diff --git a/profiles/base/accounts/group/rma_fw_keeper b/profiles/base/accounts/group/rma_fw_keeper
new file mode 100644
index 0000000..0432b86
--- /dev/null
+++ b/profiles/base/accounts/group/rma_fw_keeper
@@ -0,0 +1,3 @@
+group:rma_fw_keeper
+gid:20124
+users:rma_fw_keeper
diff --git a/profiles/base/accounts/group/suzy-q b/profiles/base/accounts/group/suzy-q
new file mode 100644
index 0000000..c41c968
--- /dev/null
+++ b/profiles/base/accounts/group/suzy-q
@@ -0,0 +1,3 @@
+group:suzy-q
+gid:415
+users:chronos,rma_fw_keeper
diff --git a/profiles/base/accounts/user/rma_fw_keeper b/profiles/base/accounts/user/rma_fw_keeper
new file mode 100644
index 0000000..ebd7856
--- /dev/null
+++ b/profiles/base/accounts/user/rma_fw_keeper
@@ -0,0 +1,6 @@
+user:rma_fw_keeper
+uid:20124
+gid:20124
+gecos:RMA'ed device FW keeper. verify_ro in crosh runs as this user.
+home:/dev/null
+shell:/bin/false