diff --git a/Makefile b/Makefile
index 49d1c9eac..9b678ecd1 100644
--- a/Makefile
+++ b/Makefile
@@ -776,6 +776,7 @@ bin_modules-$(CONFIG_KBD) += kbd
 bin_modules-$(CONFIG_ZSTD) += zstd
 bin_modules-$(CONFIG_E2FSPROGS) += e2fsprogs
 bin_modules-$(CONFIG_EXFATPROGS) += exfatprogs
+bin_modules-$(CONFIG_NVMUTIL) += nvmutil
 
 $(foreach m, $(bin_modules-y), \
 	$(call map,initrd_bin_add,$(call bins,$m)) \
@@ -800,6 +801,9 @@ ifeq ($(CONFIG_COREBOOT),y)
 $(eval $(call initrd_bin_add,$(COREBOOT_UTIL_DIR)/cbmem/cbmem))
 #$(eval $(call initrd_bin_add,$(COREBOOT_UTIL_DIR)/superiotool/superiotool))
 #$(eval $(call initrd_bin_add,$(COREBOOT_UTIL_DIR)/inteltool/inteltool))
+ifeq ($(CONFIG_IFDTOOL),y)
+$(eval $(call initrd_bin_add,$(COREBOOT_UTIL_DIR)/ifdtool/ifdtool))
+endif
 endif
 
 $(COREBOOT_UTIL_DIR)/cbmem/cbmem \
@@ -815,6 +819,11 @@ $(COREBOOT_UTIL_DIR)/superiotool/superiotool: \
 	$(build)/$(zlib_dir)/.build \
 	$(build)/$(pciutils_dir)/.build \
 
+$(COREBOOT_UTIL_DIR)/ifdtool/ifdtool: $(build)/$(coreboot_base_dir)/.canary musl-cross-make
+	+$(call do,MAKE,$(notdir $@),\
+		$(MAKE) -C "$(dir $@)" $(CROSS_TOOLS) \
+	)
+
 #
 # --- INITRD IMAGE CREATION ---
 #
diff --git a/boards/EOL_UNTESTED_t530-hotp-maximized/EOL_UNTESTED_t530-hotp-maximized.config b/boards/EOL_UNTESTED_t530-hotp-maximized/EOL_UNTESTED_t530-hotp-maximized.config
index 97852bc3d..fbc5cfd14 100644
--- a/boards/EOL_UNTESTED_t530-hotp-maximized/EOL_UNTESTED_t530-hotp-maximized.config
+++ b/boards/EOL_UNTESTED_t530-hotp-maximized/EOL_UNTESTED_t530-hotp-maximized.config
@@ -64,6 +64,10 @@ CONFIG_FBWHIPTAIL=y
 #SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
 #CONFIG_DROPBEAR=y
 
+#tools for mac-randomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 #Enable DEBUG output
 export CONFIG_DEBUG_OUTPUT=n
 export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=n
@@ -77,7 +81,8 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad T530-hotp-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
 
 #Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx30_me_blobs
diff --git a/boards/EOL_UNTESTED_t530-maximized/EOL_UNTESTED_t530-maximized.config b/boards/EOL_UNTESTED_t530-maximized/EOL_UNTESTED_t530-maximized.config
index 4fa736382..baa6d8440 100644
--- a/boards/EOL_UNTESTED_t530-maximized/EOL_UNTESTED_t530-maximized.config
+++ b/boards/EOL_UNTESTED_t530-maximized/EOL_UNTESTED_t530-maximized.config
@@ -63,6 +63,10 @@ CONFIG_FBWHIPTAIL=y
 #SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
 #CONFIG_DROPBEAR=y
 
+#tools for mac-randomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 #Enable DEBUG output
 export CONFIG_DEBUG_OUTPUT=n
 export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=n
@@ -76,7 +80,8 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad T530-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
 
