diff --git a/apex/Android.bp b/apex/Android.bp
index 41d2f62..8af22ff 100644
--- a/apex/Android.bp
+++ b/apex/Android.bp
@@ -43,15 +43,20 @@
         },
     },
     binaries: [
-        "mk_cdisk",
         "fd_server",
         "virtmanager",
         "vm",
+
+        // tools to create composite images
+        "mk_cdisk",
+        "mk_microdroid_signature",
+        "mk_payload",
     ],
     prebuilts: [
         "com.android.virt.init.rc",
         "microdroid_cdisk.json",
         "microdroid_cdisk_env.json",
+        "microdroid_payload.json",
         "microdroid_uboot_env",
         "microdroid_bootloader",
     ],
diff --git a/microdroid/Android.bp b/microdroid/Android.bp
index 2ce435b..2522679 100644
--- a/microdroid/Android.bp
+++ b/microdroid/Android.bp
@@ -32,7 +32,7 @@
     },
 ]
 
-android_filesystem {
+android_system_image {
     name: "microdroid",
     use_avb: true,
     avb_private_key: ":avb_testkey_rsa4096",
@@ -41,6 +41,7 @@
     deps: [
         "init_second_stage",
         "microdroid_init_rc",
+        "microdroid_build_prop",
         "ueventd.rc",
         "libbinder",
         "libstdc++",
@@ -48,7 +49,11 @@
         "logd",
         "run-as",
         "secilc",
-        "adbd",
+
+        // "com.android.adbd" requires these,
+        "libadbd_auth",
+        "libadbd_fs",
+
         "apexd",
         "debuggerd",
         "linker",
@@ -56,6 +61,7 @@
         "servicemanager",
         "tombstoned",
         "cgroups.json",
+        "public.libraries.android.txt",
 
         "plat_sepolicy_and_mapping.sha256",
     ] + microdroid_shell_and_utilities,
@@ -73,6 +79,7 @@
             ],
         },
     },
+    linker_config_src: "linker.config.json",
     base_dir: "system",
     dirs: microdroid_rootdirs,
     symlinks: microdroid_symlinks,
@@ -87,6 +94,13 @@
     installable: false, // avoid collision with system partition's init.rc
 }
 
+prebuilt_root {
+    name: "microdroid_build_prop",
+    filename: "build.prop",
+    src: "build.prop",
+    installable: false,
+}
+
 android_filesystem {
     name: "microdroid_vendor",
     use_avb: true,
@@ -369,3 +383,8 @@
     name: "microdroid_cdisk_env.json",
     src: "microdroid_cdisk_env.json",
 }
+
+prebuilt_etc {
+    name: "microdroid_payload.json",
+    src: "microdroid_payload.json",
+}
diff --git a/microdroid/README.md b/microdroid/README.md
index a4bfb6e..4ce74a5 100644
--- a/microdroid/README.md
+++ b/microdroid/README.md
@@ -36,7 +36,8 @@
 $ adb shell 'dd if=/dev/zero of=/data/local/tmp/misc.img bs=4k count=256'
 $ adb shell 'cd /data/local/tmp; /apex/com.android.virt/bin/mk_cdisk /apex/com.android.virt/etc/microdroid_cdisk.json os_composite.img'
 $ adb shell 'cd /data/local/tmp; /apex/com.android.virt/bin/mk_cdisk /apex/com.android.virt/etc/microdroid_cdisk_env.json env_composite.img'
-$ adb shell 'cd /data/local/tmp; /apex/com.android.virt/bin/crosvm run --cid=5 --disable-sandbox --bios=bootloader --serial=type=stdout --disk=os_composite.img --disk=env_composite.img'
+$ adb shell 'cd /data/local/tmp; /apex/com.android.virt/bin/mk_payload /apex/com.android.virt/etc/microdroid_payload.json payload.img'
+$ adb shell 'cd /data/local/tmp; /apex/com.android.virt/bin/crosvm run --cid=5 --disable-sandbox --bios=bootloader --serial=type=stdout --disk=os_composite.img --disk=env_composite.img --disk=payload.img'
 ```
 
 The CID in `--cid` parameter can be anything greater than 2 (`VMADDR_CID_HOST`).
