diff --git a/metropolis/node/BUILD.bazel b/metropolis/node/BUILD.bazel
index f37ed9a..722f05b 100644
--- a/metropolis/node/BUILD.bazel
+++ b/metropolis/node/BUILD.bazel
@@ -1,5 +1,5 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
-load("//metropolis/node/build:def.bzl", "erofs_image")
+load("//metropolis/node/build:def.bzl", "erofs_image", "verity_image")
 load("//metropolis/node/build:efi.bzl", "efi_unified_kernel_image")
 load("@rules_pkg//:pkg.bzl", "pkg_zip")
 
@@ -92,11 +92,17 @@
     },
 )
 
+verity_image(
+    name = "verity_rootfs",
+    source = ":rootfs",
+)
+
 efi_unified_kernel_image(
     name = "kernel_efi",
-    cmdline = "console=ttyS0,115200 console=tty0 quiet root=PARTLABEL=METROPOLIS-SYSTEM rootfstype=erofs init=/init",
+    cmdline = "console=ttyS0,115200 console=tty0 quiet rootfstype=erofs init=/init",
     kernel = "//third_party/linux",
     os_release = ":os-release-info",
+    verity = ":verity_rootfs",
 )
 
 # An intermediary "bundle" format until we finalize the actual bundle format. This is NOT stable until migrated
@@ -106,7 +112,7 @@
     name = "node",
     srcs = [
         ":kernel_efi",
-        ":rootfs",
+        ":verity_rootfs",
     ],
     visibility = ["//visibility:public"],
 )
@@ -115,7 +121,7 @@
     name = "image",
     srcs = [
         ":kernel_efi",
-        ":rootfs",
+        ":verity_rootfs",
     ],
     outs = [
         "node.img",
@@ -123,7 +129,7 @@
     cmd = """
     $(location //metropolis/node/build/mkimage) \
         -efi $(location :kernel_efi) \
-        -system $(location :rootfs) \
+        -system $(location :verity_rootfs) \
         -out $@
     """,
     tools = [
diff --git a/metropolis/node/build/efi.bzl b/metropolis/node/build/efi.bzl
index 21b1ef9..12d32db 100644
--- a/metropolis/node/build/efi.bzl
+++ b/metropolis/node/build/efi.bzl
@@ -4,50 +4,56 @@
 """
 
 load("//build/toolchain/llvm-efi:transition.bzl", "build_efi_transition")
+load("//metropolis/node/build:def.bzl", "VerityConfig")
 
 def _efi_unified_kernel_image_impl(ctx):
-    out = ctx.actions.declare_file(ctx.attr.name + ".efi")
-
-    toolchain_info = ctx.attr._toolchain[platform_common.ToolchainInfo]
-
-    sections = [
-        dict(name = ".linux", file = ctx.file.kernel, vma = 0x2000000),
-    ]
-
-    if ctx.attr.cmdline != "":
-        cmdline_file = ctx.actions.declare_file("cmdline")
+    # Find the dependency paths to be passed to mkpayload.
+    deps = {
+      "linux": ctx.file.kernel,
+      "initrd": ctx.file.initramfs,
+      "osrel": ctx.file.os_release,
+      "splash": ctx.file.splash,
+      "stub": ctx.file.stub,
+    }
+    # Since cmdline is a string attribute, put it into a file, then append
+    # that file to deps.
+    if ctx.attr.cmdline and ctx.attr.cmdline != "":
+        cmdline = ctx.actions.declare_file("cmdline")
         ctx.actions.write(
-            output = cmdline_file,
+            output = cmdline,
             content = ctx.attr.cmdline,
         )
-        sections.append(dict(name = ".cmdline", file = cmdline_file, vma = 0x30000))
-
-    if ctx.file.initramfs:
-        sections += [dict(name = ".initrd", file = ctx.file.initramfs, vma = 0x5000000)]
-    if ctx.file.os_release:
-        sections += [dict(name = ".osrel", file = ctx.file.os_release, vma = 0x20000)]
-    if ctx.file.splash:
-        sections += [dict(name = ".splash", file = ctx.file.splash, vma = 0x40000)]
-
+        deps["cmdline"] = cmdline
+    # Get the dm-verity target table from VerityConfig provider.
+    if ctx.attr.verity:
+      deps["rootfs_dm_table"] = ctx.attr.verity[VerityConfig].table
+    # Format deps into command line arguments while keeping track of mkpayload
+    # runtime inputs.
     args = []
-    for sec in sections:
-        args.append("--add-section")
-        args.append("{}={}".format(sec["name"], sec["file"].path))
-        args.append("--change-section-vma")
-        args.append("{}={}".format(sec["name"], sec["vma"]))
-
+    inputs = []
+    for name, file in deps.items():
+      if file:
+        args.append("-{}={}".format(name, file.path))
+        inputs.append(file)
+    # Append the output parameter separately, as it doesn't belong with the
+    # runtime inputs.
+    image = ctx.actions.declare_file(ctx.attr.name + ".efi")
+    args.append("-output={}".format(image.path))
+    # Append the objcopy parameter separately, as it's not of File type, and
+    # it does not constitute an input, since it's part of the toolchain.
+    objcopy = ctx.attr._toolchain[platform_common.ToolchainInfo].objcopy_executable
+    args.append("-objcopy={}".format(objcopy))
+    # Run mkpayload.
     ctx.actions.run(
-        mnemonic = "GenEFIKernelImage",
-        progress_message = "Generating EFI unified kernel image",
-        inputs = [ctx.file.stub] + [s["file"] for s in sections],
-        outputs = [out],
-        executable = toolchain_info.objcopy_executable,
-        arguments = args + [
-            ctx.file.stub.path,
-            out.path,
-        ],
+      mnemonic = "GenEFIKernelImage",
+      progress_message = "Generating EFI unified kernel image",
+      inputs = inputs,
+      outputs = [image],
+      executable = ctx.file._mkpayload,
+      arguments = args
     )
-    return [DefaultInfo(files = depset([out]), runfiles = ctx.runfiles(files = [out]))]
+    # Return the unified kernel image file.
+    return [DefaultInfo(files = depset([image]), runfiles = ctx.runfiles(files = [image]))]
 
 efi_unified_kernel_image = rule(
     implementation = _efi_unified_kernel_image_impl,
@@ -82,6 +88,18 @@
             executable = True,
             cfg = build_efi_transition,
         ),
+        "verity": attr.label(
+            doc = "The DeviceMapper Verity rootfs target table.",
+            allow_single_file = True,
+            providers = [DefaultInfo, VerityConfig],
+        ),
+        "_mkpayload": attr.label(
+            doc = "The mkpayload executable.",
+            default = "//metropolis/node/build/mkpayload",
+            allow_single_file = True,
+            executable = True,
+            cfg = "exec",
+        ),
         "_toolchain": attr.label(
             doc = "The toolchain used for objcopy.",
             default = "//build/toolchain/llvm-efi:efi_cc_suite",