 #Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx30_me_blobs
diff --git a/boards/EOL_m900_tower-hotp-maximized/EOL_m900_tower-hotp-maximized.config b/boards/EOL_m900_tower-hotp-maximized/EOL_m900_tower-hotp-maximized.config
index 5d7cbf034..91185191b 100644
--- a/boards/EOL_m900_tower-hotp-maximized/EOL_m900_tower-hotp-maximized.config
+++ b/boards/EOL_m900_tower-hotp-maximized/EOL_m900_tower-hotp-maximized.config
@@ -82,6 +82,10 @@ CONFIG_FBWHIPTAIL=y
 #SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
 #CONFIG_DROPBEAR=y
 
+#tools for mac-randomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 #Enable DEBUG output
 export CONFIG_DEBUG_OUTPUT=n
 export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=n
@@ -95,6 +99,7 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkcentre m900_tower-hotp-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
 
 BOARD_TARGETS := m900_me_blobs
diff --git a/boards/EOL_m900_tower-maximized/EOL_m900_tower-maximized.config b/boards/EOL_m900_tower-maximized/EOL_m900_tower-maximized.config
index 8eb16cb96..06118d467 100644
--- a/boards/EOL_m900_tower-maximized/EOL_m900_tower-maximized.config
+++ b/boards/EOL_m900_tower-maximized/EOL_m900_tower-maximized.config
@@ -80,6 +80,10 @@ CONFIG_FBWHIPTAIL=y
 #SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
 #CONFIG_DROPBEAR=y
 
+#tools for mac-randomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 #Enable DEBUG output
 export CONFIG_DEBUG_OUTPUT=n
 export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=n
@@ -93,6 +97,7 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkcentre m900_tower-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
 
 BOARD_TARGETS := m900_me_blobs
diff --git a/boards/EOL_optiplex-7010_9010-hotp-maximized/EOL_optiplex-7010_9010-hotp-maximized.config b/boards/EOL_optiplex-7010_9010-hotp-maximized/EOL_optiplex-7010_9010-hotp-maximized.config
index 5e4ccce60..7e020fefd 100644
--- a/boards/EOL_optiplex-7010_9010-hotp-maximized/EOL_optiplex-7010_9010-hotp-maximized.config
+++ b/boards/EOL_optiplex-7010_9010-hotp-maximized/EOL_optiplex-7010_9010-hotp-maximized.config
@@ -66,6 +66,10 @@ CONFIG_FBWHIPTAIL=y
 #SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
 #CONFIG_DROPBEAR=y
 
+#tools for mac-randomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 #Runtime configuration
 #Automatically boot if HOTP is valid
 export CONFIG_AUTO_BOOT_TIMEOUT=5
@@ -88,7 +92,8 @@ export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOOT_DEV="/dev/sda1"
 export CONFIG_BOARD_NAME="Dell Optiplex 7010/9010 HOTP maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
 
 #Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx30_me_blobs
diff --git a/boards/EOL_optiplex-7010_9010-maximized/EOL_optiplex-7010_9010-maximized.config b/boards/EOL_optiplex-7010_9010-maximized/EOL_optiplex-7010_9010-maximized.config
index d57983b68..8de72749f 100644
--- a/boards/EOL_optiplex-7010_9010-maximized/EOL_optiplex-7010_9010-maximized.config
+++ b/boards/EOL_optiplex-7010_9010-maximized/EOL_optiplex-7010_9010-maximized.config
@@ -66,6 +66,10 @@ CONFIG_FBWHIPTAIL=y
 #SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
 #CONFIG_DROPBEAR=y
 
+#tools for mac-randomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 #Runtime configuration
 #Automatically boot if HOTP is valid
 export CONFIG_AUTO_BOOT_TIMEOUT=5
@@ -88,7 +92,8 @@ export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOOT_DEV="/dev/sda1"
 export CONFIG_BOARD_NAME="Dell Optiplex 7010/9010 maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
 
