diff --git a/apex/Android.bp b/apex/Android.bp
index fade6c5..52f4384 100644
--- a/apex/Android.bp
+++ b/apex/Android.bp
@@ -69,6 +69,7 @@
         "microdroid.json",
         "microdroid_bootloader",
         "microdroid_bootloader.avbpubkey",
+        "microdroid_kernel",
     ],
     file_contexts: ":com.android.virt-file_contexts",
     canned_fs_config: "canned_fs_config",
diff --git a/apex/sign_virt_apex.py b/apex/sign_virt_apex.py
index 6863b0c..c8cb07d 100644
--- a/apex/sign_virt_apex.py
+++ b/apex/sign_virt_apex.py
@@ -378,9 +378,9 @@
 
     # re-sign bootloader, boot.img, vendor_boot.img, and init_boot.img
     Async(AddHashFooter, args, key, files['bootloader'], wait=[replace_f])
-    boot_img_f = Async(AddHashFooter, args, key, files['boot.img'])
-    vendor_boot_img_f = Async(AddHashFooter, args, key, files['vendor_boot.img'])
-    init_boot_img_f = Async(AddHashFooter, args, key, files['init_boot.img'])
+    Async(AddHashFooter, args, key, files['boot.img'])
+    Async(AddHashFooter, args, key, files['vendor_boot.img'])
+    Async(AddHashFooter, args, key, files['init_boot.img'])
 
     # re-sign super.img
     # 1. unpack super.img
@@ -392,11 +392,10 @@
     partitions = {"system_a": system_a_img, "vendor_a": vendor_a_img}
     Async(MakeSuperImage, args, partitions, files['super.img'], wait=[system_a_f, vendor_a_f])
 
-    # re-generate vbmeta from re-signed {boot, vendor_boot, init_boot, system_a, vendor_a}.img
+    # re-generate vbmeta from re-signed {system_a, vendor_a}.img
     Async(MakeVbmetaImage, args, key, files['vbmeta.img'],
-          images=[files['boot.img'], files['vendor_boot.img'],
-                  files['init_boot.img'], system_a_img, vendor_a_img],
-          wait=[boot_img_f, vendor_boot_img_f, init_boot_img_f, system_a_f, vendor_a_f])
+          images=[system_a_img, vendor_a_img],
+          wait=[system_a_f, vendor_a_f])
 
     # Re-sign bootconfigs and the uboot_env with the same key
     bootconfig_sign_key = key
diff --git a/libs/apkverify/src/v3.rs b/libs/apkverify/src/v3.rs
index fac0a7f..db7d8cc 100644
--- a/libs/apkverify/src/v3.rs
+++ b/libs/apkverify/src/v3.rs
@@ -76,9 +76,9 @@
 }
 
 #[derive(Debug)]
-struct Signature {
+pub(crate) struct Signature {
     /// Option is used here to allow us to ignore unsupported algorithm.
-    signature_algorithm_id: Option<SignatureAlgorithmID>,
+    pub(crate) signature_algorithm_id: Option<SignatureAlgorithmID>,
     signature: LengthPrefixed<Bytes>,
 }
 
@@ -127,9 +127,9 @@
 }
 
 impl Signer {
-    /// Select the signature that uses the strongest algorithm according to the preferences of the
-    /// v4 signing scheme.
-    fn strongest_signature(&self) -> Result<&Signature> {
+    /// Selects the signature that has the strongest supported `SignatureAlgorithmID`.
+    /// The strongest signature is used in both v3 verification and v4 apk digest computation.
+    pub(crate) fn strongest_signature(&self) -> Result<&Signature> {
         Ok(self
             .signatures
             .iter()
@@ -138,14 +138,13 @@
             .context("No supported signatures found")?)
     }
 