diff --git a/microdroid/build.prop b/microdroid/build.prop
new file mode 100644
index 0000000..52d073f
--- /dev/null
+++ b/microdroid/build.prop
@@ -0,0 +1,4 @@
+# build.prop for microdroid
+ro.apex.updatable=true
+ro.debuggable=1
+ro.adb.secure=0
diff --git a/microdroid/init.rc b/microdroid/init.rc
index e70fb77..61f9ae5 100644
--- a/microdroid/init.rc
+++ b/microdroid/init.rc
@@ -12,14 +12,22 @@
 
 # Cgroups are mounted right before early-init using list from /etc/cgroups.json
 on early-init
-    start ueventd
-    setprop ro.apex.updatable true
-    setprop ro.debuggable 1
-    setprop ro.adb.secure 0
 
-    # Generate ld.config.txt
-    exec -- /system/bin/bootstrap/linkerconfig --target /linkerconfig
-    chmod 644 /linkerconfig/ld.config.txt
+    # TODO(b/185991357) eliminate bootstrap mount namespace
+    # Set up linker config subdirectories based on mount namespaces
+    mkdir /linkerconfig/bootstrap 0755
+    mkdir /linkerconfig/default 0755
+
+    # Generate ld.config.txt for early executed processes
+    exec -- /system/bin/bootstrap/linkerconfig --target /linkerconfig/bootstrap
+    chmod 644 /linkerconfig/bootstrap/ld.config.txt
+    copy /linkerconfig/bootstrap/ld.config.txt /linkerconfig/default/ld.config.txt
+    chmod 644 /linkerconfig/default/ld.config.txt
+
+    # Mount bootstrap linker configuration as current
+    mount none /linkerconfig/bootstrap /linkerconfig bind rec
+
+    start ueventd
 
     # Run apexd-bootstrap so that APEXes that provide critical libraries
     # become available. Note that this is executed as exec_start to ensure that
@@ -90,11 +98,14 @@
     # The bind+remount combination allows this to work in containers.
     mount rootfs rootfs / remount bind ro nodev
 
-    # Currently, exec_start apexd-bootstrap is enough to run adb.
-    # TODO(b/179342589): uncomment after turning off APEX session on microdroid
-    # start apexd
-    # Wait for apexd to finish activating APEXes before starting more processes.
-    # wait_for_prop apexd.status activated
+    enter_default_mount_ns
+
+    # Start apexd in the VM mode to avoid unnecessary overhead of session management.
+    exec - root system -- /system/bin/apexd --vm
+
+    perform_apex_config
+
+    exec_start derive_sdk
 
     start adbd
 
@@ -113,13 +124,6 @@
     seclabel u:r:shell:s0
     setenv HOSTNAME console
 
-# TODO(b/181093750): remove these after adding apex support
-service adbd /system/bin/adbd --root_seclabel=u:r:su:s0
-    class core
-    socket adbd seqpacket 660 system system
-    disabled
-    seclabel u:r:adbd:s0
-
 on fs
     write /dev/event-log-tags "# content owned by logd
 "
diff --git a/microdroid/linker.config.json b/microdroid/linker.config.json
new file mode 100644
index 0000000..fd90821
--- /dev/null
+++ b/microdroid/linker.config.json
@@ -0,0 +1,20 @@
+{
+  "requireLibs": [
+    "libdexfile.so",
+    "libdexfiled.so",
+    "libnativebridge.so",
+    "libnativehelper.so",
+    "libnativeloader.so",
+    "libsigchain.so",
+    "libandroidicu.so",
+    "libicu.so",
+    "libicui18n.so",
+    "libicuuc.so",
+    "libnetd_resolv.so",
+    "libstatspull.so",
+    "libstatssocket.so",
+    "libadb_pairing_auth.so",
+    "libadb_pairing_connection.so",
+    "libadb_pairing_server.so"
+  ]
+}
diff --git a/microdroid/microdroid_payload.json b/microdroid/microdroid_payload.json
new file mode 100644
index 0000000..c5c49d0
--- /dev/null
+++ b/microdroid/microdroid_payload.json
@@ -0,0 +1,6 @@
+{
+  "system_apexes": [
+    "com.android.adbd",
+    "com.android.sdkext"
+  ]
+}
\ No newline at end of file
diff --git a/microdroid/signature/Android.bp b/microdroid/signature/Android.bp
new file mode 100644
index 0000000..b993e4e
--- /dev/null
+++ b/microdroid/signature/Android.bp
