diff --git a/README.md b/README.md
index bf9ceb7..35b8cce 100644
--- a/README.md
+++ b/README.md
@@ -53,7 +53,7 @@ Boot effective:
 
 These steps will not be covered here.
 
-### `lzbt`, the Lanzaboote tool
+### `lzbt-*`, the Lanzaboote tool
 
 At the moment, boot loaders, kernels and initrds on NixOS are signed
 on the current system. These then need to be prepared as [Unified
@@ -68,7 +68,13 @@ installs the UKI along with other required files to the
 ESP. `lzbt` is also aware of multiple NixOS generations and will
 sign all configurations that should be bootable.
 
-`lzbt` lives in [`rust/tool`](rust/tool).
+We have multiple backends for `lzbt`:
+
+- `lzbt-systemd` lives in [`rust/tool/systemd`](rust/tool/systemd)
+
+In the future, `lzbt` may support more backends.
+
+Shared code lives in [`rust/tool/shared`](rust/tool/shared).
 
 ### Stub
 
diff --git a/flake.lock b/flake.lock
index 66be2e2..7e49cc1 100644
--- a/flake.lock
+++ b/flake.lock
@@ -185,11 +185,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1689906077,
-        "narHash": "sha256-2tjLXKoSK7O0LYHlA6GCWL0gy2kZZno4krg+KZpDh6U=",
+        "lastModified": 1694657451,
+        "narHash": "sha256-cRZa9ZmUi0EFKcmzpsOXLVhiMQD8XLrku8v+U1YiGm8=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "c88b28944129eeff5e819bdc21248dc07eb0625d",
+        "rev": "7c4f46f0b3597e3c4663285e6794194e55574879",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index 687af42..d522c68 100644
--- a/flake.nix
+++ b/flake.nix
@@ -165,8 +165,10 @@
           stub = stubCrane.package;
           fatStub = fatStubCrane.package;
 
+          # TODO: when we will have more backends
+          # let's generalize this properly.
           toolCrane = buildRustApp {
-            pname = "lanzaboote-tool";
+            pname = "lzbt-systemd";
             src = ./rust/tool;
             extraArgs = {
               TEST_SYSTEMD = pkgs.systemd;
@@ -187,7 +189,7 @@
 
             # Clean PATH to only contain what we need to do objcopy. Also
             # tell lanzatool where to find our UEFI binaries.
-            makeWrapper ${tool}/bin/lzbt $out/bin/lzbt \
+            makeWrapper ${tool}/bin/lzbt-systemd $out/bin/lzbt \
               --set PATH ${lib.makeBinPath [ pkgs.binutils-unwrapped pkgs.sbsigntool ]} \
               --set LANZABOOTE_STUB ${stub}/bin/lanzaboote_stub.efi
           '';
diff --git a/rust/tool/Cargo.lock b/rust/tool/Cargo.lock
index 1a0ea6c..6af64c2 100644
--- a/rust/tool/Cargo.lock
+++ b/rust/tool/Cargo.lock
@@ -2,6 +2,12 @@
 # It is not intended for manual editing.
 version = 3
 
+[[package]]
+name = "android-tzdata"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e999941b234f3131b00bc13c22d06e8c5ff726d1b6318ac7eb276997bbb4fef0"
+
 [[package]]
 name = "android_system_properties"
 version = "0.1.5"
@@ -13,30 +19,29 @@ dependencies = [
 
 [[package]]
 name = "anstream"
-version = "0.3.2"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ca84f3628370c59db74ee214b3263d58f9aadd9b4fe7e711fd87dc452b7f163"
+checksum = "b1f58811cfac344940f1a400b6e6231ce35171f614f26439e80f8c1465c5cc0c"
 dependencies = [
  "anstyle",
  "anstyle-parse",
  "anstyle-query",
  "anstyle-wincon",
  "colorchoice",
- "is-terminal",
  "utf8parse",
 ]
 
 [[package]]
 name = "anstyle"
-version = "1.0.0"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41ed9a86bf92ae6580e0a31281f65a1b1d867c0cc68d5346e2ae128dddfa6a7d"
+checksum = "b84bf0a05bbb2a83e5eb6fa36bb6e87baa08193c35ff52bbf6b38d8af2890e46"
 
 [[package]]
 name = "anstyle-parse"
-version = "0.2.0"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e765fd216e48e067936442276d1d57399e37bce53c264d6fefbe298080cb57ee"
+checksum = "938874ff5980b03a87c5524b3ae5b59cf99b1d6bc836848df7bc5ada9643c333"
 dependencies = [
  "utf8parse",
 ]
@@ -52,9 +57,9 @@ dependencies = [
 
 [[package]]
 name = "anstyle-wincon"
-version = "1.0.1"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "180abfa45703aebe0093f79badacc01b8fd4ea2e35118747e5811127f926e188"
+checksum = "58f54d10c6dfa51283a066ceab3ec1ab78d13fae00aa49243a45e4571fb79dfd"
 dependencies = [
  "anstyle",
  "windows-sys",
@@ -62,9 +67,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.72"
+version = "1.0.75"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b13c32d80ecc7ab747b80c3784bce54ee8a7a0cc4fbda9bf4cda2cf6fe90854"
+checksum = "a4668cab20f66d8d020e1fbc0ebe47217433c1b6c8f2040faf858554e394ace6"
 
 [[package]]
 name = "assert_cmd"
@@ -87,7 +92,7 @@ version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
 dependencies = [
- "hermit-abi 0.1.19",
+ "hermit-abi",
  "libc",
  "winapi",
 ]
@@ -104,6 +109,12 @@ version = "1.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
+[[package]]
+name = "bitflags"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4682ae6287fcf752ecaabbfcc7b6f9b72aa33933dc23a554d853aea8eea8635"
+
 [[package]]
 name = "block-buffer"
 version = "0.10.4"
@@ -126,27 +137,29 @@ dependencies = [
 
