diff --git a/build_library/build_image_util.sh b/build_library/build_image_util.sh
index a2be5c8c5b..d363771a14 100755
--- a/build_library/build_image_util.sh
+++ b/build_library/build_image_util.sh
@@ -29,7 +29,7 @@ set_build_symlinks() {
 }
 
 cleanup_mounts() {
-  echo "Cleaning up mounts"
+  info "Cleaning up mounts"
   "${BUILD_LIBRARY_DIR}/disk_util" umount "$1" || true
 }
 
diff --git a/build_library/modify_image_util.sh b/build_library/modify_image_util.sh
new file mode 100755
index 0000000000..fe8d4683d2
--- /dev/null
+++ b/build_library/modify_image_util.sh
@@ -0,0 +1,101 @@
+#!/bin/bash
+
+# Copyright (c) 2014 The CoreOS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Shell library for modifying an image built with build_image.
+
+start_modify_image() {
+    # Default to the most recent image
+    if [[ -z "${FLAGS_from}" ]] ; then
+        FLAGS_from="$(${SCRIPT_ROOT}/get_latest_image.sh --board=${FLAGS_board})"
+    else
+        FLAGS_from="$(readlink -f "${FLAGS_from}")"
+    fi
+
+    local src_image="${FLAGS_from}/${COREOS_PRODUCTION_IMAGE_NAME}"
+    if [[ ! -f "${src_image}" ]]; then
+        die_notrace "Source image does not exist: ${src_image}"
+    fi
+
+    # Source should include version.txt, switch to its version information
+    if [[ ! -f "${FLAGS_from}/version.txt" ]]; then
+        die_notrace "Source version info does not exist: ${FLAGS_from}/version.txt"
+    fi
+    source "${FLAGS_from}/version.txt"
+    COREOS_VERSION_STRING="${COREOS_VERSION}"
+
+    # Load after version.txt to set the correct output paths
+    . "${BUILD_LIBRARY_DIR}/toolchain_util.sh"
+    . "${BUILD_LIBRARY_DIR}/board_options.sh"
+    . "${BUILD_LIBRARY_DIR}/build_image_util.sh"
+
+    # Handle existing directory.
+    if [[ -e "${BUILD_DIR}" ]]; then
+        if [[ ${FLAGS_replace} -eq ${FLAGS_TRUE} ]]; then
+            sudo rm -rf "${BUILD_DIR}"
+        else
+            error "Directory ${BUILD_DIR} already exists."
+            error "Use --build_attempt option to specify an unused attempt."
+            error "Or use --replace if you want to overwrite this directory."
+            die "Unwilling to overwrite ${BUILD_DIR}."
+        fi
+    fi
+
+    # Create the output directory and temporary mount points.
+    DST_IMAGE="${BUILD_DIR}/${COREOS_PRODUCTION_IMAGE_NAME}"
+    ROOT_FS_DIR="${BUILD_DIR}/rootfs"
+    mkdir -p "${ROOT_FS_DIR}"
+
+    info "Copying from ${FLAGS_from}"
+    cp "${src_image}" "${DST_IMAGE}"
+
+    # Copy all extra useful things, these do not need to be modified.
+    local update_prefix="${COREOS_PRODUCTION_IMAGE_NAME%_image.bin}_update"
+    local production_prefix="${COREOS_PRODUCTION_IMAGE_NAME%.bin}"
+    local container_prefix="${COREOS_DEVELOPER_CONTAINER_NAME%.bin}"
+    local pcr_data="${COREOS_PRODUCTION_IMAGE_NAME%.bin}_pcr_policy.zip"
+    EXTRA_FILES=(
+        "version.txt"
+        "${update_prefix}.bin"
+        "${update_prefix}.zip"
+        "${pcr_data}"
+        "${production_prefix}_contents.txt"
+        "${production_prefix}_packages.txt"
+        "${COREOS_DEVELOPER_CONTAINER_NAME}"
+        "${container_prefix}_contents.txt"
+        "${container_prefix}_packages.txt"
+        )
+    for filename in "${EXTRA_FILES[@]}"; do
+        if [[ -e "${FLAGS_from}/${filename}" ]]; then
+            cp "${FLAGS_from}/${filename}" "${BUILD_DIR}/${filename}"
+        fi
+    done
+
+    "${BUILD_LIBRARY_DIR}/disk_util" --disk_layout="${FLAGS_disk_layout}" \
+            mount "${DST_IMAGE}" "${ROOT_FS_DIR}"
+    trap "cleanup_mounts '${ROOT_FS_DIR}'" EXIT
+}
+
+finish_modify_image() {
+    cleanup_mounts "${ROOT_FS_DIR}"
+    trap - EXIT
+
+    upload_image "${DST_IMAGE}"
