diff --git a/build_library/generate_au_zip.py b/build_library/generate_au_zip.py
index d943d73f05..d6ffe9763f 100755
--- a/build_library/generate_au_zip.py
+++ b/build_library/generate_au_zip.py
@@ -22,6 +22,7 @@ STATIC_FILES = ['/usr/bin/old_bins/cgpt',
                 '~/trunk/.repo/manifests/version.txt',
                 '~/trunk/src/scripts/chromeos-common.sh',
                 '~/trunk/src/scripts/common.sh',
+                '~/trunk/src/scripts/core_upload_update',
                 ]
 
 DYNAMIC_EXECUTABLES = ['/usr/bin/delta_generator',
diff --git a/core_upload_update b/core_upload_update
index 199a2769ed..e1424702cf 100755
--- a/core_upload_update
+++ b/core_upload_update
@@ -5,6 +5,9 @@
 # found in the LICENSE file.
 
 SCRIPT_ROOT=$(dirname $(readlink -f "$0"))
+# We have to simple-mindedly set GCLIENT_ROOT in case we're running from
+# au-generator.zip because common.sh will fail while auto-detect it.
+export GCLIENT_ROOT=$(readlink -f "${SCRIPT_ROOT}/../../")
 . "${SCRIPT_ROOT}/common.sh" || exit 1
 
 DEFINE_string image "${SRC_ROOT}/build/images/amd64-generic/latest/${COREOS_BASE_IMAGE_NAME}" \
@@ -42,24 +45,24 @@ switch_to_strict_mode
 [[ -z "${FLAGS_private_key}" ]] && die "--private_key is required"
 [[ -z "${FLAGS_public_key}" ]] && die "--public_key is required"
 
-# Put our public key in a place that update_engine can find it
-${SRC_ROOT}/platform/vboot_reference/scripts/image_signing/insert_au_publickey.sh ${FLAGS_image} ${FLAGS_public_key}
+OUTPUT_DIR=$(mktemp -d)
+trap "rm -rf ${OUTPUT_DIR}" INT TERM EXIT
 
 # Generate a payload and sign it with our private key
-cros_generate_update_payload --image ${FLAGS_image} --output /tmp/update.gz \
-	--private_key ${FLAGS_private_key}
-
-# Verify that the payload signature is OK
-delta_generator -in_file /tmp/update.gz -public_key ${FLAGS_public_key}
-
-# Generate the metadata payload
-delta_generator -out_metadata /tmp/update.metadata -private_key ${FLAGS_private_key} \
-	-in_file /tmp/update.gz
+cros_generate_update_payload \
+    --image "${FLAGS_image}" \
+    --output "${OUTPUT_DIR}/update.gz" \
+    --metadata_output "${OUTPUT_DIR}/update.metadata" \
+    --private_key "${FLAGS_private_key}" \
+    --public_key "${FLAGS_public_key}" \
+    --outside_chroot
 
 MD5SUM=$(md5sum ${FLAGS_image} | cut -f1 -d" ")
-gsutil cp /tmp/update.gz gs://update-storage.core-os.net/${FLAGS_track}/$MD5SUM/update.gz
+gsutil cp "${OUTPUT_DIR}/update.gz" \
+    gs://update-storage.core-os.net/${FLAGS_track}/$MD5SUM/update.gz
 CORE_UPDATE_URL="https://core-api.appspot.com" core-admin new-version \
-	-k ${FLAGS_api_key} -v ${FLAGS_version} \
-	-a ${FLAGS_app_id} \
-	-m /tmp/update.metadata \
-	-t ${FLAGS_track} -p $MD5SUM /tmp/update.gz
+    -k ${FLAGS_api_key} \
+    -a ${FLAGS_app_id} \
+    -v ${FLAGS_version} \
+    -m "${OUTPUT_DIR}/update.metadata" \
+    -t ${FLAGS_track} -p $MD5SUM "${OUTPUT_DIR}/update.gz"