diff --git a/src/ci/azure-pipelines/steps/install-windows-build-deps.yml b/src/ci/azure-pipelines/steps/install-windows-build-deps.yml
index 3c99ede9ade..1a5b14d66aa 100644
--- a/src/ci/azure-pipelines/steps/install-windows-build-deps.yml
+++ b/src/ci/azure-pipelines/steps/install-windows-build-deps.yml
@@ -1,22 +1,4 @@
 steps:
-# Download and install MSYS2, needed primarily for the test suite (run-make) but
-# also used by the MinGW toolchain for assembling things.
-#
-# FIXME: we should probe the default azure image and see if we can use the MSYS2
-# toolchain there. (if there's even one there). For now though this gets the job
-# done.
-- bash: |
-    set -e
-    choco install msys2 --params="/InstallDir:$(System.Workfolder)/msys2 /NoPath" -y --no-progress
-    echo "##vso[task.prependpath]$(System.Workfolder)/msys2/usr/bin"
-    mkdir -p "$(System.Workfolder)/msys2/home/$USERNAME"
-  displayName: Install msys2
-  condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
-
-- bash: pacman -S --noconfirm --needed base-devel ca-certificates make diffutils tar
-  displayName: Install msys2 base deps
-  condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
-
 # If we need to download a custom MinGW, do so here and set the path
 # appropriately.
 #
@@ -46,17 +28,6 @@ steps:
   condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'), ne(variables['MINGW_URL'],''))
   displayName: Download custom MinGW
 
-# FIXME(#65767): workaround msys bug, step 1
-- bash: |
-    set -e
-    arch=i686
-    if [ "$MSYS_BITS" = "64" ]; then
-      arch=x86_64
-    fi
-    curl -O https://ci-mirrors.rust-lang.org/rustc/msys2-repo/mingw/$arch/mingw-w64-$arch-ca-certificates-20180409-1-any.pkg.tar.xz
-  condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
-  displayName: Download working ca-certificates for msys
-
 # Otherwise install MinGW through `pacman`
 - bash: |
     set -e
@@ -69,29 +40,6 @@ steps:
   condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'), eq(variables['MINGW_URL'],''))
   displayName: Download standard MinGW
 
-# FIXME(#65767): workaround msys bug, step 2
-- bash: |
-    set -e
-    arch=i686
-    if [ "$MSYS_BITS" = "64" ]; then
-      arch=x86_64
-    fi
-    pacman -U --noconfirm --noprogressbar mingw-w64-$arch-ca-certificates-20180409-1-any.pkg.tar.xz
-    rm mingw-w64-$arch-ca-certificates-20180409-1-any.pkg.tar.xz
-  condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
-  displayName: Install working ca-certificates for msys
-
-# Make sure we use the native python interpreter instead of some msys equivalent
-# one way or another. The msys interpreters seem to have weird path conversions
-# baked in which break LLVM's build system one way or another, so let's use the
-# native version which keeps everything as native as possible.
-- bash: |
-    set -e
-    cp C:/Python27amd64/python.exe C:/Python27amd64/python2.7.exe
-    echo "##vso[task.prependpath]C:/Python27amd64"
-  displayName: Prefer the "native" Python as LLVM has trouble building with MSYS sometimes
-  condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
-
 # Note that this is originally from the github releases patch of Ninja
 - bash: |
     set -e
diff --git a/src/ci/azure-pipelines/steps/run.yml b/src/ci/azure-pipelines/steps/run.yml
index df8e8e59d72..4700af0148e 100644
--- a/src/ci/azure-pipelines/steps/run.yml
+++ b/src/ci/azure-pipelines/steps/run.yml
@@ -91,6 +91,13 @@ steps:
   displayName: "Disable git automatic line ending conversion (on C:/)"
   condition: and(succeeded(), not(variables.SKIP_JOB))
 
+- bash: src/ci/scripts/install-msys2.sh
+  env:
+    AGENT_OS: $(Agent.OS)
+    SYSTEM_WORKFOLDER: $(System.Workfolder)
+  displayName: Install msys2
+  condition: and(succeeded(), not(variables.SKIP_JOB))
+
 - template: install-windows-build-deps.yml
 
 # Looks like docker containers have IPv6 disabled by default, so let's turn it
diff --git a/src/ci/scripts/install-msys2.sh b/src/ci/scripts/install-msys2.sh
new file mode 100755
index 00000000000..bfd3f2c1edb
--- /dev/null
+++ b/src/ci/scripts/install-msys2.sh
@@ -0,0 +1,40 @@
+#!/bin/bash
+# Download and install MSYS2, needed primarily for the test suite (run-make) but
+# also used by the MinGW toolchain for assembling things.
+#
+# FIXME: we should probe the default azure image and see if we can use the MSYS2
+# toolchain there. (if there's even one there). For now though this gets the job
+# done.
+
+set -euo pipefail
+IFS=$'\n\t'
+
+source "$(cd "$(dirname "$0")" && pwd)/../shared.sh"
+
+if isWindows; then
+    # FIXME(#65767): workaround msys bug, step 1
+    arch=i686
+    if [ "$MSYS_BITS" = "64" ]; then
+      arch=x86_64
+    fi
+    curl -O "${MIRRORS_BASE}/msys2-repo/mingw/$arch/mingw-w64-$arch-ca-certificates-20180409-1-any.pkg.tar.xz"
+
+    choco install msys2 --params="/InstallDir:${SYSTEM_WORKFOLDER}/msys2 /NoPath" -y --no-progress
+    mkdir -p "${SYSTEM_WORKFOLDER}/msys2/home/${USERNAME}"
+
+    ciCommandAddPath "${SYSTEM_WORKFOLDER}/msys2/usr/bin"
+    export PATH="${SYSTEM_WORKFOLDER}/msys2/usr/bin"
+
+    pacman -S --noconfirm --needed base-devel ca-certificates make diffutils tar
+
+    # FIXME(#65767): workaround msys bug, step 2
+    pacman -U --noconfirm --noprogressbar mingw-w64-$arch-ca-certificates-20180409-1-any.pkg.tar.xz
+    rm mingw-w64-$arch-ca-certificates-20180409-1-any.pkg.tar.xz
+
+    # Make sure we use the native python interpreter instead of some msys equivalent
+    # one way or another. The msys interpreters seem to have weird path conversions
+    # baked in which break LLVM's build system one way or another, so let's use the
+    # native version which keeps everything as native as possible.
+    cp C:/Python27amd64/python.exe C:/Python27amd64/python2.7.exe
+    ciCommandAddPath "C:\\Python27amd64"
+fi