 [[package]]
 name = "bstr"
-version = "1.4.0"
+version = "1.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3d4260bcc2e8fc9df1eac4919a720effeb63a3f0952f5bf4944adfa18897f09"
+checksum = "4c2f7349907b712260e64b0afe2f84692af14a454be26187d9df565c7f69266a"
 dependencies = [
  "memchr",
- "once_cell",
  "regex-automata",
  "serde",
 ]
 
 [[package]]
 name = "bumpalo"
-version = "3.12.2"
+version = "3.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c6ed94e98ecff0c12dd1b04c15ec0d7d9458ca8fe806cea6f12954efe74c63b"
+checksum = "a3e2c3daef883ecc1b5d58c15adae93470a91d425f3532ba1695849656af3fc1"
 
 [[package]]
 name = "cc"
-version = "1.0.79"
+version = "1.0.83"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50d30906286121d95be3d479533b458f87493b30a4b5f79a607db8f5d11aa91f"
+checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
+dependencies = [
+ "libc",
+]
 
 [[package]]
 name = "cfg-if"
@@ -156,34 +169,33 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "chrono"
-version = "0.4.24"
+version = "0.4.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e3c5919066adf22df73762e50cffcde3a758f2a848b113b586d1f86728b673b"
+checksum = "defd4e7873dbddba6c7c91e199c7fcb946abc4a6a4ac3195400bcfb01b5de877"
 dependencies = [
+ "android-tzdata",
  "iana-time-zone",
  "js-sys",
- "num-integer",
  "num-traits",
  "wasm-bindgen",
- "winapi",
+ "windows-targets",
 ]
 
 [[package]]
 name = "clap"
-version = "4.3.17"
+version = "4.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b0827b011f6f8ab38590295339817b0d26f344aa4932c3ced71b45b0c54b4a9"
+checksum = "84ed82781cea27b43c9b106a979fe450a13a31aab0500595fb3fc06616de08e6"
 dependencies = [
  "clap_builder",
  "clap_derive",
- "once_cell",
 ]
 
 [[package]]
 name = "clap_builder"
-version = "4.3.17"
+version = "4.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9441b403be87be858db6a23edb493e7f694761acdc3343d5a0fcaafd304cbc9e"
+checksum = "2bb9faaa7c2ef94b2743a21f5a29e6f0010dff4caa69ac8e9d6cf8b6fa74da08"
 dependencies = [
  "anstream",
  "anstyle",
@@ -193,21 +205,21 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.3.12"
+version = "4.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54a9bb5758fc5dfe728d1019941681eccaf0cf8a4189b692a0ee2f2ecf90a050"
+checksum = "0862016ff20d69b84ef8247369fabf5c008a7417002411897d40ee1f4532b873"
 dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.26",
+ "syn",
 ]
 
 [[package]]
 name = "clap_lex"
-version = "0.5.0"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2da6da31387c7e4ef160ffab6d5e7f00c42626fe39aea70a7b0f1773f7dd6c1b"
+checksum = "cd7cc57abe963c6d3b9d8be5b06ba7c8957a930305ca90304f24ef040aa6f961"
 
 [[package]]
 name = "colorchoice"
@@ -223,9 +235,9 @@ checksum = "e496a50fda8aacccc86d7529e2c1e0892dbd0f898a6b5645b5561b89c3210efa"
 
 [[package]]
 name = "cpufeatures"
-version = "0.2.7"
+version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e4c1eaa2012c47becbbad2ab175484c2a84d1185b566fb2cc5b8707343dfe58"
+checksum = "a17b76ff3a4162b0b27f354a0c87015ddad39d35f9c0c36607a3bdd175dde1f1"
 dependencies = [
  "libc",
 ]
@@ -240,6 +252,12 @@ dependencies = [
  "typenum",
 ]
 
+[[package]]
+name = "deranged"
+version = "0.3.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2696e8a945f658fd14dc3b87242e6b80cd0f36ff04ea560fa39082368847946"
+
 [[package]]
 name = "difflib"
 version = "0.4.0"
@@ -258,9 +276,9 @@ dependencies = [
 
 [[package]]
 name = "dissimilar"
-version = "1.0.6"
+version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "210ec60ae7d710bed8683e333e9d2855a8a56a3e9892b38bad3bb0d4d29b0d5e"
+checksum = "86e3bdc80eee6e16b2b6b0f87fbc98c04bee3455e35174c0de1a125d0688c632"
 
 [[package]]
 name = "doc-comment"
@@ -270,15 +288,15 @@ checksum = "fea41bba32d969b513997752735605054bc0dfa92b4c56bf1189f2e174be7a10"
 
 [[package]]
 name = "either"
-version = "1.8.1"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fcaabb2fef8c910e7f4c7ce9f67a1283a1715879a7c230ca9d6d1ae31f16d91"
+checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"
 
 [[package]]
 name = "errno"
-version = "0.3.1"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4bcfec3a70f97c962c307b2d2c56e358cf1d00b558d74262b5f929ee8cc7e73a"
+checksum = "136526188508e25c6fef639d7927dfb3e0e3084488bf202267829cf7fc23dbdd"
 dependencies = [
  "errno-dragonfly",
  "libc",
@@ -305,15 +323,6 @@ dependencies = [
  "once_cell",
 ]
 
-[[package]]
-name = "fastrand"
-version = "1.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e51093e27b0797c359783294ca4f0a911c270184cb10f85783b118614a1501be"
-dependencies = [
- "instant",
-]
-
 [[package]]
 name = "fastrand"
 version = "2.0.0"
@@ -322,13 +331,13 @@ checksum = "6999dc1837253364c2ebb0704ba97994bd874e8f195d665c50b7548f6ea92764"
 
 [[package]]
 name = "filetime"
-version = "0.2.21"
+version = "0.2.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5cbc844cecaee9d4443931972e1289c8ff485cb4cc2767cb03ca139ed6885153"
+checksum = "d4029edd3e734da6fe05b6cd7bd2960760a616bd2ddd0d59a0124746d6272af0"
 dependencies = [
  "cfg-if",
  "libc",
- "redox_syscall 0.2.16",
+ "redox_syscall",
  "windows-sys",
 ]
 
