diff --git a/third_party/qboot/BUILD.bazel b/third_party/qboot/BUILD.bazel
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/third_party/qboot/BUILD.bazel
diff --git a/third_party/qboot/README.md b/third_party/qboot/README.md
new file mode 100644
index 0000000..9fde6a6
--- /dev/null
+++ b/third_party/qboot/README.md
@@ -0,0 +1,9 @@
+# qboot firmware
+This is a firmware used for initializing QEMU MicroVM-based virtual machines. It initializes the virtual CPU, and
+relocates the Kernel and initramfs to the correct locations and jumps into it. It is the analogue to EDK II on the
+normal systems, but orders of magnitude faster and lighter.
+
+This firmware is usually shipped as a precompiled binary by QEMU, but the version they currently ship has a critical
+bug (https://github.com/bonzini/qboot/pull/28) preventing our VMs from starting which has been fixed upstream,
+but QEMU needs to rebuild their firwmare and Fedora needs to ship an updated QEMU. Since it is not a lot of code, this
+just builds qboot in Bazel, getting us that critical fix immediately.
diff --git a/third_party/qboot/qboot.bzl b/third_party/qboot/qboot.bzl
new file mode 100644
index 0000000..bd86d98
--- /dev/null
+++ b/third_party/qboot/qboot.bzl
@@ -0,0 +1,70 @@
+#  Copyright 2020 The Monogon Project Authors.
+#
+#  SPDX-License-Identifier: Apache-2.0
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+cc_binary(
+    name = "qboot-elf",
+    srcs = [
+        "code16.c",
+        "code32seg.c",
+        "cstart.S",
+        "entry.S",
+        "fw_cfg.c",
+        "hwsetup.c",
+        "linuxboot.c",
+        "main.c",
+        "malloc.c",
+        "mptable.c",
+        "pci.c",
+        "printf.c",
+        "string.c",
+        "smbios.c",
+        "tables.c",
+        "benchmark.h",
+    ] + glob(["include/*.h"]),
+    copts = [
+        "-m32",
+        "-march=i386",
+        "-mregparm=3",
+        "-fno-stack-protector",
+        "-fno-delete-null-pointer-checks",
+        "-ffreestanding",
+        "-mstringop-strategy=rep_byte",
+        "-minline-all-stringops",
+        "-fno-pic",
+    ],
+    includes = [
+        "include",
+    ],
+    additional_linker_inputs = [
+        "flat.lds",
+    ],
+    linkopts = [
+        "-nostdlib",
+        "-m32",
+        "-Wl,--build-id=none",
+        "-Wl,-T$(location flat.lds)",
+        "-no-pie",
+    ],
+)
+
+# TODO(q3k): move to starlark rule for hermeticity, use toolchain objcopy
+genrule(
+    name = "qboot-bin",
+    srcs = [":qboot-elf"],
+    outs = ["bios.bin"],
+    cmd = "objcopy -O binary $< $@",
+    visibility = ["//visibility:public"],
+)