 #Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx30_me_blobs
diff --git a/boards/EOL_optiplex-7010_9010_TXT-hotp-maximized/EOL_optiplex-7010_9010_TXT-hotp-maximized.config b/boards/EOL_optiplex-7010_9010_TXT-hotp-maximized/EOL_optiplex-7010_9010_TXT-hotp-maximized.config
index 5b9d2cfc9..6c6d931f1 100644
--- a/boards/EOL_optiplex-7010_9010_TXT-hotp-maximized/EOL_optiplex-7010_9010_TXT-hotp-maximized.config
+++ b/boards/EOL_optiplex-7010_9010_TXT-hotp-maximized/EOL_optiplex-7010_9010_TXT-hotp-maximized.config
@@ -66,6 +66,10 @@ CONFIG_FBWHIPTAIL=y
 #SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
 #CONFIG_DROPBEAR=y
 
+#tools for mac-randomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 #Runtime configuration
 #Automatically boot if HOTP is valid
 export CONFIG_AUTO_BOOT_TIMEOUT=5
@@ -88,7 +92,8 @@ export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOOT_DEV="/dev/sda1"
 export CONFIG_BOARD_NAME="Dell Optiplex 7010/9010 HOTP maximized (TXT enabled)"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
 
 #Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx30_me_blobs
diff --git a/boards/EOL_optiplex-7010_9010_TXT-maximized/EOL_optiplex-7010_9010_TXT-maximized.config b/boards/EOL_optiplex-7010_9010_TXT-maximized/EOL_optiplex-7010_9010_TXT-maximized.config
index 69154c329..32c79bc03 100644
--- a/boards/EOL_optiplex-7010_9010_TXT-maximized/EOL_optiplex-7010_9010_TXT-maximized.config
+++ b/boards/EOL_optiplex-7010_9010_TXT-maximized/EOL_optiplex-7010_9010_TXT-maximized.config
@@ -66,6 +66,10 @@ CONFIG_FBWHIPTAIL=y
 #SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
 #CONFIG_DROPBEAR=y
 
+#tools for mac-randomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 #Runtime configuration
 #Automatically boot if HOTP is valid
 export CONFIG_AUTO_BOOT_TIMEOUT=5
@@ -88,7 +92,8 @@ export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOOT_DEV="/dev/sda1"
 export CONFIG_BOARD_NAME="Dell Optiplex 7010/9010 maximized (TXT enabled)"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
 
 #Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx30_me_blobs
diff --git a/boards/EOL_t420-hotp-maximized/EOL_t420-hotp-maximized.config b/boards/EOL_t420-hotp-maximized/EOL_t420-hotp-maximized.config
index 8fd55401b..6decf2fca 100644
--- a/boards/EOL_t420-hotp-maximized/EOL_t420-hotp-maximized.config
+++ b/boards/EOL_t420-hotp-maximized/EOL_t420-hotp-maximized.config
@@ -11,7 +11,8 @@
 #
 # Doesn't include (to fit in 7mb image)
 # - dropbear
-
+# - ifdtool
+# - nvmutil
 export CONFIG_COREBOOT=y
 export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
@@ -67,6 +68,10 @@ CONFIG_FBWHIPTAIL=y
 #SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
 CONFIG_DROPBEAR=n
 
+#tools for mac-randomization
+export CONFIG_NVMUTIL=n
+export CONFIG_IFDTOOL=n
+
 #Enable DEBUG output
 export CONFIG_DEBUG_OUTPUT=n
 export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=n
@@ -80,7 +85,8 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="ThinkPad T420-hotp-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal:ich_spi_mode=hwseq"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal:ich_spi_mode=hwseq"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
 
 #Include bits related to sandybridge ME blob download/neutering down to BUP
 BOARD_TARGETS := xx20_me_blobs
diff --git a/boards/EOL_t420-maximized/EOL_t420-maximized.config b/boards/EOL_t420-maximized/EOL_t420-maximized.config
index 9442cc474..0c8cbbfbc 100644
--- a/boards/EOL_t420-maximized/EOL_t420-maximized.config
+++ b/boards/EOL_t420-maximized/EOL_t420-maximized.config
@@ -11,6 +11,8 @@
 #
 # Doesn't include (to fit in 7mb image)
 # - dropbear
+# - ifdtool
+# - nvmutil
 export CONFIG_COREBOOT=y
 export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
@@ -65,6 +67,10 @@ CONFIG_FBWHIPTAIL=y
 #SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
 CONFIG_DROPBEAR=n
 