@@ -344,15 +353,26 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.9"
+version = "0.2.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c85e1d9ab2eadba7e5040d4e09cbd6d072b76a557ad64e797c2cb9d4da21d7e4"
+checksum = "be4136b2a15dd319360be1c07d9933517ccf0be8f16bf62a3bee4f0d618df427"
 dependencies = [
  "cfg-if",
  "libc",
  "wasi",
 ]
 
+[[package]]
+name = "goblin"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d6b4de4a8eb6c46a8c77e1d3be942cb9a8bf073c22374578e5ba4b08ed0ff68"
+dependencies = [
+ "log",
+ "plain",
+ "scroll",
+]
+
 [[package]]
 name = "goblin"
 version = "0.7.1"
@@ -379,17 +399,11 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "hermit-abi"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fed44880c466736ef9a5c5b5facefb5ed0785676d0c02d612db14e54f0d84286"
-
 [[package]]
 name = "iana-time-zone"
-version = "0.1.56"
+version = "0.1.57"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0722cd7114b7de04316e7ea5456a0bbb20e4adb46fd27a3697adb812cff0f37c"
+checksum = "2fad5b825842d2b38bd206f3e81d6957625fd7f0a361e345c30e01a0ae2dd613"
 dependencies = [
  "android_system_properties",
  "core-foundation-sys",
@@ -414,38 +428,6 @@ version = "2.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2c785eefb63ebd0e33416dfcb8d6da0bf27ce752843a45632a67bf10d4d4b5c4"
 
-[[package]]
-name = "instant"
-version = "0.1.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "io-lifetimes"
-version = "1.0.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c66c74d2ae7e79a5a8f7ac924adbe38ee42a859c6539ad869eb51f0b52dc220"
-dependencies = [
- "hermit-abi 0.3.1",
- "libc",
- "windows-sys",
-]
-
-[[package]]
-name = "is-terminal"
-version = "0.4.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "adcf93614601c8129ddf72e2d5633df827ba6551541c6d8c59520a371475be1f"
-dependencies = [
- "hermit-abi 0.3.1",
- "io-lifetimes",
- "rustix",
- "windows-sys",
-]
-
 [[package]]
 name = "itertools"
 version = "0.10.5"
@@ -457,15 +439,15 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "1.0.6"
+version = "1.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "453ad9f582a441959e5f0d088b02ce04cfe8d51a8eaf077f12ac6d3e94164ca6"
+checksum = "af150ab688ff2122fcef229be89cb50dd66af9e01a4ff320cc137eecc9bacc38"
 
 [[package]]
 name = "js-sys"
-version = "0.3.63"
+version = "0.3.64"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f37a4a5928311ac501dee68b3c7613a1037d0edb30c8e5427bd832d55d1b790"
+checksum = "c5f195fe497f702db0f318b07fdd68edb16955aed830df8363d837542f8f935a"
 dependencies = [
  "wasm-bindgen",
 ]
@@ -479,9 +461,9 @@ dependencies = [
  "bootspec",
  "clap",
  "expect-test",
- "fastrand 2.0.0",
+ "fastrand",
  "filetime",
- "goblin",
+ "goblin 0.7.1",
  "indoc",
  "log",
  "nix",
@@ -497,64 +479,76 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.144"
+version = "0.2.148"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b00cc1c228a6782d0f076e7b232802e0c5689d41bb5df366f2a6b6621cfdfe1"
+checksum = "9cdc71e17332e86d2e1d38c1f99edcb6288ee11b815fb1a4b049eaa2114d369b"
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.3.8"
+version = "0.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef53942eb7bf7ff43a617b3e2c1c4a5ecf5944a7c1bc12d7ee39bbb15e5c1519"
+checksum = "1a9bad9f94746442c783ca431b22403b519cd7fbeed0533fdd6328b2f2212128"
 
 [[package]]
 name = "log"
-version = "0.4.19"
+version = "0.4.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b06a4cde4c0f271a446782e3eff8de789548ce57dbc8eca9292c27f4a42004b4"
+checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
 
 [[package]]
-name = "memchr"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
-
-[[package]]
-name = "nix"
-version = "0.26.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfdda3d196821d6af13126e40375cdf7da646a96114af134d5f417a9a1dc8e1a"
+name = "lzbt-systemd"
+version = "0.3.0"
 dependencies = [
- "bitflags",
- "cfg-if",
- "libc",
- "static_assertions",
+ "anyhow",
+ "assert_cmd",
+ "clap",
+ "expect-test",
+ "filetime",
+ "goblin 0.6.1",
+ "indoc",
+ "lanzaboote_tool",
+ "log",
+ "nix",
+ "rand",
+ "serde",
+ "serde_json",
+ "sha2",
+ "stderrlog",
+ "tempfile",
+ "walkdir",
 ]
 
 [[package]]
-name = "num-integer"
-version = "0.1.45"
+name = "memchr"
+version = "2.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "225d3389fb3509a24c93f5c29eb6bde2586b98d9f016636dff58d7c6f7569cd9"
+checksum = "8f232d6ef707e1956a43342693d2a31e72989554d58299d7a88738cc95b0d35c"
+
+[[package]]
+name = "nix"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "598beaf3cc6fdd9a5dfb1630c2800c7acd31df7aaf0f565796fba2b53ca1af1b"
 dependencies = [
- "autocfg",
- "num-traits",
+ "bitflags 1.3.2",
+ "cfg-if",
+ "libc",
 ]
 
 [[package]]
 name = "num-traits"
-version = "0.2.15"
+version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "578ede34cf02f8924ab9447f50c28075b4d3e5b269972345e7e0372b38c6cdcd"
+checksum = "f30b0abd723be7e2ffca1272140fac1a2f084c77ec3e123c192b66af1ee9e6c2"
 dependencies = [
  "autocfg",
 ]
 
 [[package]]
 name = "once_cell"
-version = "1.17.1"
+version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7e5500299e16ebb147ae15a00a942af264cf3688f47923b8fc2cd5858f23ad3"
+checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
 