-    pub(crate) fn pick_v4_apk_digest(&self) -> Result<(SignatureAlgorithmID, Box<[u8]>)> {
-        let strongest_algorithm_id = self
-            .strongest_signature()?
-            .signature_algorithm_id
-            .context("Strongest signature should contain a valid signature algorithm.")?;
+    pub(crate) fn find_digest_by_algorithm(
+        &self,
+        algorithm_id: SignatureAlgorithmID,
+    ) -> Result<Box<[u8]>> {
         let signed_data: SignedData = self.signed_data.slice(..).read()?;
-        let digest = signed_data.find_digest_by_algorithm(strongest_algorithm_id)?;
-        Ok((strongest_algorithm_id, digest.digest.as_ref().to_vec().into_boxed_slice()))
+        let digest = signed_data.find_digest_by_algorithm(algorithm_id)?;
+        Ok(digest.digest.as_ref().to_vec().into_boxed_slice())
     }
 
     /// Verifies the strongest signature from signatures against signed data using public key.
diff --git a/libs/apkverify/src/v4.rs b/libs/apkverify/src/v4.rs
index d0522a7..9012479 100644
--- a/libs/apkverify/src/v4.rs
+++ b/libs/apkverify/src/v4.rs
@@ -18,7 +18,7 @@
 //!
 //! [v4]: https://source.android.com/security/apksigning/v4
 
-use anyhow::{ensure, Result};
+use anyhow::{ensure, Context, Result};
 use std::io::{Read, Seek};
 
 use crate::algorithms::SignatureAlgorithmID;
@@ -34,13 +34,17 @@
     verify: bool,
 ) -> Result<(SignatureAlgorithmID, Box<[u8]>)> {
     let (signer, mut sections) = extract_signer_and_apk_sections(apk)?;
-    let (signature_algorithm_id, extracted_digest) = signer.pick_v4_apk_digest()?;
+    let strongest_algorithm_id = signer
+        .strongest_signature()?
+        .signature_algorithm_id
+        .context("Strongest signature should contain a valid signature algorithm.")?;
+    let extracted_digest = signer.find_digest_by_algorithm(strongest_algorithm_id)?;
     if verify {
-        let computed_digest = sections.compute_digest(signature_algorithm_id)?;
+        let computed_digest = sections.compute_digest(strongest_algorithm_id)?;
         ensure!(
             computed_digest == extracted_digest.as_ref(),
             "Computed digest does not match the extracted digest."
         );
     }
-    Ok((signature_algorithm_id, extracted_digest))
+    Ok((strongest_algorithm_id, extracted_digest))
 }
diff --git a/microdroid/Android.bp b/microdroid/Android.bp
index 7b28ad2..67f3117 100644
--- a/microdroid/Android.bp
+++ b/microdroid/Android.bp
@@ -508,10 +508,7 @@
     private_key: ":microdroid_sign_key",
     partitions: [
         "microdroid_vendor",
-        "microdroid_vendor_boot",
         "microdroid",
-        "microdroid_boot",
-        "microdroid_init_boot",
     ],
 }
 
