diff --git a/common/http_fetcher_unittest.cc b/common/http_fetcher_unittest.cc
index 654cb1d..17e360e 100644
--- a/common/http_fetcher_unittest.cc
+++ b/common/http_fetcher_unittest.cc
@@ -24,6 +24,7 @@
 #include <utility>
 #include <vector>
 
+#include <base/bind.h>
 #include <base/location.h>
 #include <base/logging.h>
 #include <base/message_loop/message_loop.h>
@@ -31,6 +32,7 @@
 #include <base/strings/string_util.h>
 #include <base/strings/stringprintf.h>
 #include <base/time/time.h>
+#include <brillo/bind_lambda.h>
 #include <brillo/message_loops/base_message_loop.h>
 #include <brillo/message_loops/message_loop.h>
 #include <brillo/message_loops/message_loop_utils.h>
@@ -46,7 +48,6 @@
 #include "update_engine/common/multi_range_http_fetcher.h"
 #include "update_engine/common/test_utils.h"
 #include "update_engine/common/utils.h"
-#include "update_engine/fake_system_state.h"
 #include "update_engine/proxy_resolver.h"
 
 using brillo::MessageLoop;
@@ -214,12 +215,12 @@
   virtual HttpServer* CreateServer() = 0;
 
   FakeHardware* fake_hardware() {
-    return fake_system_state_.fake_hardware();
+    return &fake_hardware_;
   }
 
  protected:
   DirectProxyResolver proxy_resolver_;
-  FakeSystemState fake_system_state_;
+  FakeHardware fake_hardware_;
 };
 
 class MockHttpFetcherTest : public AnyHttpFetcherTest {
@@ -264,11 +265,11 @@
     proxy_resolver_.set_num_proxies(num_proxies);
     LibcurlHttpFetcher *ret = new
         LibcurlHttpFetcher(reinterpret_cast<ProxyResolver*>(&proxy_resolver_),
-                           &fake_system_state_);
+                           &fake_hardware_);
     // Speed up test execution.
     ret->set_idle_seconds(1);
     ret->set_retry_seconds(1);
-    fake_system_state_.fake_hardware()->SetIsOfficialBuild(false);
+    fake_hardware_.SetIsOfficialBuild(false);
     return ret;
   }
 
@@ -313,13 +314,13 @@
         reinterpret_cast<ProxyResolver*>(&proxy_resolver_);
     MultiRangeHttpFetcher *ret =
         new MultiRangeHttpFetcher(
-            new LibcurlHttpFetcher(resolver, &fake_system_state_));
+            new LibcurlHttpFetcher(resolver, &fake_hardware_));
     ret->ClearRanges();
     ret->AddRange(0);
     // Speed up test execution.
     ret->set_idle_seconds(1);
     ret->set_retry_seconds(1);
-    fake_system_state_.fake_hardware()->SetIsOfficialBuild(false);
+    fake_hardware_.SetIsOfficialBuild(false);
     return ret;
   }
 
diff --git a/common/libcurl_http_fetcher.cc b/common/libcurl_http_fetcher.cc
index 5a248e6..51643a4 100644
--- a/common/libcurl_http_fetcher.cc
+++ b/common/libcurl_http_fetcher.cc
@@ -29,7 +29,6 @@
 #include "update_engine/common/certificate_checker.h"
 #include "update_engine/common/hardware_interface.h"
 #include "update_engine/common/platform_constants.h"
-#include "update_engine/system_state.h"
 
 using base::TimeDelta;
 using brillo::MessageLoop;
@@ -47,11 +46,11 @@
 
 LibcurlHttpFetcher::LibcurlHttpFetcher(
     ProxyResolver* proxy_resolver,
-    SystemState* system_state,
+    HardwareInterface* hardware,
     std::unique_ptr<CertificateChecker> certificate_checker)
-    : HttpFetcher(proxy_resolver),
-      hardware_(system_state->hardware()),
-      certificate_checker_(std::move(certificate_checker)) {
+  : HttpFetcher(proxy_resolver),
+    hardware_(hardware),
+    certificate_checker_(std::move(certificate_checker)) {
   // Dev users want a longer timeout (180 seconds) because they may
   // be waiting on the dev server to build an image.
   if (!hardware_->IsOfficialBuild())
diff --git a/common/libcurl_http_fetcher.h b/common/libcurl_http_fetcher.h
index 9e8abda..df0a7be 100644
--- a/common/libcurl_http_fetcher.h
+++ b/common/libcurl_http_fetcher.h
@@ -31,7 +31,6 @@
 #include "update_engine/common/certificate_checker.h"
 #include "update_engine/common/hardware_interface.h"
 #include "update_engine/common/http_fetcher.h"
-#include "update_engine/system_state.h"
 