 [[package]]
 name = "plain"
@@ -598,18 +592,18 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.66"
+version = "1.0.67"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18fb31db3f9bddb2ea821cde30a9f70117e3f119938b5ee630b7403aa6e2ead9"
+checksum = "3d433d9f1a3e8c1263d9456598b16fec66f4acc9a74dacffd35c7bb09b3a1328"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.31"
+version = "1.0.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5fe8a65d69dd0808184ebb5f836ab526bb259db23c657efa38711b1072ee47f0"
+checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
 dependencies = [
  "proc-macro2",
 ]
@@ -644,39 +638,29 @@ dependencies = [
  "getrandom",
 ]
 
-[[package]]
-name = "redox_syscall"
-version = "0.2.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb5a58c1855b4b6819d59012155603f0b22ad30cad752600aadfcb695265519a"
-dependencies = [
- "bitflags",
-]
-
 [[package]]
 name = "redox_syscall"
 version = "0.3.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "567664f262709473930a4bf9e51bf2ebf3348f2e748ccc50dea20646858f8f29"
 dependencies = [
- "bitflags",
+ "bitflags 1.3.2",
 ]
 
 [[package]]
 name = "regex-automata"
-version = "0.1.10"
+version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c230d73fb8d8c1b9c0b3135c5142a8acee3a0558fb8db5cf1cb65f8d7862132"
+checksum = "c2f401f4955220693b56f8ec66ee9c78abffd8d1c4f23dc41a23839eb88f0795"
 
 [[package]]
 name = "rustix"
-version = "0.37.19"
+version = "0.38.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "acf8729d8542766f1b2cf77eb034d52f40d375bb8b615d0b147089946e16613d"
+checksum = "d7db8590df6dfcd144d22afd1b83b36c21a18d7cbc1dc4bb5295a8712e9eb662"
 dependencies = [
- "bitflags",
+ "bitflags 2.4.0",
  "errno",
- "io-lifetimes",
  "libc",
  "linux-raw-sys",
  "windows-sys",
@@ -684,9 +668,9 @@ dependencies = [
 
 [[package]]
 name = "ryu"
-version = "1.0.13"
+version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f91339c0467de62360649f8d3e185ca8de4224ff281f66000de5eb2a77a79041"
+checksum = "1ad4cc8da4ef723ed60bced201181d83791ad433213d8c24efffda1eec85d741"
 
 [[package]]
 name = "same-file"
@@ -708,40 +692,40 @@ dependencies = [
 
 [[package]]
 name = "scroll_derive"
-version = "0.11.0"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bdbda6ac5cd1321e724fa9cee216f3a61885889b896f073b8f82322789c5250e"
+checksum = "1db149f81d46d2deba7cd3c50772474707729550221e69588478ebf9ada425ae"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 1.0.109",
+ "syn",
 ]
 
 [[package]]
 name = "serde"
-version = "1.0.172"
+version = "1.0.188"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c489e660549c5f25abb5e7a546a9de2ea437072d7d6f8d8c993ceab4e76be14"
+checksum = "cf9e0fcba69a370eed61bcf2b728575f726b50b55cba78064753d708ddc7549e"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.172"
+version = "1.0.188"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d37fc147b26555e4a092321832edb03124603c0a456c449ecb589ed05bf91f89"
+checksum = "4eca7ac642d82aa35b60049a6eccb4be6be75e599bd2e9adb5f875a737654af2"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.26",
+ "syn",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.103"
+version = "1.0.107"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d03b412469450d4404fe8499a268edd7f8b79fecb074b0d812ad64ca21f4031b"
+checksum = "6b420ce6e3d8bd882e9b243c6eed35dbc9a6110c9769e74b584e0d68d1f20c65"
 dependencies = [
  "itoa",
  "ryu",
@@ -759,12 +743,6 @@ dependencies = [
  "digest",
 ]
 
-[[package]]
-name = "static_assertions"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
-
 [[package]]
 name = "stderrlog"
 version = "0.5.4"
@@ -786,20 +764,9 @@ checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
 
 [[package]]
 name = "syn"
-version = "1.0.109"
+version = "2.0.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "syn"
-version = "2.0.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "45c3457aacde3c65315de5031ec191ce46604304d2446e803d71ade03308d970"
+checksum = "9caece70c63bfba29ec2fed841a09851b14a235c60010fa4de58089b6c025668"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -808,14 +775,13 @@ dependencies = [
 
 [[package]]
 name = "tempfile"
-version = "3.6.0"
+version = "3.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31c0432476357e58790aaa47a8efb0c5138f137343f3b5f23bd36a27e3b0a6d6"
+checksum = "cb94d2f3cc536af71caac6b6fcebf65860b347e7ce0cc9ebe8f70d3e521054ef"
 dependencies = [
- "autocfg",
  "cfg-if",
- "fastrand 1.9.0",
- "redox_syscall 0.3.5",
+ "fastrand",
+ "redox_syscall",
  "rustix",
  "windows-sys",
 ]
@@ -837,22 +803,22 @@ checksum = "3369f5ac52d5eb6ab48c6b4ffdc8efbcad6b89c765749064ba298f2c68a16a76"
 
 [[package]]
 name = "thiserror"
-version = "1.0.40"
+version = "1.0.48"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "978c9a314bd8dc99be594bc3c175faaa9794be04a5a5e153caba6915336cebac"
+checksum = "9d6d7a740b8a666a7e828dd00da9c0dc290dff53154ea77ac109281de90589b7"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.40"
+version = "1.0.48"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9456a42c5b0d803c8cd86e73dd7cc9edd429499f37a3550d286d5e86720569f"
+checksum = "49922ecae66cc8a249b77e68d1d0623c1b2c514f0060c27cdc68bd62a1219d35"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.26",
+ "syn",
 ]
 
 [[package]]
@@ -867,10 +833,11 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.23"
+version = "0.3.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59e399c068f43a5d116fedaf73b203fa4f9c519f17e2b34f63221d3792f81446"
+checksum = "17f6bb557fd245c28e6411aa56b6403c689ad95061f50e4be16c274e70a17e48"
 dependencies = [
+ "deranged",
  "serde",
  "time-core",
 ]
@@ -889,9 +856,9 @@ checksum = "497961ef93d974e23eb6f433eb5fe1b7930b659f06d12dec6fc44a8f554c0bba"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.8"
+version = "1.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5464a87b239f13a63a501f2701565754bae92d243d4bb7eb12f6d57d2269bf4"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
 
