diff --git a/metropolis/node/BUILD.bazel b/metropolis/node/BUILD.bazel
index 6ae234a..c09ca2d 100644
--- a/metropolis/node/BUILD.bazel
+++ b/metropolis/node/BUILD.bazel
@@ -33,6 +33,10 @@
     },
 )
 
+exports_files([
+    "passwd",
+])
+
 erofs_image(
     name = "rootfs",
     files = {
@@ -42,6 +46,7 @@
         # These should not be explicitly used by Metropolis code and are only here for compatibility with
         # paths hardcoded by standard libraries (like Go's).
         "@cacerts//file": "/etc/ssl/cert.pem",
+        "//metropolis/node:passwd": "/etc/passwd",
         "//osbase/net/dns:resolv.conf": "/etc/resolv.conf",
         "//osbase/net/dns:hosts": "/etc/hosts",
         ":os-release-info": "/etc/os-release",