 // This is a concrete implementation of HttpFetcher that uses libcurl to do the
 // http work.
@@ -41,10 +40,11 @@
 class LibcurlHttpFetcher : public HttpFetcher {
  public:
   LibcurlHttpFetcher(ProxyResolver* proxy_resolver,
-                     SystemState* system_state,
+                     HardwareInterface* hardware,
                      std::unique_ptr<CertificateChecker> certificate_checker);
-  LibcurlHttpFetcher(ProxyResolver* proxy_resolver, SystemState* system_state)
-      : LibcurlHttpFetcher(proxy_resolver, system_state, nullptr) {}
+  LibcurlHttpFetcher(ProxyResolver* proxy_resolver,
+                     HardwareInterface* hardware)
+      : LibcurlHttpFetcher(proxy_resolver, hardware, nullptr) {}
 
   // Cleans up all internal state. Does not notify delegate
   ~LibcurlHttpFetcher() override;
diff --git a/payload_consumer/delta_performer.cc b/payload_consumer/delta_performer.cc
index 99db3bf..21d8e54 100644
--- a/payload_consumer/delta_performer.cc
+++ b/payload_consumer/delta_performer.cc
@@ -803,7 +803,7 @@
     install_plan_->partitions.push_back(install_part);
   }
 
-  if (!install_plan_->LoadPartitionsFromSlots(system_state_)) {
+  if (!install_plan_->LoadPartitionsFromSlots(system_state_->boot_control())) {
     LOG(ERROR) << "Unable to determine all the partition devices.";
     *error = ErrorCode::kInstallDeviceOpenError;
     return false;
diff --git a/payload_consumer/install_plan.cc b/payload_consumer/install_plan.cc
index f404c20..a2a1b7b 100644
--- a/payload_consumer/install_plan.cc
+++ b/payload_consumer/install_plan.cc
@@ -89,18 +89,18 @@
                 powerwash_required);
 }
 
-bool InstallPlan::LoadPartitionsFromSlots(SystemState* system_state) {
+bool InstallPlan::LoadPartitionsFromSlots(BootControlInterface* boot_control) {
   bool result = true;
   for (Partition& partition : partitions) {
     if (source_slot != BootControlInterface::kInvalidSlot) {
-      result = system_state->boot_control()->GetPartitionDevice(
+      result = boot_control->GetPartitionDevice(
           partition.name, source_slot, &partition.source_path) && result;
     } else {
       partition.source_path.clear();
     }
 
     if (target_slot != BootControlInterface::kInvalidSlot) {
-      result = system_state->boot_control()->GetPartitionDevice(
+      result = boot_control->GetPartitionDevice(
           partition.name, target_slot, &partition.target_path) && result;
     } else {
       partition.target_path.clear();
diff --git a/payload_consumer/install_plan.h b/payload_consumer/install_plan.h
index f412499..e69462d 100644
--- a/payload_consumer/install_plan.h
+++ b/payload_consumer/install_plan.h
@@ -25,7 +25,6 @@
 
 #include "update_engine/common/action.h"
 #include "update_engine/common/boot_control_interface.h"
-#include "update_engine/system_state.h"
 
 // InstallPlan is a simple struct that contains relevant info for many
 // parts of the update system about the install that should happen.
@@ -52,7 +51,7 @@
   // Load the |source_path| and |target_path| of all |partitions| based on the
   // |source_slot| and |target_slot| if available. Returns whether it succeeded
   // to load all the partitions for the valid slots.
-  bool LoadPartitionsFromSlots(SystemState* system_state);
+  bool LoadPartitionsFromSlots(BootControlInterface* boot_control);
 
