diff --git a/microdroid/Android.bp b/microdroid/Android.bp
index af6031a..79378fe 100644
--- a/microdroid/Android.bp
+++ b/microdroid/Android.bp
@@ -567,6 +567,12 @@
             enabled: true,
         },
     },
+    props: [
+        {
+            name: "trusted_ramdisk",
+            file: ":microdroid_initrd_hashes",
+        },
+    ],
 }
 
 prebuilt_etc {
diff --git a/microdroid/initrd/Android.bp b/microdroid/initrd/Android.bp
index d8e7069..eb761bf 100644
--- a/microdroid/initrd/Android.bp
+++ b/microdroid/initrd/Android.bp
@@ -159,3 +159,36 @@
     },
     filename: "microdroid_initrd_normal.img",
 }
+
+genrule {
+    name: "microdroid_initrd_normal.sha256",
+    srcs: [":microdroid_initrd_normal"],
+    cmd: "cat $(in) | sha256sum | cut -d' ' -f1 > $(out)",
+    out: ["hash"],
+}
+
+genrule {
+    name: "microdroid_initrd_app_debuggable.sha256",
+    srcs: [":microdroid_initrd_app_debuggable"],
+    cmd: "cat $(in) | sha256sum | cut -d' ' -f1 > $(out)",
+    out: ["hash"],
+}
+
+genrule {
+    name: "microdroid_initrd_full_debuggable.sha256",
+    srcs: [":microdroid_initrd_full_debuggable"],
+    cmd: "cat $(in) | sha256sum | cut -d' ' -f1 > $(out)",
+    out: ["hash"],
+}
+
+genrule {
+    name: "microdroid_initrd_hashes",
+    srcs: [
+        ":microdroid_initrd_normal.sha256",
+        ":microdroid_initrd_app_debuggable.sha256",
+        ":microdroid_initrd_full_debuggable.sha256",
+    ],
+    // join the hashes with commas
+    cmd: "cat $(in) | tr '\n' ',' > $(out) && truncate -s -1 $(out)",
+    out: ["output"],
+}