diff --git a/flake.nix b/flake.nix
index d302d52..31e0a6b 100644
--- a/flake.nix
+++ b/flake.nix
@@ -55,18 +55,26 @@
           --change-section-vma .cmdline=$(printf 0x%x $cmdline_offs) \
            "$IN" "$OUT"
       '';
-      
-      lanzaboote = naersk-nightly.buildPackage {
-        src = ./rust/lanzaboote;
+
+      buildRustEfiApp = src: naersk-nightly.buildPackage {
+        inherit src;
         cargoBuildOptions = old: old ++ [
           "--target x86_64-unknown-uefi"
         ];
       };
 
-      lanzatool = naersk-nightly.buildPackage {
-        src = ./rust/lanzatool;
+      buildRustLinuxApp = src: naersk-nightly.buildPackage {
+        inherit src;
       };
 
+      # This is basically an empty EFI application that we use as a
+      # carrier for the initrd.
+      initrd-stub = buildRustEfiApp ./rust-nightly/initrd-stub;
+
+      lanzaboote = buildRustEfiApp ./rust/lanzaboote;
+
+      lanzatool = buildRustLinuxApp ./rust/lanzatool;
+
       osrel = pkgs.writeText "lanzaboote-osrel" ''
         NAME=Lanzaboote
         VERSION="${lanzaboote.version}"
diff --git a/rust/initrd-stub/.cargo/config b/rust/initrd-stub/.cargo/config
new file mode 100644
index 0000000..85d49dc
--- /dev/null
+++ b/rust/initrd-stub/.cargo/config
@@ -0,0 +1,2 @@
+[build]
+target = "x86_64-unknown-uefi"
diff --git a/rust/initrd-stub/Cargo.lock b/rust/initrd-stub/Cargo.lock
new file mode 100644
index 0000000..6c72db2
--- /dev/null
+++ b/rust/initrd-stub/Cargo.lock
@@ -0,0 +1,104 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "bit_field"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dcb6dd1c2376d2e096796e234a70e17e94cc2d5d54ff8ce42b28cef1d0d359a4"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "initrd-stub"
+version = "0.1.0"
+dependencies = [
+ "uefi",
+]
+
+[[package]]
+name = "log"
+version = "0.4.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "abb12e687cfb44aa40f41fc3978ef76448f9b6038cad6aef4259d3c095a2382e"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ea3d908b0e36316caf9e9e2c4625cdde190a7e6f440d794667ed17a1855e725"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbe448f377a7d6961e30f5955f9b8d106c3f5e449d493ee1b125c1d43c2b5179"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "syn"
+version = "1.0.103"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a864042229133ada95abf3b54fdc62ef5ccabe9515b64717bcb9a1919e59445d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "ucs2"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bad643914094137d475641b6bab89462505316ec2ce70907ad20102d28a79ab8"
+dependencies = [
+ "bit_field",
+]
+
+[[package]]
+name = "uefi"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07b87700863d65dd4841556be3374d8d4f9f8dbb577ad93a39859e70b3b91f35"
+dependencies = [
+ "bitflags",
+ "log",
+ "ucs2",
+ "uefi-macros",
+]
+
+[[package]]
+name = "uefi-macros"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "275f054a1d9fd7e43a2ce91cc24298a87b281117dea8afc120ae95faa0e96b94"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ceab39d59e4c9499d4e5a8ee0e2735b891bb7308ac83dfb4e80cad195c9f6f3"
diff --git a/rust/initrd-stub/Cargo.toml b/rust/initrd-stub/Cargo.toml
new file mode 100644
index 0000000..a324f85
--- /dev/null
+++ b/rust/initrd-stub/Cargo.toml
@@ -0,0 +1,12 @@
+[package]
+name = "initrd-stub"
+version = "0.1.0"
+edition = "2021"
+publish = false
+
+[dependencies]
+uefi = { version = "0.18.0", default-features = false, features = [ ] }
+
+[profile.release]
+opt-level = "s"
+lto = true
diff --git a/rust/initrd-stub/src/main.rs b/rust/initrd-stub/src/main.rs
new file mode 100644
index 0000000..27f639d
--- /dev/null
+++ b/rust/initrd-stub/src/main.rs
@@ -0,0 +1,19 @@
+#![no_main]
+#![no_std]
+#![feature(abi_efiapi)]
+
+use core::panic::PanicInfo;
+use uefi::{
+    prelude::{entry, Boot, SystemTable},
+    Handle, Status,
+};
+
+#[panic_handler]
+fn panic(_info: &PanicInfo) -> ! {
+    loop {}
+}
+
+#[entry]
+fn main(_handle: Handle, mut _system_table: SystemTable<Boot>) -> Status {
+    Status::UNSUPPORTED
+}