   bool is_resume{false};
   bool is_full_update{false};
diff --git a/update_attempter.cc b/update_attempter.cc
index 5d451bf..4790e84 100644
--- a/update_attempter.cc
+++ b/update_attempter.cc
@@ -581,7 +581,7 @@
   update_check_checker->SetObserver(this);
   std::unique_ptr<LibcurlHttpFetcher> update_check_fetcher(
       new LibcurlHttpFetcher(GetProxyResolver(),
-                             system_state_,
+                             system_state_->hardware(),
                              std::move(update_check_checker)));
   // Try harder to connect to the network, esp when not interactive.
   // See comment in libcurl_http_fetcher.cc.
@@ -601,16 +601,17 @@
       new OmahaRequestAction(system_state_,
                              new OmahaEvent(
                                  OmahaEvent::kTypeUpdateDownloadStarted),
-                             brillo::make_unique_ptr(
-                                new LibcurlHttpFetcher(GetProxyResolver(),
-                                                       system_state_)),
+                             brillo::make_unique_ptr(new LibcurlHttpFetcher(
+                                 GetProxyResolver(),
+                                 system_state_->hardware())),
                              false));
   std::unique_ptr<CertificateChecker> download_checker(
       new CertificateChecker(prefs_, &openssl_wrapper_,
                              ServerToCheck::kDownload));
   download_checker->SetObserver(this);
   LibcurlHttpFetcher* download_fetcher =
-      new LibcurlHttpFetcher(GetProxyResolver(), system_state_,
+      new LibcurlHttpFetcher(GetProxyResolver(),
+                             system_state_->hardware(),
                              std::move(download_checker));
   shared_ptr<DownloadAction> download_action(
       new DownloadAction(prefs_,
@@ -618,23 +619,24 @@
                          new MultiRangeHttpFetcher(
                              download_fetcher)));  // passes ownership
   shared_ptr<OmahaRequestAction> download_finished_action(
-      new OmahaRequestAction(system_state_,
-                             new OmahaEvent(
-                                 OmahaEvent::kTypeUpdateDownloadFinished),
-                             brillo::make_unique_ptr(
-                                new LibcurlHttpFetcher(GetProxyResolver(),
-                                                       system_state_)),
-                             false));
+      new OmahaRequestAction(
+          system_state_,
+          new OmahaEvent(OmahaEvent::kTypeUpdateDownloadFinished),
+          brillo::make_unique_ptr(
+              new LibcurlHttpFetcher(GetProxyResolver(),
+                                     system_state_->hardware())),
+          false));
   shared_ptr<FilesystemVerifierAction> dst_filesystem_verifier_action(
       new FilesystemVerifierAction(system_state_->boot_control(),
                                    VerifierMode::kVerifyTargetHash));
   shared_ptr<OmahaRequestAction> update_complete_action(
-      new OmahaRequestAction(system_state_,
-                             new OmahaEvent(OmahaEvent::kTypeUpdateComplete),
-                             brillo::make_unique_ptr(
-                                new LibcurlHttpFetcher(GetProxyResolver(),
-                                                       system_state_)),
-                             false));
+      new OmahaRequestAction(
+          system_state_,
+          new OmahaEvent(OmahaEvent::kTypeUpdateComplete),
+          brillo::make_unique_ptr(
+              new LibcurlHttpFetcher(GetProxyResolver(),
+                                     system_state_->hardware())),
+          false));
 
   download_action->set_delegate(this);
   response_handler_action_ = response_handler_action;
@@ -703,7 +705,8 @@
   install_plan.target_slot = GetRollbackSlot();
   install_plan.source_slot = system_state_->boot_control()->GetCurrentSlot();
 
-  TEST_AND_RETURN_FALSE(install_plan.LoadPartitionsFromSlots(system_state_));
+  TEST_AND_RETURN_FALSE(
+      install_plan.LoadPartitionsFromSlots(system_state_->boot_control()));
   install_plan.powerwash_required = powerwash;
 
   LOG(INFO) << "Using this install plan:";
@@ -1268,7 +1271,8 @@
       new OmahaRequestAction(system_state_,
                              error_event_.release(),  // Pass ownership.
                              brillo::make_unique_ptr(new LibcurlHttpFetcher(
-                                 GetProxyResolver(), system_state_)),
+                                 GetProxyResolver(),
+                                 system_state_->hardware())),
                              false));
   actions_.push_back(shared_ptr<AbstractAction>(error_event_action));
   processor_->EnqueueAction(error_event_action.get());
@@ -1376,7 +1380,7 @@
         nullptr,
         brillo::make_unique_ptr(new LibcurlHttpFetcher(
             GetProxyResolver(),
-            system_state_)),
+            system_state_->hardware())),
         true));
     actions_.push_back(shared_ptr<OmahaRequestAction>(ping_action));
     processor_->set_delegate(nullptr);