diff --git a/osbase/build/mkucode/BUILD.bazel b/osbase/build/mkucode/BUILD.bazel
new file mode 100644
index 0000000..9f56e10
--- /dev/null
+++ b/osbase/build/mkucode/BUILD.bazel
@@ -0,0 +1,19 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+
+go_library(
+    name = "mkucode_lib",
+    srcs = ["main.go"],
+    importpath = "source.monogon.dev/osbase/build/mkucode",
+    visibility = ["//visibility:private"],
+    deps = [
+        "//osbase/build/mkucode/spec",
+        "@com_github_cavaliergopher_cpio//:cpio",
+        "@org_golang_google_protobuf//encoding/prototext",
+    ],
+)
+
+go_binary(
+    name = "mkucode",
+    embed = [":mkucode_lib"],
+    visibility = ["//visibility:public"],
+)
diff --git a/osbase/build/mkucode/def.bzl b/osbase/build/mkucode/def.bzl
new file mode 100644
index 0000000..04d83a2
--- /dev/null
+++ b/osbase/build/mkucode/def.bzl
@@ -0,0 +1,45 @@
+def _cpio_ucode_impl(ctx):
+    ucode_spec = ctx.actions.declare_file(ctx.label.name + "_spec.prototxt")
+
+    vendors = []
+    inputs = []
+    for label, vendor in ctx.attr.ucode.items():
+        files = label[DefaultInfo].files.to_list()
+        inputs += files
+        vendors.append(struct(id = vendor, file = [f.path for f in files]))
+
+    ctx.actions.write(ucode_spec, proto.encode_text(struct(vendor = vendors)))
+
+    output_file = ctx.actions.declare_file(ctx.label.name + ".cpio")
+    ctx.actions.run(
+        outputs = [output_file],
+        inputs = [ucode_spec] + inputs,
+        tools = [ctx.executable._mkucode],
+        executable = ctx.executable._mkucode,
+        arguments = ["-out", output_file.path, "-spec", ucode_spec.path],
+    )
+    return [DefaultInfo(files = depset([output_file]))]
+
+cpio_ucode = rule(
+    implementation = _cpio_ucode_impl,
+    doc = """
+        Builds a cpio archive with microcode for the Linux early microcode loader.
+    """,
+    attrs = {
+        "ucode": attr.label_keyed_string_dict(
+            mandatory = True,
+            allow_files = True,
+            doc = """
+                Dictionary of Labels to String. Each label is a list of microcode files and the string label
+                is the vendor ID corresponding to that microcode.
+            """,
+        ),
+
+        # Tool
+        "_mkucode": attr.label(
+            default = Label("//osbase/build/mkucode"),
+            executable = True,
+            cfg = "exec",
+        ),
+    },
+)
diff --git a/osbase/build/mkucode/main.go b/osbase/build/mkucode/main.go
new file mode 100644
index 0000000..58561e3
--- /dev/null
+++ b/osbase/build/mkucode/main.go
@@ -0,0 +1,71 @@
+// This assembles standalone microcode files into the format expected by the
+// Linux microcode loader. See
+// https://www.kernel.org/doc/html/latest/x86/microcode.html for further
+// information.
