diff --git a/metropolis/pkg/tpm/proto/BUILD.bazel b/metropolis/pkg/tpm/proto/BUILD.bazel
new file mode 100644
index 0000000..7d7ee86
--- /dev/null
+++ b/metropolis/pkg/tpm/proto/BUILD.bazel
@@ -0,0 +1,25 @@
+load("@rules_proto//proto:defs.bzl", "proto_library")
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+
+proto_library(
+    name = "proto_proto",
+    srcs = ["tpm.proto"],
+    visibility = ["//visibility:public"],
+    deps = ["@com_github_google_go_tpm_tools//proto:proto_proto"],  #keep
+)
+
+go_proto_library(
+    name = "proto_go_proto",
+    importpath = "source.monogon.dev/metropolis/pkg/tpm/proto",
+    proto = ":proto_proto",
+    visibility = ["//visibility:public"],
+    deps = ["@com_github_google_go_tpm_tools//proto:go_default_library"],  #keep
+)
+
+go_library(
+    name = "go_default_library",
+    embed = [":proto_go_proto"],
+    importpath = "source.monogon.dev/metropolis/pkg/tpm/proto",
+    visibility = ["//visibility:public"],
+)
diff --git a/metropolis/pkg/tpm/proto/tpm.proto b/metropolis/pkg/tpm/proto/tpm.proto
new file mode 100644
index 0000000..29b74aa
--- /dev/null
+++ b/metropolis/pkg/tpm/proto/tpm.proto
@@ -0,0 +1,16 @@
+syntax = "proto3";
+option go_package = "source.monogon.dev/metropolis/pkg/tpm/proto";
+package metropolis.pkg.tpm;
+
+import "proto/tpm.proto";
+
+// ExtendedSealedBytes contains data sealed by a TPM2 via an indirection to
+// allow for more than 128 bytes of payload. It seals an ephemeral key for
+// a nacl secretbox in the TPM and stores the encrypted box next to the sealed
+// key.
+message ExtendedSealedBytes {
+  // The secretbox key, as sealed by the TPM.
+  .proto.SealedBytes sealed_key = 1;
+  // The encrypted box contents.
+  bytes encrypted_payload = 2;
+}
\ No newline at end of file