diff --git a/apex/Android.bp b/apex/Android.bp
index f06ff7a..4c2c00c 100644
--- a/apex/Android.bp
+++ b/apex/Android.bp
@@ -58,6 +58,7 @@
         "microdroid.json",
         "microdroid_uboot_env",
         "microdroid_bootloader",
+        "microdroid_bootconfig_debug",
     ],
     file_contexts: ":com.android.virt-file_contexts",
 }
diff --git a/microdroid/Android.bp b/microdroid/Android.bp
index f942349..5fb5ab4 100644
--- a/microdroid/Android.bp
+++ b/microdroid/Android.bp
@@ -193,10 +193,9 @@
 }
 
 microdroid_boot_cmdline = "panic=-1 " +
+    "bootconfig " +
     // TODO(b/181936135) make the ratelimiting conditional; ratelimiting on prod build
-    "printk.devkmsg=on " +
-    "androidboot.first_stage_console=1 " +
-    "androidboot.hardware=microdroid "
+    "printk.devkmsg=on "
 
 bootimg {
     name: "microdroid_boot-5.10",
@@ -207,15 +206,11 @@
     arch: {
         arm64: {
             kernel_prebuilt: ":kernel_prebuilts-5.10-arm64",
-            cmdline: microdroid_boot_cmdline +
-                "androidboot.boot_devices=10000.pci",
+            cmdline: microdroid_boot_cmdline,
         },
         x86_64: {
             kernel_prebuilt: ":kernel_prebuilts-5.10-x86_64",
-            cmdline: microdroid_boot_cmdline +
-                "pci=noacpi " +
-                "androidboot.boot_devices=pci0000:00/0000:00:01.0," + // os
-                "pci0000:00/0000:00:03.0", // payload
+            cmdline: microdroid_boot_cmdline + "pci=noacpi ",
         },
     },
     dtb_prebuilt: "dummy_dtb.img",
@@ -249,6 +244,14 @@
     dtb_prebuilt: "dummy_dtb.img",
     header_version: "4",
     vendor_boot: true,
+    arch: {
+        arm64: {
+            bootconfig: ":microdroid_bootconfig_arm64_gen",
+        },
+        x86_64: {
+            bootconfig: ":microdroid_bootconfig_x86_64_gen",
+        },
+    },
     partition_name: "vendor_boot",
     use_avb: true,
     avb_private_key: ":avb_testkey_rsa4096",
@@ -281,6 +284,32 @@
     ],
 }
 
+genrule {
+    name: "microdroid_bootconfig_arm64_gen",
+    srcs: [
+        "bootconfig.common",
+        "bootconfig.arm64",
+    ],
+    out: ["bootconfig"],
+    cmd: "cat $(in) > $(out)",
+}
+
+genrule {
+    name: "microdroid_bootconfig_x86_64_gen",
+    srcs: [
+        "bootconfig.common",
+        "bootconfig.x86_64",
+    ],
+    out: ["bootconfig"],
+    cmd: "cat $(in) > $(out)",
+}
+
+prebuilt_etc {
+    name: "microdroid_bootconfig_debug",
+    src: "bootconfig.debug",
+    filename: "microdroid_bootconfig.debug",
+}
+
 prebuilt_etc {
     name: "microdroid_fstab",
     src: "fstab.microdroid",
diff --git a/microdroid/bootconfig.arm64 b/microdroid/bootconfig.arm64
new file mode 100644
index 0000000..b1e6d56
--- /dev/null
+++ b/microdroid/bootconfig.arm64
@@ -0,0 +1 @@
+androidboot.boot_devices = 10000.pci
diff --git a/microdroid/bootconfig.common b/microdroid/bootconfig.common
new file mode 100644
index 0000000..eda95a2
--- /dev/null
+++ b/microdroid/bootconfig.common
@@ -0,0 +1,2 @@
+androidboot.first_stage_console = 1
+androidboot.hardware = microdroid
diff --git a/microdroid/bootconfig.debug b/microdroid/bootconfig.debug
new file mode 100644
index 0000000..d83ecb9
--- /dev/null
+++ b/microdroid/bootconfig.debug
@@ -0,0 +1 @@
+androidboot.selinux = permissive
diff --git a/microdroid/bootconfig.x86_64 b/microdroid/bootconfig.x86_64
new file mode 100644
index 0000000..75e4a80
--- /dev/null
+++ b/microdroid/bootconfig.x86_64
@@ -0,0 +1 @@
+androidboot.boot_devices = pci0000:00/0000:00:01.0,pci0000:00/0000:00:02.0,pci0000:00/0000:00:03.0