diff --git a/gnu/services.scm b/gnu/services.scm
index 81af4df849..3162c6ba05 100644
--- a/gnu/services.scm
+++ b/gnu/services.scm
@@ -334,7 +334,11 @@ containing the given entries."
                 (extend system-derivation)))
 
 (define (compute-boot-script _ mexps)
-  (mlet %store-monad ((gexps (sequence %store-monad mexps)))
+  ;; Reverse MEXPS so that extensions appear in the boot script in the right
+  ;; order.  That is, user extensions would come first, and extensions added
+  ;; by 'essential-services' (e.g., running shepherd) are guaranteed to come
+  ;; last.
+  (mlet %store-monad ((gexps (sequence %store-monad (reverse mexps))))
     (gexp->file "boot"
                 ;; Clean up and activate the system, then spawn shepherd.
                 #~(begin #$@gexps))))
diff --git a/gnu/system.scm b/gnu/system.scm
index d367307a24..7c51c4da97 100644
--- a/gnu/system.scm
+++ b/gnu/system.scm
@@ -470,13 +470,13 @@ a container or that of a \"bare metal\" system."
     (cons* (service system-service-type entries)
            %boot-service
 
-           ;; %SHEPHERD-ROOT-SERVICE must come first so that the gexp that
+           ;; %SHEPHERD-ROOT-SERVICE must come last so that the gexp that
            ;; execs shepherd comes last in the boot script (XXX).  Likewise,
-           ;; the cleanup service must come last so that its gexp runs before
+           ;; the cleanup service must come first so that its gexp runs before
            ;; activation code.
-           %shepherd-root-service
-           %activation-service
            (service cleanup-service-type #f)
+           %activation-service
+           %shepherd-root-service
 
            (pam-root-service (operating-system-pam-services os))
            (account-service (append (operating-system-accounts os)