+#tools for mac-randomization
+export CONFIG_NVMUTIL=n
+export CONFIG_IFDTOOL=n
+
 #Enable DEBUG output
 export CONFIG_DEBUG_OUTPUT=n
 export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=n
@@ -78,7 +84,8 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="ThinkPad T420-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal:ich_spi_mode=hwseq"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal:ich_spi_mode=hwseq"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
 
 #Include bits related to sandybridge ME blob download/neutering down to BUP
 BOARD_TARGETS := xx20_me_blobs
diff --git a/boards/EOL_t430-hotp-maximized/EOL_t430-hotp-maximized.config b/boards/EOL_t430-hotp-maximized/EOL_t430-hotp-maximized.config
index 14f7861b9..3c72b1cb9 100644
--- a/boards/EOL_t430-hotp-maximized/EOL_t430-hotp-maximized.config
+++ b/boards/EOL_t430-hotp-maximized/EOL_t430-hotp-maximized.config
@@ -62,6 +62,10 @@ CONFIG_FBWHIPTAIL=y
 #SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
 #CONFIG_DROPBEAR=y
 
+#tools for mac-randomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 #Enable DEBUG output
 export CONFIG_DEBUG_OUTPUT=n
 export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=n
@@ -75,7 +79,8 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad T430-hotp-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
 
 #Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx30_me_blobs
diff --git a/boards/EOL_t430-maximized/EOL_t430-maximized.config b/boards/EOL_t430-maximized/EOL_t430-maximized.config
index b885744bf..609998ff6 100644
--- a/boards/EOL_t430-maximized/EOL_t430-maximized.config
+++ b/boards/EOL_t430-maximized/EOL_t430-maximized.config
@@ -62,6 +62,10 @@ CONFIG_FBWHIPTAIL=y
 #SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
 #CONFIG_DROPBEAR=y
 
+#tools for mac-randomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 #Enable DEBUG output
 export CONFIG_DEBUG_OUTPUT=n
 export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=n
@@ -75,7 +79,8 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad T430-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
 
 #Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx30_me_blobs
diff --git a/boards/EOL_t440p-hotp-maximized/EOL_t440p-hotp-maximized.config b/boards/EOL_t440p-hotp-maximized/EOL_t440p-hotp-maximized.config
index 39379753a..c9b880646 100644
--- a/boards/EOL_t440p-hotp-maximized/EOL_t440p-hotp-maximized.config
+++ b/boards/EOL_t440p-hotp-maximized/EOL_t440p-hotp-maximized.config
@@ -37,6 +37,11 @@ CONFIG_FBWHIPTAIL=y
 CONFIG_LINUX_USB=y
 CONFIG_MOBILE_TETHERING=y
 
+#Additional tools:
+#tools for mac-randomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 export CONFIG_TPM=y
 #Enable DEBUG output
 export CONFIG_DEBUG_OUTPUT=n
@@ -49,7 +54,9 @@ export CONFIG_BOOTSCRIPT=/bin/gui-init.sh
 export CONFIG_BOOT_REQ_HASH=n
 export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOARD_NAME="ThinkPad T440p-hotp-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
+
 CONFIG_HOTPKEY=y
 export CONFIG_AUTO_BOOT_TIMEOUT=5
 
diff --git a/boards/EOL_t440p-maximized/EOL_t440p-maximized.config b/boards/EOL_t440p-maximized/EOL_t440p-maximized.config
index 82dde73bd..1f8338ddb 100644
--- a/boards/EOL_t440p-maximized/EOL_t440p-maximized.config
+++ b/boards/EOL_t440p-maximized/EOL_t440p-maximized.config
@@ -37,6 +37,11 @@ CONFIG_FBWHIPTAIL=y
 CONFIG_LINUX_USB=y
 CONFIG_MOBILE_TETHERING=y
 
+#Additional tools:
+#tools for mac-randomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 export CONFIG_TPM=y
 #Enable DEBUG output
 export CONFIG_DEBUG_OUTPUT=n
@@ -49,7 +54,8 @@ export CONFIG_BOOTSCRIPT=/bin/gui-init.sh
 export CONFIG_BOOT_REQ_HASH=n
 export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOARD_NAME="ThinkPad T440p-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
 