@@ -573,3 +570,32 @@
     name: "microdroid_bootconfig_normal_src",
     srcs: ["bootconfig.normal"],
 }
+
+prebuilt_etc {
+    name: "microdroid_kernel_unsigned",
+    src: "empty_kernel",
+    filename: "microdroid_kernel_unsigned",
+    arch: {
+        arm64: {
+            src: ":microdroid_kernel_prebuilts-5.15-arm64",
+        },
+        x86_64: {
+            src: ":microdroid_kernel_prebuilts-5.15-x86_64",
+        },
+    },
+}
+
+avb_add_hash_footer {
+    name: "microdroid_kernel_signed",
+    src: ":microdroid_kernel_unsigned",
+    filename: "microdroid_kernel",
+    partition_name: "bootloader",
+    private_key: ":microdroid_sign_key",
+    salt: bootloader_salt,
+}
+
+prebuilt_etc {
+    name: "microdroid_kernel",
+    src: ":microdroid_kernel_signed",
+    relative_install_path: "fs",
+}
diff --git a/microdroid/microdroid.json b/microdroid/microdroid.json
index f02dcbf..00cedc8 100644
--- a/microdroid/microdroid.json
+++ b/microdroid/microdroid.json
@@ -1,21 +1,9 @@
 {
-  "bootloader": "/apex/com.android.virt/etc/fs/microdroid_bootloader",
+  "kernel": "/apex/com.android.virt/etc/fs/microdroid_kernel",
   "disks": [
     {
       "partitions": [
         {
-          "label": "boot_a",
-          "path": "/apex/com.android.virt/etc/fs/microdroid_boot.img"
-        },
-        {
-          "label": "init_boot_a",
-          "path": "/apex/com.android.virt/etc/fs/microdroid_init_boot.img"
-        },
-        {
-          "label": "vendor_boot_a",
-          "path": "/apex/com.android.virt/etc/fs/microdroid_vendor_boot.img"
-        },
-        {
           "label": "vbmeta_a",
           "path": "/apex/com.android.virt/etc/fs/microdroid_vbmeta.img"
         },
@@ -25,16 +13,6 @@
         }
       ],
       "writable": false
-    },
-    {
-      "partitions": [
-        {
-          "label": "uboot_env",
-          "path": "/apex/com.android.virt/etc/fs/uboot_env.img",
-          "writable": false
-        }
-      ],
-      "writable": true
     }
   ],
   "memory_mib": 256,
diff --git a/tests/helper/src/java/com/android/microdroid/test/device/MicrodroidDeviceTestBase.java b/tests/helper/src/java/com/android/microdroid/test/device/MicrodroidDeviceTestBase.java
index 5dcd77b..a1dee6d 100644
--- a/tests/helper/src/java/com/android/microdroid/test/device/MicrodroidDeviceTestBase.java
+++ b/tests/helper/src/java/com/android/microdroid/test/device/MicrodroidDeviceTestBase.java
@@ -282,7 +282,9 @@
         }
 
         private long getKernelStartedNanoTime() {
-            return kernelStartedNanoTime.getAsLong();
+            // pvmfw emits log at the end which is used to estimate the kernelStart time.
+            // In case of no pvmfw run(non-protected mode), use vCPU started time instead.
+            return kernelStartedNanoTime.orElse(vcpuStartedNanoTime.getAsLong());
         }
 
         private long getInitStartedNanoTime() {
diff --git a/tests/hostside/java/com/android/microdroid/test/MicrodroidTestCase.java b/tests/hostside/java/com/android/microdroid/test/MicrodroidTestCase.java
index 48dd1e0..928261a 100644
--- a/tests/hostside/java/com/android/microdroid/test/MicrodroidTestCase.java
+++ b/tests/hostside/java/com/android/microdroid/test/MicrodroidTestCase.java
@@ -58,6 +58,7 @@
 import org.json.JSONObject;
 import org.junit.After;
 import org.junit.Before;
+import org.junit.Ignore;
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.rules.TestName;
@@ -358,7 +359,7 @@
         JSONObject config = new JSONObject(FileUtil.readStringFromFile(microdroidConfigFile));
 
         // Replace paths so that the config uses re-signed images from TEST_ROOT
-        config.put("bootloader", config.getString("bootloader").replace(VIRT_APEX, TEST_ROOT));
+        config.put("kernel", config.getString("kernel").replace(VIRT_APEX, TEST_ROOT));
         JSONArray disks = config.getJSONArray("disks");
         for (int diskIndex = 0; diskIndex < disks.length(); diskIndex++) {
             JSONObject disk = disks.getJSONObject(diskIndex);
@@ -370,14 +371,16 @@
         }
 
         // Add partitions to the second disk
-        final String vbmetaPath = TEST_ROOT + "etc/fs/microdroid_vbmeta_bootconfig.img";
-        final String bootconfigPath = TEST_ROOT + "etc/fs/microdroid_bootconfig.full_debuggable";
-        disks.getJSONObject(1)
-                .getJSONArray("partitions")
-                .put(newPartition("vbmeta", vbmetaPath))
-                .put(newPartition("bootconfig", bootconfigPath))
-                .put(newPartition("vm-instance", instanceImgPath));
-
+        final String initrdPath = TEST_ROOT + "etc/microdroid_initrd_full_debuggable.img";
+        config.put("initrd", initrdPath);
+        // Add instance image as a partition in disks[1]
+        disks.put(
+            new JSONObject()
+                .put("writable", true)
+                .put(
+                    "partitions",
+                    new JSONArray()
+                        .put(newPartition("vm-instance", instanceImgPath))));
         // Add payload image disk with partitions:
         // - payload-metadata
         // - apexes: com.android.os.statsd, com.android.adbd, [sharedlib apex](optional)
@@ -437,7 +440,10 @@
         assertThat(getDevice().pullFileContents(consolePath), containsString("pvmfw boot failed"));
     }
 
