diff --git a/BUILD.bazel b/BUILD.bazel
index dbffe2e..23a1235 100644
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -15,7 +15,8 @@
 load("@bazel_gazelle//:def.bzl", "gazelle")
 load("@io_bazel_rules_docker//go:image.bzl", "go_image")
 load("@io_bazel_rules_docker//container:container.bzl", "container_image")
-load("@package_bundle//file:packages.bzl", "packages")
+load("@package_bundle_amd64//file:packages.bzl", packages_amd64 = "packages")
+load("@package_bundle_arm64//file:packages.bzl", packages_arm64 = "packages")
 load("@rules_pkg//:pkg.bzl", "pkg_deb", "pkg_tar")
 
 # gazelle:prefix cos.googlesource.com/cos/tools.git
@@ -36,27 +37,54 @@
 )
 
 container_image(
-    name = "veritysetup",
+    name = "veritysetup_amd64",
     debs = [
-        packages["coreutils"],
-        packages["tar"],
-        packages["libacl1"],
-        packages["libattr1"],
-        packages["libc6"],
-        packages["libselinux1"],
-        packages["libpcre3"],
-        packages["cryptsetup-bin"],
-        packages["libcryptsetup4"],
-        packages["libpopt0"],
-        packages["libuuid1"],
-        packages["libdevmapper1.02.1"],
-        packages["libgcrypt20"],
-        packages["libargon2-0"],
-        packages["libjson-c3"],
-        packages["libudev1"],
-        packages["libpthread-stubs0-dev"],
-        packages["libm17n-0"],
-        packages["libgpg-error0"],
+        packages_amd64["coreutils"],
+        packages_amd64["tar"],
+        packages_amd64["libacl1"],
+        packages_amd64["libattr1"],
+        packages_amd64["libc6"],
+        packages_amd64["libselinux1"],
+        packages_amd64["libpcre3"],
+        packages_amd64["cryptsetup-bin"],
+        packages_amd64["libcryptsetup4"],
+        packages_amd64["libpopt0"],
+        packages_amd64["libuuid1"],
+        packages_amd64["libdevmapper1.02.1"],
+        packages_amd64["libgcrypt20"],
+        packages_amd64["libargon2-0"],
+        packages_amd64["libjson-c3"],
+        packages_amd64["libudev1"],
+        packages_amd64["libpthread-stubs0-dev"],
+        packages_amd64["libm17n-0"],
+        packages_amd64["libgpg-error0"],
+    ],
+    repository = "veritysetup",
+    visibility = ["//visibility:public"],
+)
+
+container_image(
+    name = "veritysetup_arm64",
+    debs = [
+        packages_arm64["coreutils"],
+        packages_arm64["tar"],
+        packages_arm64["libacl1"],
+        packages_arm64["libattr1"],
+        packages_arm64["libc6"],
+        packages_arm64["libselinux1"],
+        packages_arm64["libpcre3"],
+        packages_arm64["cryptsetup-bin"],
+        packages_arm64["libcryptsetup4"],
+        packages_arm64["libpopt0"],
+        packages_arm64["libuuid1"],
+        packages_arm64["libdevmapper1.02.1"],
+        packages_arm64["libgcrypt20"],
+        packages_arm64["libargon2-0"],
+        packages_arm64["libjson-c3"],
+        packages_arm64["libudev1"],
+        packages_arm64["libpthread-stubs0-dev"],
+        packages_arm64["libm17n-0"],
+        packages_arm64["libgpg-error0"],
     ],
     repository = "veritysetup",
     visibility = ["//visibility:public"],
@@ -73,14 +101,14 @@
     base = "@daisy//image",
     data_path = ".",
     debs = [
-        packages["coreutils"],
-        packages["tar"],
-        packages["libacl1"],
-        packages["libattr1"],
-        packages["libc6"],
-        packages["libselinux1"],
-        packages["libpcre3"],
-        packages["mtools"],
+        packages_amd64["coreutils"],
+        packages_amd64["tar"],
+        packages_amd64["libacl1"],
+        packages_amd64["libattr1"],
+        packages_amd64["libc6"],
+        packages_amd64["libselinux1"],
+        packages_amd64["libpcre3"],
+        packages_amd64["mtools"],
     ],
     files = [
         ":tmp_dir",
diff --git a/WORKSPACE b/WORKSPACE
index e219a7b..8cd183f 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -145,7 +145,7 @@
 )
 
 dpkg_src(
-    name = "debian_stretch",
+    name = "debian_stretch_amd64",
     arch = "amd64",
     distro = "stretch",
     sha256 = "79a66cd92ba9096fce679e15d0b5feb9effcf618b0a6d065eb32684dbffd0311",
@@ -153,8 +153,17 @@
     url = "http://snapshot.debian.org/archive",
 )
 
+dpkg_src(
+    name = "debian_stretch_arm64",
+    arch = "arm64",
+    distro = "stretch",
+    sha256 = "ec05c9109c0a6aef4509091b9ccf10939583e56b7ce53be9d8ef38ec5e0ce9d2",
+    snapshot = "20190328T105444Z",
+    url = "http://snapshot.debian.org/archive",
+)
+
 dpkg_list(
-    name = "package_bundle",
+    name = "package_bundle_amd64",
     packages = [
         "coreutils",
         "libacl1",
@@ -178,7 +187,36 @@
         "mtools",
     ],
     sources = [
-        "@debian_stretch//file:Packages.json",
+        "@debian_stretch_amd64//file:Packages.json",
+    ],
+)
+
+dpkg_list(
+    name = "package_bundle_arm64",
+    packages = [
+        "coreutils",
+        "libacl1",
+        "libattr1",
+        "libc6",
+        "libpcre3",
+        "libselinux1",
+        "tar",
+        "cryptsetup-bin",
+        "libcryptsetup4",
+        "libpopt0",
+        "libuuid1",
+        "libdevmapper1.02.1",
+        "libgcrypt20",
+        "libargon2-0",
+        "libjson-c3",
+        "libudev1",
+        "libpthread-stubs0-dev",
+        "libm17n-0",
+        "libgpg-error0",
+        "mtools",
+    ],
+    sources = [
+        "@debian_stretch_arm64//file:Packages.json",
     ],
 )
 
diff --git a/src/cmd/provisioner/BUILD.bazel b/src/cmd/provisioner/BUILD.bazel
index 21ea897..ef22e4e 100644
--- a/src/cmd/provisioner/BUILD.bazel
+++ b/src/cmd/provisioner/BUILD.bazel
@@ -28,7 +28,7 @@
 
 genrule(
     name = "veritysetup.img",
-    srcs = ["//:veritysetup.tar"],
+    srcs = ["//:veritysetup_amd64.tar"],
     outs = ["_veritysetup.img"],
     cmd = "cp $< $@",
 )