@@ -0,0 +1,86 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_defaults {
+    name: "microdroid_signature_default",
+    host_supported: true,
+    srcs: [
+        "microdroid_signature.proto",
+        "signature.cc",
+    ],
+    shared_libs: [
+        "libbase",
+        "liblog",
+    ],
+    export_include_dirs: ["include"],
+}
+
+cc_library_static {
+    name: "lib_microdroid_signature_proto",
+    proto: {
+        export_proto_headers: true,
+        type: "full",
+    },
+    defaults: ["microdroid_signature_default"],
+}
+
+cc_library_static {
+    name: "lib_microdroid_signature_proto_lite",
+    recovery_available: true,
+    proto: {
+        export_proto_headers: true,
+        type: "lite",
+    },
+    defaults: ["microdroid_signature_default"],
+    apex_available: [
+        "com.android.virt",
+    ],
+}
+
+cc_binary {
+    name: "mk_microdroid_signature",
+    srcs: [
+        "mk_microdroid_signature.cc",
+    ],
+    shared_libs: [
+        "libbase",
+        "liblog",
+    ],
+    static_libs: [
+        "lib_microdroid_signature_proto_lite",
+        "libjsoncpp",
+        "libprotobuf-cpp-lite",
+    ],
+    apex_available: [
+        "com.android.virt",
+    ],
+}
+
+cc_binary {
+    name: "mk_payload",
+    srcs: [
+        "mk_payload.cc",
+    ],
+    shared_libs: [
+        "libbase",
+        "libcuttlefish_fs",
+        "libcuttlefish_utils",
+        "liblog",
+        "libz",
+    ],
+    static_libs: [
+        "lib_microdroid_signature_proto_lite",
+        "libcdisk_spec",
+        "libext2_uuid",
+        "libimage_aggregator",
+        "libjsoncpp",
+        "libprotobuf-cpp-lite",
+        "libsparse",
+        "libxml2",
+    ],
+    generated_sources: ["apex-info-list"],
+    apex_available: [
+        "com.android.virt",
+    ],
+}
diff --git a/microdroid/signature/README.md b/microdroid/signature/README.md
new file mode 100644
index 0000000..0a39c31
--- /dev/null
+++ b/microdroid/signature/README.md
@@ -0,0 +1,85 @@
+# Microdroid Signature
+
+Microdroid Signature contains the signatures of the payloads so that the payloads are
+verified inside the Guest OS.
+
+* APEX packages that are passed to microdroid should be listed in the Microroid Signature.
+
+## Format
+
+Microdroid Signature is composed of header and body.
+
+| offset | size | description                                                    |
+|--------|------|----------------------------------------------------------------|
+| 0      | 4    | Header. unsigned int32: body length(L) in big endian           |
+| 4      | L    | Body. A protobuf message. [schema](microdroid_signature.proto) |
+
+## How to Create
+
+### `mk_microdroid_signature` and `mk_cdisk`
+
+For testing purpose, use `mk_microdroid_signature` to create a Microdroid Signature.
+
+```
+$ cat signature_config.json
+{
+  "apexes": [
+    {
+      "name": "com.my.hello",
+      "path": "hello.apex"
+    }
+  ]
+}
+$ adb push signature_config.json hello.apex /data/local/tmp/
+$ adb shell 'cd /data/local/tmp; /apex/com.android.virt/bin/mk_microdroid_signature signature_config.json signature
+```
+
+Then, pass the signature as the first partition of the payload disk image.
+
+```
+$ cat payload_cdisk.json
+{
+  "partitions": [
+    {
+      "label": "signature",
+      "path": "signature"
+    },
+    {
+      "label": "com.my.hello",
+      "path": "hello.apex"
+    }
+  ]
+}
+$ adb push payload_cdisk.json /data/local/tmp/
+$ adb shell 'cd /data/local/tmp; /apex/com.android.virt/bin/mk_cdisk payload_cdisk.json payload.img
+$ adb shell 'cd /data/local/tmp; /apex/com.android.virt/bin/crosvm .... --disk=payload.img'
+```
+
+### `mk_payload`
+
+`mk_payload` combines these two steps into a single step. Additionally, `mk_payload` can search system APEXes as well.