+    // TODO(b/245277660): Resigning the system/vendor image changes the vbmeta hash.
+    // So, unless vbmeta related bootconfigs are updated the following test will fail
     @Test
+    @Ignore("b/245277660")
     @CddTest(requirements = {"9.17/C-2-2", "9.17/C-2-6"})
     public void testBootSucceedsWhenNonProtectedVmStartsWithImagesSignedWithDifferentKey()
             throws Exception {
@@ -456,7 +462,7 @@
 
     @Test
     @CddTest(requirements = {"9.17/C-2-2", "9.17/C-2-6"})
-    public void testBootFailsWhenBootloaderAndVbMetaAreSignedWithDifferentKeys() throws Exception {
+    public void testBootFailsWhenVbMetaDigestDoesNotMatchBootconfig() throws Exception {
         // Sign everything with key1 except vbmeta
         File key = findTestFile("test.com.android.virt.pem");
         File key2 = findTestFile("test2.com.android.virt.pem");
@@ -468,34 +474,11 @@
         String cid =
                 runMicrodroidWithResignedImages(
                         key, keyOverrides, isProtected, daemonize, consolePath);
-        // Wail for a while so that bootloader prints errors to console
+        // Wait so that init can print errors to console (time in cuttlefish >> in real device)
         assertThatEventually(
-                10000,
+                100000,
                 () -> getDevice().pullFileContents(consolePath),
-                containsString("Public key was rejected"));
-        shutdownMicrodroid(getDevice(), cid);
-    }
-
-    @Test
-    @CddTest(requirements = {"9.17/C-2-2", "9.17/C-2-6"})
-    public void testBootSucceedsWhenBootloaderAndVbmetaHaveSameSigningKeys() throws Exception {
-        // Sign everything with key1 except bootloader and vbmeta
-        File key = findTestFile("test.com.android.virt.pem");
-        File key2 = findTestFile("test2.com.android.virt.pem");
-        Map<String, File> keyOverrides =
-                Map.of(
-                        "microdroid_bootloader", key2,
-                        "microdroid_vbmeta.img", key2,
-                        "microdroid_vbmeta_bootconfig.img", key2);
-        boolean isProtected = false; // Not interested in pvwfw
-        boolean daemonize = true; // Bootloader should succeed.
-        // To be able to stop it, it should be a daemon.
-        String consolePath = TEST_ROOT + "console";
-        String cid =
-                runMicrodroidWithResignedImages(
-                        key, keyOverrides, isProtected, daemonize, consolePath);
-        // Adb connection to the microdroid means that boot succeeded.
-        adbConnectToMicrodroid(getDevice(), cid);
+                containsString("init: [libfs_avb]Failed to verify vbmeta digest"));
         shutdownMicrodroid(getDevice(), cid);
     }
 
