diff --git a/build_image b/build_image
index bd87b69ca5..9a8cc163fc 100755
--- a/build_image
+++ b/build_image
@@ -22,6 +22,10 @@ DEFAULT_GROUP=developer
 # Developer-visible flags.
 DEFINE_string board "${DEFAULT_BOARD}" \
   "The board to build an image for."
+DEFINE_boolean getbinpkg "${FLAGS_FALSE}" \
+  "Download binary packages from remote repository."
+DEFINE_string getbinpkgver "" \
+  "Use binary packages from a specific version."
 DEFINE_boolean enable_rootfs_verification ${FLAGS_TRUE} \
   "Default all bootloaders to use kernel-based root fs integrity checking."
 DEFINE_boolean enable_verity ${FLAGS_FALSE} \
@@ -84,6 +88,12 @@ switch_to_strict_mode
 
 check_gsutil_opts
 
+# If downloading packages is enabled ensure the board is configured properly.
+if [[ ${FLAGS_getbinpkg} -eq ${FLAGS_TRUE} ]]; then
+  "${SRC_ROOT}/scripts/setup_board" --board="${FLAGS_board}" \
+      --getbinpkgver="${FLAGS_getbinpkgver}" --regen_configs_only
+fi
+
 # N.B.  Ordering matters for some of the libraries below, because
 # some of the files contain initialization used by later files.
 . "${BUILD_LIBRARY_DIR}/toolchain_util.sh" || exit 1
diff --git a/build_library/build_image_util.sh b/build_library/build_image_util.sh
index 65b241a4e5..3dc817d8e1 100755
--- a/build_library/build_image_util.sh
+++ b/build_library/build_image_util.sh
@@ -114,6 +114,10 @@ run_ldconfig() {
 emerge_to_image() {
   local root_fs_dir="$1"; shift
 
+  if [[ ${FLAGS_getbinpkg} -eq ${FLAGS_TRUE} ]]; then
+    set -- --getbinpkg "$@"
+  fi
+
   sudo -E ROOT="${root_fs_dir}" \
       PORTAGE_CONFIGROOT="${BUILD_DIR}"/configroot \
       emerge --root-deps=rdeps --usepkgonly --jobs=$FLAGS_jobs -v "$@"
diff --git a/build_library/prod_image_util.sh b/build_library/prod_image_util.sh
index 9193e62355..7eb519efc6 100755
--- a/build_library/prod_image_util.sh
+++ b/build_library/prod_image_util.sh
@@ -3,16 +3,42 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
+# Lookup the current version of a binary package, downloading it if needed.
+# Usage: get_binary_pkg some-pkg/name
+# Prints: some-pkg/name-1.2.3
+get_binary_pkg() {
+    local name="$1" version
+
+    # If possible use the version installed in $BOARD_ROOT,
+    # fall back to any binary package that is available.
+    version=$(pkg_version installed "${name}")
+    if [[ -z "${version}" ]]; then
+        version=$(pkg_version binary "${name}")
+    fi
+
+    # Nothing? Maybe we can fetch it.
+    if [[ -z "${version}" && ${FLAGS_getbinpkg} -eq ${FLAGS_TRUE} ]]; then
+        emerge-${BOARD} --getbinpkg --usepkgonly --fetchonly --nodeps "${name}" >&2
+        version=$(pkg_version binary "${name}")
+    fi
+
+    # Cry
+    if [[ -z "${version}" ]]; then
+        die "Binary package missing for ${name}"
+    fi
+
+    echo "${version}"
+}
+
 # The GCC package includes both its libraries and the compiler.
 # In prod images we only need the shared libraries.
 extract_prod_gcc() {
-    local root_fs_dir="$1"; shift
-    local gcc=$(portageq-${BOARD} best_version "${BOARD_ROOT}" sys-devel/gcc)
-    local pkg="$(portageq-${BOARD} pkgdir)/${gcc}.tbz2"
+    local root_fs_dir="$1" gcc pkg
+    gcc=$(get_binary_pkg sys-devel/gcc)
 
-    if [[ ! -f "${pkg}" ]]; then
-        die "Binary package missing: $pkg"
-    fi
+    # FIXME(marineam): Incompatible with FEATURES=binpkg-multi-instance
+    pkg="$(portageq-${BOARD} pkgdir)/${gcc}.tbz2"
+    [[ -f "${pkg}" ]] || die "${pkg} is missing"
 
     # Normally GCC's shared libraries are installed to:
     #  /usr/lib/gcc/x86_64-cros-linux-gnu/$version/*