diff --git a/bin/cros_make_image_bootable b/bin/cros_make_image_bootable
index a3ff3b2c75..cc4c469561 100755
--- a/bin/cros_make_image_bootable
+++ b/bin/cros_make_image_bootable
@@ -125,8 +125,7 @@ make_image_bootable() {
 
   cros_root=/dev/sd%D%P
   if [[ "${FLAGS_arch}" = "arm" ]]; then
-    # TODO(wad) assumed like in build_gpt for now.
-    cros_root=/dev/mmcblk1p3
+    cros_root='/dev/${devname}${rootpart}'
   fi
   if [[ ${FLAGS_enable_rootfs_verification} -eq ${FLAGS_TRUE} ]]; then
     cros_root=/dev/dm-0
diff --git a/build_image b/build_image
index 5bf830f6be..7620d0af7f 100755
--- a/build_image
+++ b/build_image
@@ -241,13 +241,6 @@ esac
 
 if [[ ${FLAGS_enable_rootfs_verification} -eq ${FLAGS_TRUE} ]]; then
   enable_rootfs_verification_flag="--enable_rootfs_verification"
-  # Comment out this section if you need to start testing vboot on arm.
-  if [[ "${ARCH}" = "arm" ]]; then
-    warn "ARM does not yet support --enable_rootfs_verification"
-    warn "Root filesystem verification has been disabled."
-    enable_rootfs_verification_flag=
-    FLAGS_enable_rootfs_verification_flag=${FLAGS_FALSE}
-  fi
 fi
 
 # Hack to fix bug where x86_64 CHOST line gets incorrectly added.
diff --git a/build_kernel_image.sh b/build_kernel_image.sh
index bb0253af08..b4e393e9b5 100755
--- a/build_kernel_image.sh
+++ b/build_kernel_image.sh
@@ -88,8 +88,13 @@ if [[ -n "${FLAGS_rootfs_image}" && -n "${FLAGS_rootfs_hash}" ]]; then
   # the verified boot device.  Doing so will claim /dev/sdDP out from
   # under the system.
   if [[ ${FLAGS_root} = "/dev/dm-0" ]]; then
-    table=${table//HASH_DEV//dev/sd%D%P}
-    table=${table//ROOT_DEV//dev/sd%D%P}
+    if [[ "${FLAGS_arch}" = "x86" ]]; then
+      base_root='/dev/sd%D%P'
+    elif [[ "${FLAGS_arch}" = "arm" ]]; then
+      base_root='/dev/${devname}${rootpart}'
+    fi
+    table=${table//HASH_DEV/${base_root}}
+    table=${table//ROOT_DEV/${base_root}}
   fi
   verity_args="dm=\"vroot none ro,${table}\""
   info "dm-verity configuration: ${verity_args}"
@@ -188,8 +193,39 @@ EOF
   trap - EXIT
 
 elif [[ "${FLAGS_arch}" = "arm" ]]; then
-  # FIXME: For now, ARM just uses the unsigned kernel by itself.
-  cp -f "${FLAGS_vmlinuz}" "${FLAGS_to}"
+  # FIXME: This stuff is unsigned, and will likely change with vboot_reference
+  # but it doesn't technically have to.
+
+  kernel_script="${FLAGS_working_dir}/kernel.scr"
+  kernel_script_img="${FLAGS_working_dir}/kernel.scr.uimg"
+  # HACK: !! Kernel image construction requires some stuff from portage, not
+  # sure how to get that information here cleanly !!
+  kernel_image="${FLAGS_vmlinuz/vmlinuz/vmlinux.uimg}"
+  WORK="${WORK} ${kernel_script} ${kernel_script_img}"
+
+  kernel_size=$((($(stat -c %s "${kernel_image}") + 511) / 512))
+  script_size=16
+
+  # Build boot script image
+  echo -n 'setenv bootargs ${bootargs} ' > "${kernel_script}"
+  tr '\n' ' ' <"${FLAGS_working_dir}/boot.config" >> "${kernel_script}"
+  echo >> "${kernel_script}"
+  printf 'read ${devtype} 0:${kernelpart} ${loadaddr} %x %x\n' \
+    ${script_size} ${kernel_size} >> "${kernel_script}"
+  echo 'bootm ${loadaddr}' >> ${kernel_script}
+  mkimage -A arm -O linux -T script -C none -a 0 -e 0 \
+    -n kernel_script -d "${kernel_script}" "${kernel_script_img}"
+
+  if [ $(stat -c %s "${kernel_script_img}") -gt $((512 * ${script_size})) ]
+  then
+    echo 'Kernel script too large for reserved space.'
+    exit 1
+  fi
+
+  # Assemble image
+  rm -f "${FLAGS_to}"
+  dd if="${kernel_script_img}" of="${FLAGS_to}" bs=512 count="${script_size}"
+  dd if="${kernel_image}" of="${FLAGS_to}" bs=512 seek="${script_size}"
 else
   error "Unknown arch: ${FLAGS_arch}"
 fi
diff --git a/update_bootloaders.sh b/update_bootloaders.sh
index 695d7ab701..7c6b0dd9be 100755
--- a/update_bootloaders.sh
+++ b/update_bootloaders.sh
@@ -183,29 +183,6 @@ if [[ "${FLAGS_arch}" = "x86" ]]; then
     sudo syslinux -d /syslinux "${ESP_DEV}"
   fi
 elif [[ "${FLAGS_arch}" = "arm" ]]; then
-  # Extract kernel flags
-  kernel_cfg=
-  old_root="sd%D%P"
-  if [[ -n "${FLAGS_kernel_cmdline}" ]]; then
-    info "Using supplied kernel_cmdline to update templates."
-    kernel_cfg="${FLAGS_kernel_cmdline}"
-  elif [[ -n "${FLAGS_kernel_partition}" ]]; then
-    info "Extracting the kernel command line from ${FLAGS_kernel_partition}"
-    kernel_cfg=$(dump_kernel_config "${kernel_partition}")
-  fi
-  dm_table=
-  if echo "$kernel_cfg" | grep -q 'dm="'; then
-    dm_table=$(echo "$kernel_cfg" | sed -s 's/.*dm="\([^"]*\)".*/\1/')
-  fi
-  # TODO(wad) assume usb_disk contains the arm boot location for now.
-  new_root="${FLAGS_usb_disk}"
-  info "Replacing dm slave devices with /dev/${new_root}"
-  dm_table="${dm_table//ROOT_DEV/\/dev\/${new_root}}"
-  dm_table="${dm_table//HASH_DEV/\/dev\/${new_root}}"
-
-  warn "FIXME: cannot replace root= here for the arm bootloader yet."
-  dm_table=""  # TODO(wad) Clear it until we can fix root=/dev/dm-0
-
   # Copy u-boot script to ESP partition
   if [ -r "${FLAGS_from}/boot-A.scr.uimg" ]; then
     sudo mkdir -p "${ESP_FS_DIR}/u-boot"