diff --git a/src/tools/build.mk b/src/tools/build.mk
index 7139e82..b5d8285 100644
--- a/src/tools/build.mk
+++ b/src/tools/build.mk
@@ -8,6 +8,11 @@ out/curl.tgz: \
 	out/ca-certificates.tgz
 	$(call build,tools,curl)
 
+out/gen_initramfs.tgz: \
+	out/gcc.tgz \
+	out/musl.tgz
+	$(call build,tools,gen_initramfs)
+
 out/tofu.tgz: \
 	out/busybox.tgz \
 	out/go.tgz
@@ -16,4 +21,4 @@ out/tofu.tgz: \
 out/sops.tgz: \
 	out/busybox.tgz \
 	out/go.tgz
-	$(call build,tools,sops)
\ No newline at end of file
+	$(call build,tools,sops)
diff --git a/src/tools/gen_initramfs/Dockerfile b/src/tools/gen_initramfs/Dockerfile
new file mode 100644
index 0000000..3db0b17
--- /dev/null
+++ b/src/tools/gen_initramfs/Dockerfile
@@ -0,0 +1,30 @@
+ARG REGISTRY=local
+FROM ${REGISTRY}/musl as musl
+FROM ${REGISTRY}/gcc as gcc
+FROM ${REGISTRY}/busybox as busybox
+
+FROM busybox as base
+WORKDIR ${HOME}
+ENV SRC_SITE http://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/
+ENV SRC_VERSION 6.6
+ENV SRC_HASH d926a06c63dd8ac7df3f86ee1ffc2ce2a3b81a2d168484e76b5b389aba8e56d0
+
+FROM base as fetch
+RUN wget ${SRC_SITE}/linux-${SRC_VERSION}.tar.xz
+RUN echo "${SRC_HASH}  linux-${SRC_VERSION}.tar.xz" | sha256sum -c
+
+FROM fetch as build
+RUN tar -xf linux-${SRC_VERSION}.tar.xz
+WORKDIR linux-${SRC_VERSION}
+RUN gcc usr/gen_init_cpio.c -o usr/gen_init_cpio
+
+FROM build as install
+USER 0:0
+RUN set -eux; \
+    mkdir -p /rootfs/usr/bin; \
+    cp -a usr/gen_initramfs.sh /rootfs/usr/bin/gen_initramfs; \
+    cp -a usr/gen_init_cpio /rootfs/usr/bin; \
+    find /rootfs -exec touch -hcd "@0" "{}" +
+
+FROM scratch as package
+COPY --from=install /rootfs /