+This will generate the output composite image as well as three more component images. (See below)
+
+```
+$ cat payload_config.json
+{
+  "system_apexes": [
+    "com.android.adbd",
+  ],
+  "apexes": [
+    {
+      "name": "com.my.hello",
+      "path": "hello.apex"
+    }
+  ]
+}
+$ adb push payload_config.json hello.apex /data/local/tmp/
+$ adb shell 'cd /data/local/tmp; /apex/com.android.virt/bin/mk_payload payload_config.json payload.img
+$ adb shell ls /data/local/tmp/*.img
+payload-footer.img
+payload-header.img
+payload-signature.img
+payload.img
+```
+
+In the future, [VirtManager](../../virtmanager) will handle these stuffs.
\ No newline at end of file
diff --git a/microdroid/signature/include/microdroid/signature.h b/microdroid/signature/include/microdroid/signature.h
new file mode 100644
index 0000000..abacd6e
--- /dev/null
+++ b/microdroid/signature/include/microdroid/signature.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <android-base/result.h>
+#include <microdroid_signature.pb.h>
+
+#include <iostream>
+#include <string>
+
+namespace android {
+namespace microdroid {
+
+base::Result<MicrodroidSignature> ReadMicrodroidSignature(const std::string& path);
+
+base::Result<void> WriteMicrodroidSignature(const MicrodroidSignature& signature,
+                                            std::ostream& out);
+
+} // namespace microdroid
+} // namespace android
diff --git a/microdroid/signature/microdroid_signature.proto b/microdroid/signature/microdroid_signature.proto
new file mode 100644
index 0000000..8335ff5
--- /dev/null
+++ b/microdroid/signature/microdroid_signature.proto
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+syntax = "proto3";
+
+package android.microdroid;
+
+// Microdroid Signature is the body of the signature partition.
+message MicrodroidSignature {
+  uint32 version = 1;
+
+  // Lists the signature information of the payload apexes.
+  // The payload apexes are mapped to the partitions following the signature partition.
+  repeated ApexSignature apexes = 2;
+}
+
+message ApexSignature {
+  // Required.
+  // The apex name.
+  string name = 1;
+
+  // Required.
+  // The original size of the apex file.
+  uint32 size = 2;
+
+  // Optional.
+  // When specified, the public key used to sign the apex should match with it.
+  string publicKey = 3;
+
+  // Optional.
+  // When specified, the root digest of the apex should match with it.
+  string rootDigest = 4;
+}
diff --git a/microdroid/signature/mk_microdroid_signature.cc b/microdroid/signature/mk_microdroid_signature.cc
new file mode 100644
index 0000000..d5cb1a5
--- /dev/null
+++ b/microdroid/signature/mk_microdroid_signature.cc
@@ -0,0 +1,141 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+#include <fstream>
+#include <iostream>
+#include <string>
+
+#include <android-base/file.h>
+#include <android-base/result.h>
+#include <json/json.h>
+
+#include "microdroid/signature.h"
+
+using android::base::Dirname;
+using android::base::ErrnoError;
+using android::base::Error;
+using android::base::Result;
+using android::microdroid::MicrodroidSignature;
+using android::microdroid::WriteMicrodroidSignature;
+
+Result<uint32_t> GetFileSize(const std::string& path) {
+    struct stat st;
+    if (lstat(path.c_str(), &st) == -1) {
+        return ErrnoError() << "Can't lstat " << path;
+    }
+    return static_cast<uint32_t>(st.st_size);
+}
+
+// config JSON schema:
+// {
+//   "apexes": [
+//     {
+//       "name": string,       // the apex name
+//       "path": string,       // the path to the apex file
+//                             // absolute or relative to the config file
+//       "publicKey": string,  // optional
+//       "rootDigest": string, // optional
+//     }
+//   ]
+// }
+
+Result<MicrodroidSignature> LoadConfig(const std::string& config_file) {
+    MicrodroidSignature signature;
+    signature.set_version(1);
+
+    const std::string dirname = Dirname(config_file);
+    std::ifstream in(config_file);
+    Json::CharReaderBuilder builder;
+    Json::Value root;
+    Json::String errs;