 [[package]]
 name = "utf8parse"
@@ -916,9 +883,9 @@ dependencies = [
 
 [[package]]
 name = "walkdir"
-version = "2.3.3"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "36df944cda56c7d8d8b7496af378e6b16de9284591917d307c9b4d313c44e698"
+checksum = "d71d857dc86794ca4c280d616f7da00d2dbfd8cd788846559a6813e6aa4b54ee"
 dependencies = [
  "same-file",
  "winapi-util",
@@ -932,9 +899,9 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.86"
+version = "0.2.87"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5bba0e8cb82ba49ff4e229459ff22a191bbe9a1cb3a341610c9c33efc27ddf73"
+checksum = "7706a72ab36d8cb1f80ffbf0e071533974a60d0a308d01a5d0375bf60499a342"
 dependencies = [
  "cfg-if",
  "wasm-bindgen-macro",
@@ -942,24 +909,24 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.86"
+version = "0.2.87"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19b04bc93f9d6bdee709f6bd2118f57dd6679cf1176a1af464fca3ab0d66d8fb"
+checksum = "5ef2b6d3c510e9625e5fe6f509ab07d66a760f0885d858736483c32ed7809abd"
 dependencies = [
  "bumpalo",
  "log",
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.26",
+ "syn",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.86"
+version = "0.2.87"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14d6b024f1a526bb0234f52840389927257beb670610081360e5a03c5df9c258"
+checksum = "dee495e55982a3bd48105a7b947fd2a9b4a8ae3010041b9e0faab3f9cd028f1d"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -967,22 +934,22 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.86"
+version = "0.2.87"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e128beba882dd1eb6200e1dc92ae6c5dbaa4311aa7bb211ca035779e5efc39f8"
+checksum = "54681b18a46765f095758388f2d0cf16eb8d4169b639ab575a8f5693af210c7b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.26",
+ "syn",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.86"
+version = "0.2.87"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed9d5b4305409d1fc9482fee2d7f9bcbf24b3972bf59817ef757e23982242a93"
+checksum = "ca6ad05a4870b2bf5fe995117d3728437bd27d7cd5f06f13c17443ef369775a1"
 
 [[package]]
 name = "winapi"
@@ -1035,9 +1002,9 @@ dependencies = [
 
 [[package]]
 name = "windows-targets"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b1eb6f0cd7c80c79759c929114ef071b87354ce476d9d94271031c0497adfd5"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
 dependencies = [
  "windows_aarch64_gnullvm",
  "windows_aarch64_msvc",
@@ -1050,42 +1017,42 @@ dependencies = [
 
 [[package]]
 name = "windows_aarch64_gnullvm"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91ae572e1b79dba883e0d315474df7305d12f569b400fcf90581b06062f7e1bc"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
 
 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2ef27e0d7bdfcfc7b868b317c1d32c641a6fe4629c171b8928c7b08d98d7cf3"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
 
 [[package]]
 name = "windows_i686_gnu"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "622a1962a7db830d6fd0a69683c80a18fda201879f0f447f065a3b7467daa241"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
 
 [[package]]
 name = "windows_i686_msvc"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4542c6e364ce21bf45d69fdd2a8e455fa38d316158cfd43b3ac1c5b1b19f8e00"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
 
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca2b8a661f7628cbd23440e50b05d705db3686f894fc9580820623656af974b1"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7896dbc1f41e08872e9d5e8f8baa8fdd2677f29468c4e156210174edc7f7b953"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a515f5799fe4961cb532f983ce2b23082366b898e52ffbce459c86f67c8378a"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
diff --git a/rust/tool/Cargo.toml b/rust/tool/Cargo.toml
index 25f1b28..64901e0 100644
--- a/rust/tool/Cargo.toml
+++ b/rust/tool/Cargo.toml
@@ -1,35 +1,19 @@
-[package]
-name = "lanzaboote_tool"
+[workspace]
+
+members = [
+    "shared",
+    "systemd",
+]
+
+default-members = [
+    "shared",
+    "systemd"
+]
+
+[workspace.package]
 version = "0.3.0"
 edition = "2021"
 
-[[bin]]
-name = "lzbt"
-path = "src/main.rs"
-
-# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
-
-[dependencies]
-anyhow = "1.0.72"
-clap = { version = "4.3.17", features = ["derive"] }
-goblin = "0.7.1"
-nix = { version = "0.26.2", default-features = false, features = [ "fs" ] }
-serde = { version = "1.0.172", features = ["derive"] }
-serde_json = "1.0.103"
-tempfile = "3.6.0"
-bootspec = "1.0"
-walkdir = "2.3.3"
-time = "0.3.23"
-sha2 = "0.10.7"
-# Keep the fastrand version aligned with the one from tempfile to avoid two
-# different versions.
-fastrand = "2.0.0"
-log = { version = "0.4.19", features = ["std"] }
-stderrlog = "0.5.4"
-indoc = "2.0.3"
-
-[dev-dependencies]
-assert_cmd = "2.0.12"
-expect-test = "1.4.1"
-filetime = "0.2.21"
-rand = "0.8.5"
+[profile.release]
+opt-level = "s"
+lto = true
diff --git a/rust/tool/shared/Cargo.toml b/rust/tool/shared/Cargo.toml
new file mode 100644
index 0000000..ac82dab
--- /dev/null
+++ b/rust/tool/shared/Cargo.toml
@@ -0,0 +1,31 @@
+[package]
+name = "lanzaboote_tool"
+version.workspace = true 
+edition.workspace = true 
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+anyhow = "1"
+clap = { version = "4.3", features = ["derive"] }
+goblin = "0.7"
+nix = { version = "0.26", default-features = false, features = [ "fs" ] }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+tempfile = "3.6.0"
+bootspec = "1"
+walkdir = "2"
+time = "0.3"
+sha2 = "0.10"
+# Keep the fastrand version aligned with the one from tempfile to avoid two
+# different versions.
+fastrand = "2.0.0"
+log = { version = "0.4", features = ["std"] }
+stderrlog = "0.5"
+indoc = "2"
+
+[dev-dependencies]
+assert_cmd = "2.0.12"
+expect-test = "1.4.1"
+filetime = "0.2.21"
+rand = "0.8.5"
diff --git a/rust/tool/src/esp.rs b/rust/tool/shared/src/esp.rs
similarity index 55%
rename from rust/tool/src/esp.rs
rename to rust/tool/shared/src/esp.rs
index 440c280..27cd071 100644
--- a/rust/tool/src/esp.rs
+++ b/rust/tool/shared/src/esp.rs
@@ -1,65 +1,25 @@
-use std::array::IntoIter;
-use std::path::{Path, PathBuf};
+use std::{
+    array::IntoIter,
+    path::{Path, PathBuf},
+};
 
