diff --git a/exosphere/Makefile b/exosphere/Makefile
index 4d3d862b0..12c3594a7 100644
--- a/exosphere/Makefile
+++ b/exosphere/Makefile
@@ -28,7 +28,7 @@ CFLAGS = \
 	-Werror \
 	-Wall
 
-LDFLAGS = -g $(ARCH) -nostartfiles -Wl,--nmagic,--gc-sections
+LDFLAGS = -specs=linker.specs -g $(ARCH)
 
 objects =	$(patsubst $(dir_source)/%.s, $(dir_build)/%.o, \
 			$(patsubst $(dir_source)/%.c, $(dir_build)/%.o, \
@@ -55,7 +55,7 @@ $(dir_out)/$(name).bin: $(dir_build)/$(name).elf
 	$(OBJCOPY) -S -O binary $< $@
 
 $(dir_build)/$(name).elf: $(objects)
-	$(LINK.o) -T linker.ld $(OUTPUT_OPTION) $^
+	$(LINK.o) $(OUTPUT_OPTION) $^
 
 $(dir_bpmpfw)/out/bpmpfw.bin: $(dir_bpmpfw)
 	@$(MAKE) -C $<
diff --git a/exosphere/linker.specs b/exosphere/linker.specs
new file mode 100644
index 000000000..17b095afa
--- /dev/null
+++ b/exosphere/linker.specs
@@ -0,0 +1,7 @@
+%rename link                old_link
+
+*link:
+%(old_link) -T linker.ld --nmagic --gc-sections
+
+*startfile:
+crti%O%s crtbegin%O%s
diff --git a/exosphere/src/coldboot_main.c b/exosphere/src/coldboot_main.c
index d7557b1fc..a04280cd5 100644
--- a/exosphere/src/coldboot_main.c
+++ b/exosphere/src/coldboot_main.c
@@ -5,22 +5,10 @@
 #include "cache.h"
 
 extern uint8_t __pk2ldr_start__[], __pk2ldr_end__[];
-
 extern void __jump_to_lower_el(uint64_t arg, uintptr_t ep, unsigned int el);
 
-void _init(void);
-void _fini(void);
-
 void coldboot_main(void);
 
-void _init(void) {
-    /* Stubbed. Should have been provided by gcc but we have set -nostartfiles */
-}
-
-void _fini(void) {
-    /* Stubbed. Should have been provided by gcc but we have set -nostartfiles */
-}
-
 void coldboot_main(void) {
     uintptr_t *mmu_l3_table = (uintptr_t *)TZRAM_GET_SEGMENT_ADDRESS(TZRAM_SEGMENT_ID_L3_TRANSLATION_TABLE);
     uintptr_t pk2ldr = TZRAM_GET_SEGMENT_ADDRESS(TZRAM_SEGMENT_ID_PK2LDR);
diff --git a/exosphere/src/start.s b/exosphere/src/start.s
index c881aadb7..3e3956a58 100644
--- a/exosphere/src/start.s
+++ b/exosphere/src/start.s
@@ -77,6 +77,7 @@ __start_cold:
     msr  spsel, #0
     bl   get_coldboot_crt0_stack_address
     mov  sp, x0
+    mov  fp, #0
     bl   coldboot_init
     ldr  x16, =__jump_to_main_cold
     br   x16
@@ -91,6 +92,7 @@ __start_warm:
     msr  spsel, #0
     bl   get_warmboot_crt0_stack_address
     mov  sp, x0
+    mov  fp, #0
     bl   warmboot_init
     ldr  x16, =__jump_to_main_warm
     br   x16
@@ -100,16 +102,17 @@ __start_warm:
 __jump_to_main_cold:
     /* This is inspired by Nintendo's code but significantly different */
     bl   __set_exception_entry_stack_pointer
-
-    bl   get_pk2ldr_stack_address
-    mov  sp, x0
     /*
-        Normally Nintendo calls it in crt0, but it's fine to do that here
-        note that package2.c shouldn't have constructed objects, because we
+        Normally Nintendo calls it in crt0, but it's fine to do that here.
+        Please note that package2.c shouldn't have constructed objects, because we
         call __libc_fini_array after load_package2 has been cleared, on EL3
         to EL3 chainload.
     */
     bl   __libc_init_array
+
+    bl   get_pk2ldr_stack_address
+    mov  sp, x0
+
     bl   load_package2
 
     mov  w0, #3 /* use core3 stack temporarily */