 # Make the Coreboot build depend on the following 3rd party blobs:
 $(build)/coreboot-$(CONFIG_COREBOOT_VERSION)/$(BOARD)/.build: $(pwd)/blobs/t440p/me.bin
diff --git a/boards/EOL_t480-hotp-maximized/EOL_t480-hotp-maximized.config b/boards/EOL_t480-hotp-maximized/EOL_t480-hotp-maximized.config
index 70befdc5e..99fe63258 100644
--- a/boards/EOL_t480-hotp-maximized/EOL_t480-hotp-maximized.config
+++ b/boards/EOL_t480-hotp-maximized/EOL_t480-hotp-maximized.config
@@ -69,6 +69,10 @@ CONFIG_FBWHIPTAIL=y
 #SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
 #CONFIG_DROPBEAR=y
 
+#tools for mac-randomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 #Runtime configuration
 #Automatically boot if HOTP is valid
 export CONFIG_AUTO_BOOT_TIMEOUT=5
@@ -89,6 +93,7 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad T480-hotp-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
 
 BOARD_TARGETS := t480_me_blobs
diff --git a/boards/EOL_t480-maximized/EOL_t480-maximized.config b/boards/EOL_t480-maximized/EOL_t480-maximized.config
index e7c4a50ce..2197567f4 100644
--- a/boards/EOL_t480-maximized/EOL_t480-maximized.config
+++ b/boards/EOL_t480-maximized/EOL_t480-maximized.config
@@ -69,6 +69,10 @@ CONFIG_FBWHIPTAIL=y
 #SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
 #CONFIG_DROPBEAR=y
 
+#tools for mac-randomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 #Runtime configuration
 #Automatically boot if HOTP is valid
 export CONFIG_AUTO_BOOT_TIMEOUT=5
@@ -89,6 +93,7 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad T480-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
 
 BOARD_TARGETS := t480_me_blobs
diff --git a/boards/EOL_t480s-hotp-maximized/EOL_t480s-hotp-maximized.config b/boards/EOL_t480s-hotp-maximized/EOL_t480s-hotp-maximized.config
index 4f933d15c..ab60a4c7f 100644
--- a/boards/EOL_t480s-hotp-maximized/EOL_t480s-hotp-maximized.config
+++ b/boards/EOL_t480s-hotp-maximized/EOL_t480s-hotp-maximized.config
@@ -69,6 +69,10 @@ CONFIG_FBWHIPTAIL=y
 #SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
 #CONFIG_DROPBEAR=y
 
+#tools for mac-randomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 #Runtime configuration
 #Automatically boot if HOTP is valid
 export CONFIG_AUTO_BOOT_TIMEOUT=5
@@ -89,6 +93,7 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad T480S-hotp-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
 
 BOARD_TARGETS := t480s_me_blobs
diff --git a/boards/EOL_t480s-maximized/EOL_t480s-maximized.config b/boards/EOL_t480s-maximized/EOL_t480s-maximized.config
index b1478cbc8..bd86e2418 100644
--- a/boards/EOL_t480s-maximized/EOL_t480s-maximized.config
+++ b/boards/EOL_t480s-maximized/EOL_t480s-maximized.config
@@ -69,6 +69,10 @@ CONFIG_FBWHIPTAIL=y
 #SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
 #CONFIG_DROPBEAR=y
 
+#tools for mac-randomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 #Runtime configuration
 #Automatically boot if HOTP is valid
 export CONFIG_AUTO_BOOT_TIMEOUT=5
@@ -89,6 +93,7 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad T480S-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
 
 BOARD_TARGETS := t480s_me_blobs
diff --git a/boards/EOL_w530-hotp-maximized/EOL_w530-hotp-maximized.config b/boards/EOL_w530-hotp-maximized/EOL_w530-hotp-maximized.config
index 21c3eef8d..f8f0e9961 100644
--- a/boards/EOL_w530-hotp-maximized/EOL_w530-hotp-maximized.config
+++ b/boards/EOL_w530-hotp-maximized/EOL_w530-hotp-maximized.config
@@ -64,6 +64,10 @@ CONFIG_FBWHIPTAIL=y
 #SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
 #CONFIG_DROPBEAR=y
 