 use anyhow::{Context, Result};
 
 use crate::generation::Generation;
 
-/// Paths to the boot files that are not specific to a generation.
-pub struct EspPaths {
-    pub esp: PathBuf,
-    pub efi: PathBuf,
-    pub nixos: PathBuf,
-    pub linux: PathBuf,
-    pub efi_fallback_dir: PathBuf,
-    pub efi_fallback: PathBuf,
-    pub systemd: PathBuf,
-    pub systemd_boot: PathBuf,
-    pub loader: PathBuf,
-    pub systemd_boot_loader_config: PathBuf,
-}
-
-impl EspPaths {
-    pub fn new(esp: impl AsRef<Path>) -> Self {
-        let esp = esp.as_ref();
-        let efi = esp.join("EFI");
-        let efi_nixos = efi.join("nixos");
-        let efi_linux = efi.join("Linux");
-        let efi_systemd = efi.join("systemd");
-        let efi_efi_fallback_dir = efi.join("BOOT");
-        let loader = esp.join("loader");
-        let systemd_boot_loader_config = loader.join("loader.conf");
-
-        Self {
-            esp: esp.to_path_buf(),
-            efi,
-            nixos: efi_nixos,
-            linux: efi_linux,
-            efi_fallback_dir: efi_efi_fallback_dir.clone(),
-            efi_fallback: efi_efi_fallback_dir.join("BOOTX64.EFI"),
-            systemd: efi_systemd.clone(),
-            systemd_boot: efi_systemd.join("systemd-bootx64.efi"),
-            loader,
-            systemd_boot_loader_config,
-        }
-    }
+/// Generic ESP paths which can be specific to a bootloader
+pub trait EspPaths<const N: usize> {
+    /// Build an ESP path structure out of the ESP root directory
+    fn new(esp: impl AsRef<Path>) -> Self;
 
     /// Return the used file paths to store as garbage collection roots.
-    pub fn to_iter(&self) -> IntoIter<&PathBuf, 10> {
-        [
-            &self.esp,
-            &self.efi,
-            &self.nixos,
-            &self.linux,
-            &self.efi_fallback_dir,
-            &self.efi_fallback,
-            &self.systemd,
-            &self.systemd_boot,
-            &self.loader,
-            &self.systemd_boot_loader_config,
-        ]
-        .into_iter()
-    }
+    fn iter(&self) -> std::array::IntoIter<&PathBuf, N>;
+
+    /// Returns the path containing NixOS EFI binaries
+    fn nixos_path(&self) -> &Path;
+
+    /// Returns the path containing Linux EFI binaries
+    fn linux_path(&self) -> &Path;
 }
 
 /// Paths to the boot files of a specific generation.
@@ -70,21 +30,24 @@ pub struct EspGenerationPaths {
 }
 
 impl EspGenerationPaths {
-    pub fn new(esp_paths: &EspPaths, generation: &Generation) -> Result<Self> {
+    pub fn new<const N: usize, P: EspPaths<N>>(
+        esp_paths: &P,
+        generation: &Generation,
+    ) -> Result<Self> {
         let bootspec = &generation.spec.bootspec.bootspec;
 
         Ok(Self {
             kernel: esp_paths
-                .nixos
+                .nixos_path()
                 .join(nixos_path(&bootspec.kernel, "bzImage")?),
-            initrd: esp_paths.nixos.join(nixos_path(
+            initrd: esp_paths.nixos_path().join(nixos_path(
                 bootspec
                     .initrd
                     .as_ref()
                     .context("Lanzaboote does not support missing initrd yet")?,
                 "initrd",
             )?),
-            lanzaboote_image: esp_paths.linux.join(generation_path(generation)),
+            lanzaboote_image: esp_paths.linux_path().join(generation_path(generation)),
         })
     }
 
diff --git a/rust/tool/src/gc.rs b/rust/tool/shared/src/gc.rs
similarity index 98%
rename from rust/tool/src/gc.rs
rename to rust/tool/shared/src/gc.rs
index 85e4398..2dd66b6 100644
--- a/rust/tool/src/gc.rs
+++ b/rust/tool/shared/src/gc.rs
@@ -80,6 +80,12 @@ impl Roots {
     }
 }
 
+impl Default for Roots {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/rust/tool/src/generation.rs b/rust/tool/shared/src/generation.rs
similarity index 100%
rename from rust/tool/src/generation.rs
rename to rust/tool/shared/src/generation.rs
diff --git a/rust/tool/shared/src/lib.rs b/rust/tool/shared/src/lib.rs
new file mode 100644
index 0000000..eb3c899
--- /dev/null
+++ b/rust/tool/shared/src/lib.rs
@@ -0,0 +1,7 @@
+pub mod esp;
+pub mod gc;
+pub mod generation;
+pub mod os_release;
+pub mod pe;
+pub mod signature;
+pub mod utils;
diff --git a/rust/tool/src/os_release.rs b/rust/tool/shared/src/os_release.rs
similarity index 96%
rename from rust/tool/src/os_release.rs
rename to rust/tool/shared/src/os_release.rs
index 42e75c1..cdee3dc 100644
--- a/rust/tool/src/os_release.rs
+++ b/rust/tool/shared/src/os_release.rs
@@ -1,5 +1,5 @@
-use std::collections::BTreeMap;
 use std::fmt;
+use std::{collections::BTreeMap, str::FromStr};
 
 use anyhow::{Context, Result};
 