+    for filename in "${EXTRA_FILES[@]}"; do
+        if [[ -e "${BUILD_DIR}/${filename}" ]]; then
+            upload_image "${BUILD_DIR}/${filename}"
+        fi
+    done
+
+    set_build_symlinks "${FLAGS_group}-latest"
+
+    info "Done. Updated image is in ${BUILD_DIR}"
+    cat << EOF
+To convert it to a virtual machine image, use:
+  ./image_to_vm.sh --from=${OUTSIDE_OUTPUT_DIR} --board=${BOARD} --prod_image
+
+The default type is qemu, see ./image_to_vm.sh --help for other options.
+EOF
+}
diff --git a/image_inject_bootchain b/image_inject_bootchain
new file mode 100755
index 0000000000..ddd2de7c5e
--- /dev/null
+++ b/image_inject_bootchain
@@ -0,0 +1,101 @@
+#!/bin/bash
+
+# Copyright (c) 2014 The CoreOS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+SCRIPT_ROOT=$(dirname "$(readlink -f "$0")")
+. "${SCRIPT_ROOT}/common.sh" || exit 1
+
+# Script must run inside the chroot
+restart_in_chroot_if_needed "$@"
+
+assert_not_root_user
+
+DEFAULT_GROUP=developer
+
+# Flags
+DEFINE_string kernel_path "" \
+    "Path to the kernel to inject."
+DEFINE_string efi_grub_path "" \
+    "Path to the EFI GRUB image to inject."
+DEFINE_string shim_path "" \
+    "Path to the shim image to inject."
+DEFINE_string group "${DEFAULT_GROUP}" \
+    "The update group."
+DEFINE_string board "${DEFAULT_BOARD}" \
+    "Board for which the image was built"
+DEFINE_string disk_layout "base" \
+    "The disk layout type to use for this image."
+DEFINE_string from "" \
+    "Directory containing ${COREOS_PRODUCTION_IMAGE_NAME}"
+DEFINE_string output_root "${DEFAULT_BUILD_ROOT}/images" \
+    "Directory in which to place image result directories (named by version)"
+DEFINE_boolean replace ${FLAGS_FALSE} \
+    "Overwrite existing output, if any."
+
+# include upload options
+. "${BUILD_LIBRARY_DIR}/release_util.sh" || exit 1
+
+show_help_if_requested "$@"
+
+# Usually unneeded, so just leave this option hidden.
+DEFINE_integer build_attempt 1 \
+    "The build attempt for this image build."
+
+# Parse command line
+FLAGS "$@" || exit 1
+eval set -- "${FLAGS_ARGV}"
+
+# Die on any errors.
+switch_to_strict_mode
+
+check_gsutil_opts
+
+if [[ -z "${FLAGS_kernel_path}" && -z "${FLAGS_efi_grub_path}" &&
+        -z "${FLAGS_shim_path}" ]]; then
+    die_notrace "Specify at least one of --kernel_path, --efi_grub_path, --shim_path"
+fi
+
+. "${BUILD_LIBRARY_DIR}/modify_image_util.sh"
+
+do_copy() {
+    local src="$1"
+    local dst="$2"
+
+    if [[ ! -f "${ROOT_FS_DIR}/${dst}" ]]; then
+        # We should only be overwriting existing files.
+        die "${dst} doesn't exist in image; refusing to create it"
+    fi
+    info "Replacing ${dst}"
+    sudo cp "${src}" "${ROOT_FS_DIR}/${dst}"
+}
+
+start_modify_image
+
+if [[ -n "${FLAGS_kernel_path}" ]]; then
+    do_copy "${FLAGS_kernel_path}" "/boot/coreos/vmlinuz-a"
+fi
+
+# FIXME(bgilbert): no shim on arm64
+if [[ -n "${FLAGS_efi_grub_path}" ]]; then
+    case "${BOARD}" in
+    amd64-usr) image_name="grub.efi" ;;
+    arm64-usr) image_name="bootaa64.efi" ;;
+    *) die "GRUB filename not known for this board" ;;
+    esac
+
+    do_copy "${FLAGS_efi_grub_path}" "/boot/EFI/boot/${image_name}"
+fi
+
+if [[ -n "${FLAGS_shim_path}" ]]; then
+    case "${BOARD}" in
+    amd64-usr) image_name="bootx64.efi" ;;
+    *) die "Shim filename not known for this board" ;;
+    esac
+
+    do_copy "${FLAGS_shim_path}" "/boot/EFI/boot/${image_name}"
+fi
+
+finish_modify_image
+command_completed
diff --git a/image_set_group b/image_set_group
index 2eef2e06ca..1db49e8341 100755
--- a/image_set_group
+++ b/image_set_group
@@ -52,75 +52,9 @@ if [[ -z "${FLAGS_group}" ]] ; then
   die_notrace "--group is required."
 fi
 
