diff --git a/WORKSPACE b/WORKSPACE
index b002958..6495590 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -187,3 +187,12 @@
     strip_prefix = "lz4-1.9.2",
     urls = ["https://github.com/lz4/lz4/archive/v1.9.2.tar.gz"],
 )
+
+# qboot bootloader for MicroVMs
+http_archive(
+    name = "com_github_bonzini_qboot",
+    build_file = "//third_party/qboot:qboot.bzl",
+    sha256 = "a643b2486fbee57b969659d408984094ca9afa1a048317dd3f5d3022e47213e8",
+    strip_prefix = "qboot-a5300c4949b8d4de2d34bedfaed66793f48ec948",
+    urls = ["https://github.com/bonzini/qboot/archive/a5300c4949b8d4de2d34bedfaed66793f48ec948.tar.gz"],
+)
diff --git a/third_party/qboot/BUILD.bazel b/third_party/qboot/BUILD.bazel
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/third_party/qboot/BUILD.bazel
diff --git a/third_party/qboot/README.md b/third_party/qboot/README.md
new file mode 100644
index 0000000..9fde6a6
--- /dev/null
+++ b/third_party/qboot/README.md
@@ -0,0 +1,9 @@
+# qboot firmware
+This is a firmware used for initializing QEMU MicroVM-based virtual machines. It initializes the virtual CPU, and
+relocates the Kernel and initramfs to the correct locations and jumps into it. It is the analogue to EDK II on the
+normal systems, but orders of magnitude faster and lighter.
+
+This firmware is usually shipped as a precompiled binary by QEMU, but the version they currently ship has a critical
+bug (https://github.com/bonzini/qboot/pull/28) preventing our VMs from starting which has been fixed upstream,
+but QEMU needs to rebuild their firwmare and Fedora needs to ship an updated QEMU. Since it is not a lot of code, this
+just builds qboot in Bazel, getting us that critical fix immediately.
diff --git a/third_party/qboot/qboot.bzl b/third_party/qboot/qboot.bzl
new file mode 100644
index 0000000..bd86d98
--- /dev/null
+++ b/third_party/qboot/qboot.bzl
@@ -0,0 +1,70 @@
+#  Copyright 2020 The Monogon Project Authors.
+#
+#  SPDX-License-Identifier: Apache-2.0
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+cc_binary(
+    name = "qboot-elf",
+    srcs = [
+        "code16.c",
+        "code32seg.c",
+        "cstart.S",
+        "entry.S",
+        "fw_cfg.c",
+        "hwsetup.c",
+        "linuxboot.c",
+        "main.c",
+        "malloc.c",
+        "mptable.c",
+        "pci.c",
+        "printf.c",
+        "string.c",
+        "smbios.c",
+        "tables.c",
+        "benchmark.h",
+    ] + glob(["include/*.h"]),
+    copts = [
+        "-m32",
+        "-march=i386",
+        "-mregparm=3",
+        "-fno-stack-protector",
+        "-fno-delete-null-pointer-checks",
+        "-ffreestanding",
+        "-mstringop-strategy=rep_byte",
+        "-minline-all-stringops",
+        "-fno-pic",
+    ],
+    includes = [
+        "include",
+    ],
+    additional_linker_inputs = [
+        "flat.lds",
+    ],
+    linkopts = [
+        "-nostdlib",
+        "-m32",
+        "-Wl,--build-id=none",
+        "-Wl,-T$(location flat.lds)",
+        "-no-pie",
+    ],
+)
+
+# TODO(q3k): move to starlark rule for hermeticity, use toolchain objcopy
+genrule(
+    name = "qboot-bin",
+    srcs = [":qboot-elf"],
+    outs = ["bios.bin"],
+    cmd = "objcopy -O binary $< $@",
+    visibility = ["//visibility:public"],
+)