@@ -34,14 +34,17 @@ impl OsRelease {
 
         Ok(Self(map))
     }
+}
 
+impl FromStr for OsRelease {
+    type Err = anyhow::Error;
     /// Parse the string representation of a os-release file.
     ///
     /// **Beware before reusing this function!**
     ///
     /// This parser might not parse all valid os-release files correctly. It is only designed to
     /// read the `VERSION` key from the os-release of a systemd-boot binary.
-    pub fn from_str(value: &str) -> Result<Self> {
+    fn from_str(value: &str) -> Result<Self> {
         let mut map = BTreeMap::new();
 
         // All valid lines
diff --git a/rust/tool/src/pe.rs b/rust/tool/shared/src/pe.rs
similarity index 100%
rename from rust/tool/src/pe.rs
rename to rust/tool/shared/src/pe.rs
diff --git a/rust/tool/src/signature.rs b/rust/tool/shared/src/signature.rs
similarity index 100%
rename from rust/tool/src/signature.rs
rename to rust/tool/shared/src/signature.rs
diff --git a/rust/tool/src/utils.rs b/rust/tool/shared/src/utils.rs
similarity index 100%
rename from rust/tool/src/utils.rs
rename to rust/tool/shared/src/utils.rs
diff --git a/rust/tool/systemd/Cargo.toml b/rust/tool/systemd/Cargo.toml
new file mode 100644
index 0000000..33784be
--- /dev/null
+++ b/rust/tool/systemd/Cargo.toml
@@ -0,0 +1,27 @@
+[package]
+name = "lzbt-systemd"
+version.workspace = true 
+edition = "2021"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+anyhow = "1.0.71"
+stderrlog = "0.5.4"
+log = { version = "0.4.18", features = ["std"] }
+clap = { version = "4.3.1", features = ["derive"] }
+lanzaboote_tool = { path = "../shared" }
+indoc = "2.0.1"
+tempfile = "3.5.0"
+nix = { version = "0.26.2", default-features = false, features = [ "fs" ] }
+
+[dev-dependencies]
+assert_cmd = "2.0.11"
+expect-test = "1.4.1"
+filetime = "0.2.21"
+rand = "0.8.5"
+serde_json = "1.0.96"
+goblin = "0.6.1"
+serde = { version = "1.0.163", features = ["derive"] }
+walkdir = "2.3.3"
+sha2 = "0.10.6"
diff --git a/rust/tool/src/cli.rs b/rust/tool/systemd/src/cli.rs
similarity index 98%
rename from rust/tool/src/cli.rs
rename to rust/tool/systemd/src/cli.rs
index 9ad6091..df86121 100644
--- a/rust/tool/src/cli.rs
+++ b/rust/tool/systemd/src/cli.rs
@@ -4,7 +4,7 @@ use anyhow::{Context, Result};
 use clap::{Parser, Subcommand};
 
 use crate::install;
-use crate::signature::KeyPair;
+use lanzaboote_tool::signature::KeyPair;
 
 /// The default log level.
 ///
diff --git a/rust/tool/systemd/src/esp.rs b/rust/tool/systemd/src/esp.rs
new file mode 100644
index 0000000..e3afd6e
--- /dev/null
+++ b/rust/tool/systemd/src/esp.rs
@@ -0,0 +1,68 @@
+use std::path::{Path, PathBuf};
+
+use lanzaboote_tool::esp::EspPaths;
+
+/// Paths to the boot files that are not specific to a generation.
+/// Systemd variant
+pub struct SystemdEspPaths {
+    pub esp: PathBuf,
+    pub efi: PathBuf,
+    pub nixos: PathBuf,
+    pub linux: PathBuf,
+    pub efi_fallback_dir: PathBuf,
+    pub efi_fallback: PathBuf,
+    pub systemd: PathBuf,
+    pub systemd_boot: PathBuf,
+    pub loader: PathBuf,
+    pub systemd_boot_loader_config: PathBuf,
+}
+
+impl EspPaths<10> for SystemdEspPaths {
+    fn new(esp: impl AsRef<Path>) -> Self {
+        let esp = esp.as_ref();
+        let efi = esp.join("EFI");
+        let efi_nixos = efi.join("nixos");
+        let efi_linux = efi.join("Linux");
+        let efi_systemd = efi.join("systemd");
+        let efi_efi_fallback_dir = efi.join("BOOT");
+        let loader = esp.join("loader");
+        let systemd_boot_loader_config = loader.join("loader.conf");
+
+        Self {
+            esp: esp.to_path_buf(),
+            efi,
+            nixos: efi_nixos,
+            linux: efi_linux,
+            efi_fallback_dir: efi_efi_fallback_dir.clone(),
+            efi_fallback: efi_efi_fallback_dir.join("BOOTX64.EFI"),
+            systemd: efi_systemd.clone(),
+            systemd_boot: efi_systemd.join("systemd-bootx64.efi"),
+            loader,
+            systemd_boot_loader_config,
+        }
+    }
+
+    fn nixos_path(&self) -> &Path {
+        &self.nixos
+    }
+
+    fn linux_path(&self) -> &Path {
+        &self.linux
+    }
+
+    fn iter(&self) -> std::array::IntoIter<&PathBuf, 10> {
+        [
+            &self.esp,
+            &self.efi,
+            &self.nixos,
+            &self.linux,
+            &self.efi_fallback_dir,
+            &self.efi_fallback,
+            &self.systemd,
+            &self.systemd_boot,
+            &self.loader,
+            &self.systemd_boot_loader_config,
+        ]
+        .into_iter()
+    }
+}
diff --git a/rust/tool/src/install.rs b/rust/tool/systemd/src/install.rs
similarity index 97%
rename from rust/tool/src/install.rs
rename to rust/tool/systemd/src/install.rs
index c860dc9..789cb3f 100644
--- a/rust/tool/src/install.rs
+++ b/rust/tool/systemd/src/install.rs
@@ -10,14 +10,15 @@ use anyhow::{anyhow, Context, Result};
 use nix::unistd::syncfs;
 use tempfile::TempDir;
 