diff --git a/tests/testapk/src/java/com/android/microdroid/test/MicrodroidTests.java b/tests/testapk/src/java/com/android/microdroid/test/MicrodroidTests.java
index c2060cb..4b40293 100644
--- a/tests/testapk/src/java/com/android/microdroid/test/MicrodroidTests.java
+++ b/tests/testapk/src/java/com/android/microdroid/test/MicrodroidTests.java
@@ -451,36 +451,6 @@
             "9.17/C-1-1",
             "9.17/C-2-7"
     })
-    public void bootFailsWhenUBootAvbDataIsCompromised()
-            throws VirtualMachineException, InterruptedException, IOException {
-        if (mProtectedVm) {
-            assertThatBootFailsAfterCompromisingPartition(U_BOOT_AVB_PARTITION_UUID);
-        } else {
-            // non-protected VM shouldn't have u-boot avb data
-            assertThatPartitionIsMissing(U_BOOT_AVB_PARTITION_UUID);
-        }
-    }
-
-    @Test
-    @CddTest(requirements = {
-            "9.17/C-1-1",
-            "9.17/C-2-7"
-    })
-    public void bootFailsWhenUBootEnvDataIsCompromised()
-            throws VirtualMachineException, InterruptedException, IOException {
-        if (mProtectedVm) {
-            assertThatBootFailsAfterCompromisingPartition(U_BOOT_ENV_PARTITION_UUID);
-        } else {
-            // non-protected VM shouldn't have u-boot env data
-            assertThatPartitionIsMissing(U_BOOT_ENV_PARTITION_UUID);
-        }
-    }
-
-    @Test
-    @CddTest(requirements = {
-            "9.17/C-1-1",
-            "9.17/C-2-7"
-    })
     public void bootFailsWhenPvmFwDataIsCompromised()
             throws VirtualMachineException, InterruptedException, IOException {
         if (mProtectedVm) {
diff --git a/virtualizationservice/src/aidl.rs b/virtualizationservice/src/aidl.rs
index 1eca9fe..15e798a 100644
--- a/virtualizationservice/src/aidl.rs
+++ b/virtualizationservice/src/aidl.rs
@@ -632,7 +632,7 @@
     vm_config.numCpus = config.numCpus;
     vm_config.taskProfiles = config.taskProfiles.clone();
 
-    // Microdroid requires an additional payload disk image and the bootconfig partition.
+    // Microdroid requires an additional init ramdisk & payload disk image
     if os_name == "microdroid" {
         add_microdroid_images(
             config,
diff --git a/virtualizationservice/src/payload.rs b/virtualizationservice/src/payload.rs
index 675ca50..06b9716 100644
--- a/virtualizationservice/src/payload.rs
+++ b/virtualizationservice/src/payload.rs
@@ -360,6 +360,21 @@
     vm_payload_config: &VmPayloadConfig,
     vm_config: &mut VirtualMachineRawConfig,
 ) -> Result<()> {
+    let debug_suffix = match config.debugLevel {
+        DebugLevel::NONE => "normal",
+        DebugLevel::APP_ONLY => "app_debuggable",
+        DebugLevel::FULL => "full_debuggable",
+        _ => return Err(anyhow!("unsupported debug level: {:?}", config.debugLevel)),
+    };
+    let initrd = format!("/apex/com.android.virt/etc/microdroid_initrd_{}.img", debug_suffix);
+    vm_config.initrd = Some(open_parcel_file(Path::new(&initrd), false)?);
+
+    let instance_img = Partition {
+        label: "vm-instance".to_owned(),
+        image: Some(ParcelFileDescriptor::new(instance_file)),
+        writable: true,
+    };
+    vm_config.disks.push(DiskImage { image: None, partitions: vec![instance_img], writable: true });
     vm_config.disks.push(make_payload_disk(
         config,
         apk_file,
@@ -368,34 +383,6 @@
         temporary_directory,
     )?);
 
-    vm_config.disks[1].partitions.push(Partition {
-        label: "vbmeta".to_owned(),
-        image: Some(open_parcel_file(
-            Path::new("/apex/com.android.virt/etc/fs/microdroid_vbmeta_bootconfig.img"),
-            false,
-        )?),
-        writable: false,
-    });
-    let bootconfig_image = "/apex/com.android.virt/etc/fs/microdroid_bootconfig.".to_owned()
-        + match config.debugLevel {
-            DebugLevel::NONE => "normal",
-            DebugLevel::APP_ONLY => "app_debuggable",
-            DebugLevel::FULL => "full_debuggable",
-            _ => return Err(anyhow!("unsupported debug level: {:?}", config.debugLevel)),
-        };
-    vm_config.disks[1].partitions.push(Partition {
-        label: "bootconfig".to_owned(),
-        image: Some(open_parcel_file(Path::new(&bootconfig_image), false)?),
-        writable: false,
-    });
-
-    // instance image is at the second partition in the second disk.
-    vm_config.disks[1].partitions.push(Partition {
-        label: "vm-instance".to_owned(),
-        image: Some(ParcelFileDescriptor::new(instance_file)),
-        writable: true,
-    });
-
     Ok(())
 }