-# Default to the most recent image
-if [[ -z "${FLAGS_from}" ]] ; then
-  FLAGS_from="$(${SCRIPT_ROOT}/get_latest_image.sh --board=${FLAGS_board})"
-else
-  FLAGS_from="$(readlink -f "${FLAGS_from}")"
-fi
+. "${BUILD_LIBRARY_DIR}/modify_image_util.sh"
 
-SRC_IMAGE="${FLAGS_from}/${COREOS_PRODUCTION_IMAGE_NAME}"
-if [[ ! -f "${SRC_IMAGE}" ]]; then
-  die_notrace "Source image does not exist: ${SRC_IMAGE}"
-fi
-
-# Source should include version.txt, switch to its version information
-if [[ ! -f "${FLAGS_from}/version.txt" ]]; then
-  die_notrace "Source version info does not exist: ${FLAGS_from}/version.txt"
-fi
-source "${FLAGS_from}/version.txt"
-COREOS_VERSION_STRING="${COREOS_VERSION}"
-
-# Load after version.txt to set the correct output paths
-. "${BUILD_LIBRARY_DIR}/toolchain_util.sh"
-. "${BUILD_LIBRARY_DIR}/board_options.sh"
-. "${BUILD_LIBRARY_DIR}/build_image_util.sh"
-
-# Handle existing directory.
-if [[ -e "${BUILD_DIR}" ]]; then
-  if [[ ${FLAGS_replace} -eq ${FLAGS_TRUE} ]]; then
-    sudo rm -rf "${BUILD_DIR}"
-  else
-    error "Directory ${BUILD_DIR} already exists."
-    error "Use --build_attempt option to specify an unused attempt."
-    error "Or use --replace if you want to overwrite this directory."
-    die "Unwilling to overwrite ${BUILD_DIR}."
-  fi
-fi
-
-# Create the output directory and temporary mount points.
-DST_IMAGE="${BUILD_DIR}/${COREOS_PRODUCTION_IMAGE_NAME}"
-ROOT_FS_DIR="${BUILD_DIR}/rootfs"
-mkdir -p "${ROOT_FS_DIR}"
-
-info "Copying from ${FLAGS_from}"
-cp "${SRC_IMAGE}" "${DST_IMAGE}"
-
-# Copy all extra useful things, these do not need to be modified.
-UPDATE_PREFIX="${COREOS_PRODUCTION_IMAGE_NAME%_image.bin}_update"
-PRODUCTION_PREFIX="${COREOS_PRODUCTION_IMAGE_NAME%.bin}"
-CONTAINER_PREFIX="${COREOS_DEVELOPER_CONTAINER_NAME%.bin}"
-PCR_DATA="${COREOS_PRODUCTION_IMAGE_NAME%.bin}_pcr_policy.zip"
-EXTRA_FILES=(
-    "version.txt"
-    "${UPDATE_PREFIX}.bin"
-    "${UPDATE_PREFIX}.zip"
-    "${PCR_DATA}"
-    "${PRODUCTION_PREFIX}_contents.txt"
-    "${PRODUCTION_PREFIX}_packages.txt"
-    "${COREOS_DEVELOPER_CONTAINER_NAME}"
-    "${CONTAINER_PREFIX}_contents.txt"
-    "${CONTAINER_PREFIX}_packages.txt"
-    )
-for filename in "${EXTRA_FILES[@]}"; do
-    if [[ -e "${FLAGS_from}/${filename}" ]]; then
-        cp "${FLAGS_from}/${filename}" "${BUILD_DIR}/${filename}"
-    fi
-done
-
-"${BUILD_LIBRARY_DIR}/disk_util" --disk_layout="${FLAGS_disk_layout}" \
-      mount "${DST_IMAGE}" "${ROOT_FS_DIR}"
-trap "cleanup_mounts '${ROOT_FS_DIR}'" EXIT
+start_modify_image
 
 info "Replacing /etc/coreos/update.conf"
 sudo mkdir -p "${ROOT_FS_DIR}/etc/coreos"
@@ -128,24 +62,5 @@ sudo_clobber "${ROOT_FS_DIR}/etc/coreos/update.conf" <<EOF
 GROUP=${FLAGS_group}
 EOF
 
-cleanup_mounts "${ROOT_FS_DIR}"
-trap - EXIT
-
-upload_image "${DST_IMAGE}"
-for filename in "${EXTRA_FILES[@]}"; do
-    if [[ -e "${BUILD_DIR}/${filename}" ]]; then
-        upload_image "${BUILD_DIR}/${filename}"
-    fi
-done
-
-set_build_symlinks "${FLAGS_group}-latest"
-
-info "Done. Updated image is in ${BUILD_DIR}"
-cat << EOF
-To convert it to a virtual machine image, use:
-  ./image_to_vm.sh --from=${OUTSIDE_OUTPUT_DIR} --board=${BOARD} --prod_image
-
-The default type is qemu, see ./image_to_vm.sh --help for other options.
-EOF
-
+finish_modify_image
 command_completed