diff --git a/core/cmd/mkimage/main.go b/core/cmd/mkimage/main.go
index f733e78..0803c80 100644
--- a/core/cmd/mkimage/main.go
+++ b/core/cmd/mkimage/main.go
@@ -31,9 +31,10 @@
 var SmalltownDataPartition gpt.Type = gpt.Type("9eeec464-6885-414a-b278-4305c51f7966")
 
 var (
-	efiPayloadPath = flag.String("efi", "", "UEFI payload")
-	outputPath     = flag.String("out", "", "Output disk image")
-	initramfsPath  = flag.String("initramfs", "", "External initramfs [optional]")
+	efiPayloadPath           = flag.String("efi", "", "UEFI payload")
+	outputPath               = flag.String("out", "", "Output disk image")
+	initramfsPath            = flag.String("initramfs", "", "External initramfs [optional]")
+	enrolmentCredentialsPath = flag.String("enrolment-credentials", "", "Enrolment credentials [optional]")
 )
 
 func mibToSectors(size uint64) uint64 {
@@ -135,6 +136,23 @@
 			os.Exit(1)
 		}
 	}
+	if *enrolmentCredentialsPath != "" {
+		enrolmentCredentials, err := fs.OpenFile("/EFI/smalltown/enrolment.pb", os.O_CREATE|os.O_RDWR)
+		enrolmentCredentialsSrc, err := os.Open(*enrolmentCredentialsPath)
+		if err != nil {
+			fmt.Printf("Failed to open enrolment credentials for reading: %v", err)
+			os.Exit(1)
+		}
+		enrolmentCredentialsFull, err := ioutil.ReadAll(enrolmentCredentialsSrc)
+		if err != nil {
+			fmt.Printf("Failed to read enrolment credentials: %v", err)
+			os.Exit(1)
+		}
+		if _, err := enrolmentCredentials.Write(enrolmentCredentialsFull); err != nil {
+			fmt.Printf("Failed to write enrolment credentials")
+			os.Exit(1)
+		}
+	}
 	if err := diskImg.File.Close(); err != nil {
 		fmt.Printf("Failed to write image: %v", err)
 		os.Exit(1)