert all uncommitted changes.
-3. Run the ./setup.sh script again.
-EOF
-  exit 1
-}
-
-# Copy additional boards to the kernel.
-echo -n '[-] Copying additional boards to Tock... '
-cp -r boards/* third_party/tock/boards
-echo $done_text
-
-# Apply patches to kernel. Do that in a sub-shell.
-(
-  cd third_party/tock/ && \
-  for p in ../../patches/tock/[0-9][0-9]-*.patch
-  do
-    echo -n '[-] Applying patch "'$(basename $p)'"... '
-    if git apply "$p"
-    then
-      echo $done_text
-    else
-      patch_conflict_detected
-    fi
-  done
-)
-
-# Now apply patches to libtock-rs. Do that in a sub-shell.
-#
-# Commented out as there are not patches at the moment, and the pattern fails in
-# that case.
-#(
-#  cd third_party/libtock-rs/ && \
-#  for p in ../../patches/libtock-rs/[0-9][0-9]-*.patch
-#  do
-#    echo -n '[-] Applying patch "'$(basename $p)'"... '
-#    if git apply "$p"
-#    then
-#      echo $done_text
-#    else
-#      patch_conflict_detected
-#    fi
-#  done
-#)
-
 # Ensure we have certificates, keys, etc. so that the tests can run
 source tools/gen_key_materials.sh
 generate_crypto_materials N