--- a/taskcluster/taskgraph/transforms/job/common.py
+++ b/taskcluster/taskgraph/transforms/job/common.py
@@ -52,16 +52,48 @@ def docker_worker_add_gecko_vcs_env_vars
     env.update({
         'GECKO_BASE_REPOSITORY': config.params['base_repository'],
         'GECKO_HEAD_REF': config.params['head_rev'],
         'GECKO_HEAD_REPOSITORY': config.params['head_repository'],
         'GECKO_HEAD_REV': config.params['head_rev'],
     })
 
 
+def docker_worker_support_vcs_checkout(config, job, taskdesc):
+    """Update a job/task with parameters to enable a VCS checkout.
+
+    The configuration is intended for tasks using "run-task" and its
+    VCS checkout behavior.
+    """
+    level = config.params['level']
+
+    taskdesc['worker'].setdefault('caches', []).extend([
+        {
+            'type': 'persistent',
+            'name': 'level-%s-hg-shared' % level,
+            'mount-point': '/home/worker/hg-shared',
+        }, {
+            'type': 'persistent',
+            'name': 'level-%s-checkouts' % level,
+            'mount-point': '/home/worker/checkouts',
+        }
+    ])
+
+    taskdesc['worker'].setdefault('env', {}).update({
+        'GECKO_BASE_REPOSITORY': config.params['base_repository'],
+        'GECKO_HEAD_REPOSITORY': config.params['head_repository'],
+        'GECKO_HEAD_REV': config.params['head_rev'],
+    })
+
+    # Give task access to hgfingerprint secret so it can pin the certificate
+    # for hg.mozilla.org.
+    taskdesc['scopes'].append('secrets:get:project/taskcluster/gecko/hgfingerprint')
+    taskdesc['worker']['taskcluster-proxy'] = True
+
+
 def docker_worker_setup_secrets(config, job, taskdesc):
     """Set up access to secrets via taskcluster-proxy.  The value of
     run['secrets'] should be a boolean or a list of secret names that
     can be accessed."""
     if not job['run'].get('secrets'):
         return
 
     taskdesc['worker']['taskcluster-proxy'] = True

--- a/taskcluster/taskgraph/transforms/job/run_task.py
+++ b/taskcluster/taskgraph/transforms/job/run_task.py
@@ -5,16 +5,19 @@
 Support for running jobs that are invoked via the `run-task` script.
 """
 
 from __future__ import absolute_import, print_function, unicode_literals
 
 import copy
 
 from taskgraph.transforms.job import run_job_using
+from taskgraph.transforms.job.common import (
+    docker_worker_support_vcs_checkout,
+)
 from voluptuous import Schema, Required, Any
 
 run_task_schema = Schema({
     Required('using'): 'run-task',
 
     # if true, add a cache at ~worker/.cache, which is where things like pip
     # tend to hide their caches.  This cache is never added for level-1 jobs.
     Required('cache-dotcache', default=False): bool,
@@ -27,51 +30,30 @@ run_task_schema = Schema({
     # it will be included in a single argument to `bash -cx`.
     Required('command'): Any([basestring], basestring),
 })
 
 
 @run_job_using("docker-worker", "run-task", schema=run_task_schema)
 def docker_worker_run_task(config, job, taskdesc):
     run = job['run']
-    checkout = run['checkout']
 
     worker = taskdesc['worker'] = copy.deepcopy(job['worker'])
 
-    if checkout:
-        worker['caches'] = [{
-            'type': 'persistent',
-            'name': 'level-{}-hg-shared'.format(config.params['level']),
-            'mount-point': "/home/worker/hg-shared",
-        }, {
-            'type': 'persistent',
-            'name': 'level-{}-checkouts'.format(config.params['level']),
-            'mount-point': "/home/worker/checkouts",
-        }]
+    if run['checkout']:
+        docker_worker_support_vcs_checkout(config, job, taskdesc)
 
     if run.get('cache-dotcache') and int(config.params['level']) > 1:
         worker['caches'].append({
             'type': 'persistent',
             'name': 'level-{level}-{project}-dotcache'.format(**config.params),
             'mount-point': '/home/worker/.cache',
         })
 
-    env = worker['env'] = {}
-    env.update({
-        'GECKO_BASE_REPOSITORY': config.params['base_repository'],
-        'GECKO_HEAD_REPOSITORY': config.params['head_repository'],
-        'GECKO_HEAD_REV': config.params['head_rev'],
-    })
-
-    # give the task access to the hgfingerprint secret
-    if checkout:
-        taskdesc['scopes'].append('secrets:get:project/taskcluster/gecko/hgfingerprint')
-        worker['taskcluster-proxy'] = True
-
     run_command = run['command']
     if isinstance(run_command, basestring):
         run_command = ['bash', '-cx', run_command]
     command = ['/home/worker/bin/run-task']
-    if checkout:
+    if run['checkout']:
         command.append('--vcs-checkout=/home/worker/checkouts/gecko')
     command.append('--')
     command.extend(run_command)
     worker['command'] = command