-use crate::esp::{EspGenerationPaths, EspPaths};
-use crate::gc::Roots;
-use crate::generation::{Generation, GenerationLink};
-use crate::os_release::OsRelease;
-use crate::pe;
-use crate::signature::KeyPair;
-use crate::systemd::SystemdVersion;
-use crate::utils::{file_hash, SecureTempDirExt};
+use crate::esp::SystemdEspPaths;
+use crate::version::SystemdVersion;
+use lanzaboote_tool::esp::{EspGenerationPaths, EspPaths};
+use lanzaboote_tool::gc::Roots;
+use lanzaboote_tool::generation::{Generation, GenerationLink};
+use lanzaboote_tool::os_release::OsRelease;
+use lanzaboote_tool::pe;
+use lanzaboote_tool::signature::KeyPair;
+use lanzaboote_tool::utils::{file_hash, SecureTempDirExt};
 
 pub struct Installer {
     broken_gens: BTreeSet<u64>,
@@ -27,7 +28,7 @@ pub struct Installer {
     systemd_boot_loader_config: PathBuf,
     key_pair: KeyPair,
     configuration_limit: usize,
-    esp_paths: EspPaths,
+    esp_paths: SystemdEspPaths,
     generation_links: Vec<PathBuf>,
 }
 
@@ -42,8 +43,8 @@ impl Installer {
         generation_links: Vec<PathBuf>,
     ) -> Self {
         let mut gc_roots = Roots::new();
-        let esp_paths = EspPaths::new(esp);
-        gc_roots.extend(esp_paths.to_iter());
+        let esp_paths = SystemdEspPaths::new(esp);
+        gc_roots.extend(esp_paths.iter());
 
         Self {
             broken_gens: BTreeSet::new(),
diff --git a/rust/tool/src/main.rs b/rust/tool/systemd/src/main.rs
similarity index 57%
rename from rust/tool/src/main.rs
rename to rust/tool/systemd/src/main.rs
index acf91b4..b453557 100644
--- a/rust/tool/src/main.rs
+++ b/rust/tool/systemd/src/main.rs
@@ -1,13 +1,7 @@
 mod cli;
 mod esp;
-mod gc;
-mod generation;
 mod install;
-mod os_release;
-mod pe;
-mod signature;
-mod systemd;
-mod utils;
+mod version;
 
 use clap::Parser;
 
diff --git a/rust/tool/src/systemd.rs b/rust/tool/systemd/src/version.rs
similarity index 97%
rename from rust/tool/src/systemd.rs
rename to rust/tool/systemd/src/version.rs
index 24a29eb..0a088f8 100644
--- a/rust/tool/src/systemd.rs
+++ b/rust/tool/systemd/src/version.rs
@@ -5,8 +5,8 @@ use std::str::FromStr;
 
 use anyhow::{Context, Result};
 
-use crate::os_release::OsRelease;
-use crate::pe;
+use lanzaboote_tool::os_release::OsRelease;
+use lanzaboote_tool::pe;
 
 /// A systemd version.
 ///
diff --git a/rust/tool/tests/common/mod.rs b/rust/tool/systemd/tests/common/mod.rs
similarity index 99%
rename from rust/tool/tests/common/mod.rs
rename to rust/tool/systemd/tests/common/mod.rs
index 2a9ea2e..f0a97ec 100644
--- a/rust/tool/tests/common/mod.rs
+++ b/rust/tool/systemd/tests/common/mod.rs
@@ -126,7 +126,7 @@ pub fn lanzaboote_install(
     let test_loader_config = r"timeout 0\nconsole-mode 1\n";
     fs::write(test_loader_config_path.path(), test_loader_config)?;
 
-    let mut cmd = Command::cargo_bin("lzbt")?;
+    let mut cmd = Command::cargo_bin("lzbt-systemd")?;
     let output = cmd
         .env("LANZABOOTE_STUB", test_systemd_stub)
         .arg("-vv")
diff --git a/rust/tool/tests/fixtures/uefi-keys/db.key b/rust/tool/systemd/tests/fixtures/uefi-keys/db.key
similarity index 100%
rename from rust/tool/tests/fixtures/uefi-keys/db.key
rename to rust/tool/systemd/tests/fixtures/uefi-keys/db.key
diff --git a/rust/tool/tests/fixtures/uefi-keys/db.pem b/rust/tool/systemd/tests/fixtures/uefi-keys/db.pem
similarity index 100%
rename from rust/tool/tests/fixtures/uefi-keys/db.pem
rename to rust/tool/systemd/tests/fixtures/uefi-keys/db.pem
diff --git a/rust/tool/tests/gc.rs b/rust/tool/systemd/tests/gc.rs
similarity index 100%
rename from rust/tool/tests/gc.rs
rename to rust/tool/systemd/tests/gc.rs
diff --git a/rust/tool/tests/install.rs b/rust/tool/systemd/tests/install.rs
similarity index 100%
rename from rust/tool/tests/install.rs
rename to rust/tool/systemd/tests/install.rs
diff --git a/rust/tool/tests/os_release.rs b/rust/tool/systemd/tests/os_release.rs
similarity index 100%
rename from rust/tool/tests/os_release.rs
rename to rust/tool/systemd/tests/os_release.rs
diff --git a/rust/tool/tests/systemd_boot.rs b/rust/tool/systemd/tests/systemd_boot.rs
similarity index 100%
rename from rust/tool/tests/systemd_boot.rs
rename to rust/tool/systemd/tests/systemd_boot.rs
diff --git a/rust/uefi/rust-toolchain.toml b/rust/uefi/rust-toolchain.toml
index 067ccdb..530928a 100644
--- a/rust/uefi/rust-toolchain.toml
+++ b/rust/uefi/rust-toolchain.toml
@@ -1,4 +1,4 @@
 [toolchain]
-channel = "1.68.2"
+channel = "1.70.0"
 components = [ "rust-src" ]
 targets = [ "x86_64-unknown-uefi" ]