+    if (!parseFromStream(builder, in, &root, &errs)) {
+        return Error() << "bad config: " << errs;
+    }
+
+    for (const Json::Value& apex : root["apexes"]) {
+        auto apex_signature = signature.add_apexes();
+
+        Json::Value name = apex["name"];
+        Json::Value path = apex["path"];
+        Json::Value publicKey = apex["publicKey"];
+        Json::Value rootDigest = apex["rootDigest"];
+
+        if (name.isString()) {
+            apex_signature->set_name(name.asString());
+        } else {
+            return Error() << "bad config: apexes.name should be a string: " << path;
+        }
+
+        if (path.isString()) {
+            std::string apex_path = path.asString();
+
+            // resolve path with the config_file's dirname if not absolute
+            bool is_absolute = !apex_path.empty() && apex_path[0] == '/';
+            if (!is_absolute) {
+                apex_path = dirname + "/" + apex_path;
+            }
+
+            auto file_size = GetFileSize(apex_path);
+            if (!file_size.ok()) {
+                return Error() << "I/O error: " << file_size.error();
+            }
+            apex_signature->set_size(file_size.value());
+        } else {
+            return Error() << "bad config: apexes.path should be a string: " << path;
+        }
+
+        if (publicKey.isString()) {
+            apex_signature->set_publickey(publicKey.asString());
+        } else if (!publicKey.isNull()) {
+            return Error() << "bad config: apexes.publicKey should be a string or null: "
+                           << publicKey;
+        }
+
+        if (rootDigest.isString()) {
+            apex_signature->set_rootdigest(rootDigest.asString());
+        } else if (!rootDigest.isNull()) {
+            return Error() << "bad config: apexes.rootDigest should be a string or null: "
+                           << rootDigest;
+        }
+    }
+
+    return signature;
+}
+
+int main(int argc, char** argv) {
+    if (argc != 3) {
+        std::cerr << "Usage: " << argv[0] << " <config> <output>\n";
+        return 1;
+    }
+
+    auto config = LoadConfig(argv[1]);
+    if (!config.ok()) {
+        std::cerr << config.error() << '\n';
+        return 1;
+    }
+
+    std::ofstream out(argv[2]);
+    auto result = WriteMicrodroidSignature(*config, out);
+    if (!result.ok()) {
+        std::cerr << result.error() << '\n';
+        return 1;
+    }
+    return 0;
+}
\ No newline at end of file
diff --git a/microdroid/signature/mk_payload.cc b/microdroid/signature/mk_payload.cc
new file mode 100644
index 0000000..8046b5e
--- /dev/null
+++ b/microdroid/signature/mk_payload.cc
@@ -0,0 +1,273 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+#include <fstream>
+#include <iostream>
+#include <optional>
+#include <string>
+#include <vector>
+
+#include <android-base/file.h>
+#include <android-base/result.h>
+#include <com_android_apex.h>
+#include <image_aggregator.h>
+#include <json/json.h>
+
+#include "microdroid/signature.h"
+
+using android::base::Dirname;
+using android::base::ErrnoError;
+using android::base::Error;
+using android::base::Result;
+using android::microdroid::ApexSignature;
+using android::microdroid::MicrodroidSignature;
+using android::microdroid::WriteMicrodroidSignature;
+
+using com::android::apex::ApexInfoList;
+using com::android::apex::readApexInfoList;
+
+using cuttlefish::CreateCompositeDisk;
+using cuttlefish::ImagePartition;
+using cuttlefish::kLinuxFilesystem;
+
+Result<uint32_t> GetFileSize(const std::string& path) {
+    struct stat st;
+    if (lstat(path.c_str(), &st) == -1) {
+        return ErrnoError() << "Can't lstat " << path;
+    }
+    return static_cast<uint32_t>(st.st_size);
+}
+
+std::string ToAbsolute(const std::string& path, const std::string& dirname) {
+    bool is_absolute = !path.empty() && path[0] == '/';
+    if (is_absolute) {
+        return path;
+    } else {
+        return dirname + "/" + path;
+    }
+}
+
+// Returns `append` is appended to the end of filename preserving the extension.
