diff --git a/playbook/blancco-init.sh b/playbook/blancco-init.sh
index bd2aa84..9b3a973 100644
--- a/playbook/blancco-init.sh
+++ b/playbook/blancco-init.sh
@@ -133,6 +133,23 @@ sleep 2
 
 SERVER=172.16.9.1
 
+# Where the release files (rootfs, preferences, licence container,
+# config.img) come from. Default /blancco, the active release. The webapp's
+# test menu entry adds blancco.base=/blancco/staged/<version> to boot a
+# staged release before it is activated. The kmod tarball, progress
+# reporter and debug key are not part of a release and stay in /blancco.
+BASE=/blancco
+for arg in $(cat /proc/cmdline); do
+    case "$arg" in
+        blancco.base=/blancco/*) BASE="${arg#blancco.base=}" ;;
+    esac
+done
+case "$BASE" in
+    *..*|*[!A-Za-z0-9._/-]*) BASE=/blancco ;;
+esac
+BASE="${BASE%/}"
+[ "$BASE" = /blancco ] || echo "        release under test: $BASE"
+
 # Coarse progress for the webapp's /imaging dashboard (same endpoint the
 # WinPE imaging clients use). Stage 1 also resets a finished tile for this
 # serial. Best effort: a webapp outage must never stop a wipe.
@@ -151,7 +168,7 @@ dbg ip addr
 
 echo "  [3/5] Downloading Blancco (~850 MB)"
 post_status 1 "Downloading Blancco"
-wget -T 30 -O /tmp/airootfs.sfs http://$SERVER/blancco/arch/x86_64/airootfs.sfs 2>&1
+wget -T 30 -O /tmp/airootfs.sfs http://$SERVER$BASE/arch/x86_64/airootfs.sfs 2>&1
 [ -s /tmp/airootfs.sfs ] || { echo "ERROR: download failed"; exec /bin/sh; }
 
 echo "  [4/5] Preparing system"
@@ -179,8 +196,8 @@ mkdir -p /run/newroot/albus
 # /albus/preferences.save (factory defaults, empty network_share) so
 # erasure reports never reach SMB. Fail loud here instead.
 PREFS=/run/newroot/albus/preferences.xml
-if ! wget -q -T 30 -O "$PREFS" "http://$SERVER/blancco/preferences.xml"; then
-    echo "ERROR: preferences.xml download failed from http://$SERVER/blancco/preferences.xml"
+if ! wget -q -T 30 -O "$PREFS" "http://$SERVER$BASE/preferences.xml"; then
+    echo "ERROR: preferences.xml download failed from http://$SERVER$BASE/preferences.xml"
     echo "Reports would fall back to factory defaults (no SMB target)."
     echo "Dropping to shell - check Apache + network."
     exec /bin/sh
@@ -200,7 +217,7 @@ fi
 # fires, we want the fallback to still have the right SMB target.
 cp -f "$PREFS" /run/newroot/albus/preferences.save
 
-if ! wget -q -T 30 -O /run/newroot/albus/config.xml "http://$SERVER/blancco/config-clean.xml"; then
+if ! wget -q -T 30 -O /run/newroot/albus/config.xml "http://$SERVER$BASE/config-clean.xml"; then
     echo "ERROR: config.xml (license container) download failed."
     exec /bin/sh
 fi
@@ -213,7 +230,7 @@ fi
 # tmpfs at the new root's /run; systemd leaves an existing /run mounted.
 mount -t tmpfs -o mode=0755,nosuid,nodev tmpfs /run/newroot/run
 mkdir -p /run/newroot/run/initramfs
-if wget -q -T 30 -O /tmp/config.img "http://$SERVER/blancco/config.img" &&
+if wget -q -T 30 -O /tmp/config.img "http://$SERVER$BASE/config.img" &&
    (cd /run/newroot/run/initramfs && cpio -id < /tmp/config.img 2>/dev/null) &&
    [ -s /run/newroot/run/initramfs/report.key ]; then
     dbg ls -la /run/newroot/run/initramfs