+package main
+
+import (
+	"flag"
+	"io"
+	"log"
+	"os"
+
+	"github.com/cavaliergopher/cpio"
+	"google.golang.org/protobuf/encoding/prototext"
+
+	"source.monogon.dev/osbase/build/mkucode/spec"
+)
+
+var (
+	specPath = flag.String("spec", "", "Path to prototext specification (osbase.build.mkucode.UCode)")
+	outPath  = flag.String("out", "", "Output path for cpio to be prepend to initrd")
+)
+
+// Usage: -spec <ucode.prototxt> -out <ucode.cpio>
+func main() {
+	flag.Parse()
+	specRaw, err := os.ReadFile(*specPath)
+	if err != nil {
+		log.Fatalf("Failed to read spec: %v", err)
+	}
+	var ucodeSpec spec.UCode
+	if err := prototext.Unmarshal(specRaw, &ucodeSpec); err != nil {
+		log.Fatalf("Failed unmarshaling ucode spec: %v", err)
+	}
+	out, err := os.Create(*outPath)
+	if err != nil {
+		log.Fatalf("Failed to create cpio: %v", err)
+	}
+	defer out.Close()
+	cpioWriter := cpio.NewWriter(out)
+	for _, vendor := range ucodeSpec.Vendor {
+		var totalSize int64
+		for _, file := range vendor.File {
+			data, err := os.Stat(file)
+			if err != nil {
+				log.Fatalf("Failed to stat file for vendor %q: %v", vendor.Id, err)
+			}
+			totalSize += data.Size()
+		}
+		if err := cpioWriter.WriteHeader(&cpio.Header{
+			Mode: 0444,
+			Name: "kernel/x86/microcode/" + vendor.Id + ".bin",
+			Size: totalSize,
+		}); err != nil {
+			log.Fatalf("Failed to write cpio header for vendor %q: %v", vendor.Id, err)
+		}
+		for _, file := range vendor.File {
+			f, err := os.Open(file)
+			if err != nil {
+				log.Fatalf("Failed to open file for vendor %q: %v", vendor.Id, err)
+			}
+			if _, err := io.Copy(cpioWriter, f); err != nil {
+				log.Fatalf("Failed to copy data for file %q: %v", file, err)
+			}
+			f.Close()
+		}
+	}
+	if err := cpioWriter.Close(); err != nil {
+		log.Fatalf("Failed writing cpio: %v", err)
+	}
+}
diff --git a/osbase/build/mkucode/spec/BUILD.bazel b/osbase/build/mkucode/spec/BUILD.bazel
new file mode 100644
index 0000000..0210a4b
--- /dev/null
+++ b/osbase/build/mkucode/spec/BUILD.bazel
@@ -0,0 +1,30 @@
+load("@rules_proto//proto:defs.bzl", "proto_library")
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+
+proto_library(
+    name = "mkucode_proto",
+    srcs = ["spec.proto"],
+    visibility = ["//visibility:public"],
+)
+
+go_proto_library(
+    name = "mkucode_go_proto",
+    importpath = "source.monogon.dev/osbase/build/mkucode",
+    proto = ":mkucode_proto",
+    visibility = ["//visibility:public"],
+)
+
+go_library(
+    name = "spec",
+    embed = [":spec_go_proto"],
+    importpath = "source.monogon.dev/osbase/build/mkucode/spec",
+    visibility = ["//visibility:public"],
+)
+
+go_proto_library(
+    name = "spec_go_proto",
+    importpath = "source.monogon.dev/osbase/build/mkucode/spec",
+    proto = ":mkucode_proto",
+    visibility = ["//visibility:public"],
+)
diff --git a/osbase/build/mkucode/spec/gomod-generated-placeholder.go b/osbase/build/mkucode/spec/gomod-generated-placeholder.go
new file mode 100644
index 0000000..f09cd57
--- /dev/null
+++ b/osbase/build/mkucode/spec/gomod-generated-placeholder.go
@@ -0,0 +1 @@
+package spec
diff --git a/osbase/build/mkucode/spec/spec.proto b/osbase/build/mkucode/spec/spec.proto
new file mode 100644
index 0000000..36fcc4c
--- /dev/null
+++ b/osbase/build/mkucode/spec/spec.proto
@@ -0,0 +1,17 @@
+syntax = "proto3";
+
+package osbase.build.mkucode;
+option go_package = "source.monogon.dev/osbase/build/mkucode/spec";
+
+message UCode {
+  repeated UCodeVendor vendor = 1;
+}
+
+message UCodeVendor {
+  // The vendor id (as given in cpuid) of the CPU the microcode is for, like
+  // GenuineIntel or AuthenticAMD.
+  string id = 1;
+
+  // List of paths to microcode files from for CPUs from the vendor.
+  repeated string file = 2;
+}
\ No newline at end of file