+std::string AppendFileName(const std::string& filename, const std::string& append) {
+    size_t pos = filename.find_last_of('.');
+    if (pos == std::string::npos) {
+        return filename + append;
+    } else {
+        return filename.substr(0, pos) + append + filename.substr(pos);
+    }
+}
+
+struct ApexConfig {
+    std::string name; // the apex name
+    std::string path; // the path to the apex file
+                      // absolute or relative to the config file
+    std::optional<std::string> public_key;
+    std::optional<std::string> root_digest;
+};
+
+struct Config {
+    std::string dirname; // config file's direname to resolve relative paths in the config
+
+    std::vector<std::string> system_apexes;
+    std::vector<ApexConfig> apexes;
+};
+
+#define DO(expr) \
+    if (auto res = (expr); !res.ok()) return res.error()
+
+Result<void> ParseJson(const Json::Value& value, std::string& s) {
+    if (!value.isString()) {
+        return Error() << "should be a string: " << value;
+    }
+    s = value.asString();
+    return {};
+}
+
+Result<void> ParseJson(const Json::Value& value, std::optional<std::string>& s) {
+    if (value.isNull()) {
+        s.reset();
+        return {};
+    }
+    s.emplace();
+    return ParseJson(value, *s);
+}
+
+Result<void> ParseJson(const Json::Value& value, ApexConfig& apex_config) {
+    DO(ParseJson(value["name"], apex_config.name));
+    DO(ParseJson(value["path"], apex_config.path));
+    DO(ParseJson(value["publicKey"], apex_config.public_key));
+    DO(ParseJson(value["rootDigest"], apex_config.root_digest));
+    return {};
+}
+
+template <typename T>
+Result<void> ParseJson(const Json::Value& values, std::vector<T>& parsed) {
+    for (const Json::Value& value : values) {
+        T t;
+        DO(ParseJson(value, t));
+        parsed.push_back(std::move(t));
+    }
+    return {};
+}
+
+Result<void> ParseJson(const Json::Value& value, Config& config) {
+    DO(ParseJson(value["system_apexes"], config.system_apexes));
+    DO(ParseJson(value["apexes"], config.apexes));
+    return {};
+}
+
+Result<Config> LoadConfig(const std::string& config_file) {
+    std::ifstream in(config_file);
+    Json::CharReaderBuilder builder;
+    Json::Value root;
+    Json::String errs;
+    if (!parseFromStream(builder, in, &root, &errs)) {
+        return Error() << "bad config: " << errs;
+    }
+
+    Config config;
+    config.dirname = Dirname(config_file);
+    DO(ParseJson(root, config));
+    return config;
+}
+
+#undef DO
+
+Result<void> LoadSystemApexes(Config& config) {
+    static const char* kApexInfoListFile = "/apex/apex-info-list.xml";
+    std::optional<ApexInfoList> apex_info_list = readApexInfoList(kApexInfoListFile);
+    if (!apex_info_list.has_value()) {
+        return Error() << "Failed to read " << kApexInfoListFile;
+    }
+    auto get_apex_path = [&](const std::string& apex_name) -> std::optional<std::string> {
+        for (const auto& apex_info : apex_info_list->getApexInfo()) {
+            if (apex_info.getIsActive() && apex_info.getModuleName() == apex_name) {
+                return apex_info.getModulePath();
+            }
+        }
+        return std::nullopt;
+    };
+    for (const auto& apex_name : config.system_apexes) {
+        const auto& apex_path = get_apex_path(apex_name);
+        if (!apex_path.has_value()) {
+            return Error() << "Can't find the system apex: " << apex_name;
+        }
+        config.apexes.push_back(ApexConfig{
+                .name = apex_name,
+                .path = *apex_path,
+                .public_key = std::nullopt,
+                .root_digest = std::nullopt,
+        });
+    }
+    return {};
+}
+
+Result<void> MakeSignature(const Config& config, const std::string& filename) {
+    MicrodroidSignature signature;
+    signature.set_version(1);
+
+    for (const auto& apex_config : config.apexes) {
+        ApexSignature* apex_signature = signature.add_apexes();
+
+        // name
+        apex_signature->set_name(apex_config.name);
+
+        // size
+        auto file_size = GetFileSize(ToAbsolute(apex_config.path, config.dirname));
+        if (!file_size.ok()) {
+            return Error() << "I/O error: " << file_size.error();
+        }
+        apex_signature->set_size(file_size.value());
+
+        // publicKey
+        if (apex_config.public_key.has_value()) {
+            apex_signature->set_publickey(apex_config.public_key.value());
+        }
+
+        // rootDigest
+        if (apex_config.root_digest.has_value()) {
+            apex_signature->set_rootdigest(apex_config.root_digest.value());
+        }
+    }
+
+    std::ofstream out(filename);
+    return WriteMicrodroidSignature(signature, out);
+}
+
+Result<void> MakePayload(const Config& config, const std::string& signature_file,
+                         const std::string& output_file) {
+    std::vector<ImagePartition> partitions;
+
+    // put signature at the first partition
+    partitions.push_back(ImagePartition{
+            .label = "signature",
+            .image_file_path = signature_file,
+            .type = kLinuxFilesystem,
+            .read_only = true,
+    });
+
+    // put apexes at the subsequent partitions
+    for (size_t i = 0; i < config.apexes.size(); i++) {
+        const auto& apex_config = config.apexes[i];
+        partitions.push_back(ImagePartition{
+                .label = "payload_apex_" + std::to_string(i),
+                .image_file_path = apex_config.path,
+                .type = kLinuxFilesystem,
+                .read_only = true,
+        });
+    }
+
+    const std::string gpt_header = AppendFileName(output_file, "-header");
+    const std::string gpt_footer = AppendFileName(output_file, "-footer");
+    CreateCompositeDisk(partitions, gpt_header, gpt_footer, output_file);
+    return {};
+}
+
+int main(int argc, char** argv) {
+    if (argc != 3) {
+        std::cerr << "Usage: " << argv[0] << " <config> <output>\n";
+        return 1;
+    }
+
+    auto config = LoadConfig(argv[1]);
+    if (!config.ok()) {
+        std::cerr << config.error() << '\n';
+        return 1;
+    }
+
+    if (const auto res = LoadSystemApexes(*config); !res.ok()) {
+        std::cerr << res.error() << '\n';
+        return 1;
+    }
+
+    const std::string output_file(argv[2]);
+    const std::string signature_file = AppendFileName(output_file, "-signature");
+
+    if (const auto res = MakeSignature(*config, signature_file); !res.ok()) {
+        std::cerr << res.error() << '\n';
+        return 1;
+    }
+    if (const auto res = MakePayload(*config, signature_file, output_file); !res.ok()) {
+        std::cerr << res.error() << '\n';
+        return 1;
+    }
+
+    return 0;
+}
\ No newline at end of file
diff --git a/microdroid/signature/signature.cc b/microdroid/signature/signature.cc
new file mode 100644
index 0000000..446159e
--- /dev/null
+++ b/microdroid/signature/signature.cc
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "microdroid/signature.h"
+
+#include <android-base/endian.h>
+#include <android-base/file.h>
+
+using android::base::ErrnoError;
+using android::base::Error;
+using android::base::Result;
+
+namespace android {
+namespace microdroid {
+
+Result<MicrodroidSignature> ReadMicrodroidSignature(const std::string& path) {
+    std::string content;
+    if (!base::ReadFileToString(path, &content)) {
+        return ErrnoError() << "Failed to read " << path;
+    }
+
+    // read length prefix (4-byte, big-endian)
+    uint32_t size;
+    const size_t length_prefix_bytes = sizeof(size);
+    if (content.size() < length_prefix_bytes) {
+        return Error() << "Invalid signature: size == " << content.size();
+    }
+    size = be32toh(*reinterpret_cast<uint32_t*>(content.data()));
+    if (content.size() < length_prefix_bytes + size) {
+        return Error() << "Invalid signature: size(" << size << ") mimatches to the content size("
+                       << content.size() - length_prefix_bytes << ")";
+    }
+    content = content.substr(length_prefix_bytes, size);
+
+    // parse content
+    MicrodroidSignature signature;
+    if (!signature.ParseFromString(content)) {
+        return Error() << "Can't parse MicrodroidSignature from " << path;
+    }
+    return signature;
+}
+
+Result<void> WriteMicrodroidSignature(const MicrodroidSignature& signature, std::ostream& out) {
+    // prepare content
+    std::string content;
+    if (!signature.SerializeToString(&content)) {
+        return Error() << "Failed to write protobuf.";
+    }
+
+    // write length prefix (4-byte, big-endian)
+    uint32_t size = htobe32(static_cast<uint32_t>(content.size()));
+    out.write(reinterpret_cast<const char*>(&size), sizeof(size));
+
+    // write content
+    out << content;
+
+    return {};
+}
+
+} // namespace microdroid
+} // namespace android
\ No newline at end of file
diff --git a/microdroid/uboot-env-x86_64.txt b/microdroid/uboot-env-x86_64.txt
index ab0fc26..ffc0462 100644
--- a/microdroid/uboot-env-x86_64.txt
+++ b/microdroid/uboot-env-x86_64.txt
@@ -1,7 +1,7 @@
 # Static u-boot environment variables for microdroid. See b/180481192
 
 # Boot the device following the Android boot procedure
-bootcmd=boot_android virtio 0#misc
+bootcmd=avb init virtio 0 && avb verify _a && boot_android virtio 0#misc
 
 bootdelay=0
 
diff --git a/microdroid/uboot-env.txt b/microdroid/uboot-env.txt
index b7940e5..0bdc591 100644
--- a/microdroid/uboot-env.txt
+++ b/microdroid/uboot-env.txt
@@ -1,7 +1,7 @@
 # Static u-boot environment variables for microdroid. See b/180481192
 
 # Boot the device following the Android boot procedure
-bootcmd=boot_android virtio 0#misc
+bootcmd=avb init virtio 0 && avb verify _a && boot_android virtio 0#misc
 
 bootdelay=0
 fdtaddr=0x80000000
diff --git a/tests/hostside/java/android/virt/test/MicrodroidTestCase.java b/tests/hostside/java/android/virt/test/MicrodroidTestCase.java
index 57c7b17..aaa0457 100644
--- a/tests/hostside/java/android/virt/test/MicrodroidTestCase.java
+++ b/tests/hostside/java/android/virt/test/MicrodroidTestCase.java
@@ -65,7 +65,7 @@
                         TEST_ROOT, TEST_ROOT, VIRT_APEX, VIRT_APEX, VIRT_APEX);
         getDevice().executeShellCommand(prepareImagesCmd);
 
-        // Create os_composite.img and env_composite.img
+        // Create os_composite.img, env_composite.img, and payload.img
         String makeOsCompositeCmd =
                 String.format(
                         "cd %s; %sbin/mk_cdisk %setc/microdroid_cdisk.json os_composite.img",
@@ -76,12 +76,21 @@
                         "cd %s; %sbin/mk_cdisk %setc/microdroid_cdisk_env.json env_composite.img",
                         TEST_ROOT, VIRT_APEX, VIRT_APEX);
         getDevice().executeShellCommand(makeEnvCompositeCmd);
+        String makePayloadCompositeCmd =
+                String.format(
+                        "cd %s; %sbin/mk_payload %setc/microdroid_payload.json payload.img",
+                        TEST_ROOT, VIRT_APEX, VIRT_APEX);
+        getDevice().executeShellCommand(makePayloadCompositeCmd);
 
         // Make sure that the composite images are created
-        final String compositeImg = TEST_ROOT + "/os_composite.img";
+        final String osCompositeImg = TEST_ROOT + "/os_composite.img";
         final String envCompositeImg = TEST_ROOT + "/env_composite.img";
+        final String payloadCompositeImg = TEST_ROOT + "/payload.img";
         CommandResult result =
-                getDevice().executeShellV2Command("du -b " + compositeImg + " " + envCompositeImg);
+                getDevice().executeShellV2Command(
+                        "du -b " + osCompositeImg + " "
+                                 + envCompositeImg + " "
+                                 + payloadCompositeImg);
         assertThat(result.getExitCode(), is(0));
         assertThat(result.getStdout(), is(not("")));
 
@@ -91,7 +100,7 @@
                 String.format(
                         "cd %s; %sbin/crosvm run --cid=%d --disable-sandbox --bios=bootloader"
                                 + " --serial=type=syslog --disk=os_composite.img"
-                                + " --disk=env_composite.img",
+                                + " --disk=env_composite.img --disk=payload.img",
                         TEST_ROOT, VIRT_APEX, TEST_VM_CID);
         executor.execute(
                 () -> {