+#tools for mac-randomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 #Enable DEBUG output
 export CONFIG_DEBUG_OUTPUT=n
 export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=n
@@ -77,7 +81,8 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad W530-hotp-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
 
 #Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx30_me_blobs
diff --git a/boards/EOL_w530-maximized/EOL_w530-maximized.config b/boards/EOL_w530-maximized/EOL_w530-maximized.config
index a5e77ea6c..845deb567 100644
--- a/boards/EOL_w530-maximized/EOL_w530-maximized.config
+++ b/boards/EOL_w530-maximized/EOL_w530-maximized.config
@@ -63,6 +63,10 @@ CONFIG_FBWHIPTAIL=y
 #SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
 #CONFIG_DROPBEAR=y
 
+#tools for mac-randomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 #Enable DEBUG output
 export CONFIG_DEBUG_OUTPUT=n
 export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=n
@@ -76,7 +80,8 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad W530-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
 
 #Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx30_me_blobs
diff --git a/boards/EOL_w541-hotp-maximized/EOL_w541-hotp-maximized.config b/boards/EOL_w541-hotp-maximized/EOL_w541-hotp-maximized.config
index f93d267cc..82a4756e7 100644
--- a/boards/EOL_w541-hotp-maximized/EOL_w541-hotp-maximized.config
+++ b/boards/EOL_w541-hotp-maximized/EOL_w541-hotp-maximized.config
@@ -38,6 +38,11 @@ CONFIG_FBWHIPTAIL=y
 CONFIG_LINUX_USB=y
 CONFIG_MOBILE_TETHERING=y
 
+#Additional tools:
+#tools for mac-randomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 export CONFIG_TPM=y
 #Enable DEBUG output
 export CONFIG_DEBUG_OUTPUT=n
@@ -50,7 +55,9 @@ export CONFIG_BOOTSCRIPT=/bin/gui-init.sh
 export CONFIG_BOOT_REQ_HASH=n
 export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOARD_NAME="ThinkPad W541-hotp-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
+
 CONFIG_HOTPKEY=y
 export CONFIG_AUTO_BOOT_TIMEOUT=5
 
diff --git a/boards/EOL_w541-maximized/EOL_w541-maximized.config b/boards/EOL_w541-maximized/EOL_w541-maximized.config
index 53a21174d..0a28d4a59 100644
--- a/boards/EOL_w541-maximized/EOL_w541-maximized.config
+++ b/boards/EOL_w541-maximized/EOL_w541-maximized.config
@@ -38,6 +38,11 @@ CONFIG_FBWHIPTAIL=y
 CONFIG_LINUX_USB=y
 CONFIG_MOBILE_TETHERING=y
 
+#Additional tools:
+#tools for mac-randomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 export CONFIG_TPM=y
 #Enable DEBUG output
 export CONFIG_DEBUG_OUTPUT=n
@@ -50,7 +55,8 @@ export CONFIG_BOOTSCRIPT=/bin/gui-init.sh
 export CONFIG_BOOT_REQ_HASH=n
 export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOARD_NAME="ThinkPad W541-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
 
 # Make the Coreboot build depend on the following 3rd party blobs:
 $(build)/coreboot-$(CONFIG_COREBOOT_VERSION)/$(BOARD)/.build: $(pwd)/blobs/w541/me.bin
diff --git a/boards/EOL_x220-hotp-maximized/EOL_x220-hotp-maximized.config b/boards/EOL_x220-hotp-maximized/EOL_x220-hotp-maximized.config
index 4fd0825cc..9b5daf5f9 100644
--- a/boards/EOL_x220-hotp-maximized/EOL_x220-hotp-maximized.config
+++ b/boards/EOL_x220-hotp-maximized/EOL_x220-hotp-maximized.config
@@ -11,7 +11,8 @@
 #
 # Doesn't include (to fit in 7mb image)
 # - dropbear
-
+# - ifdtool
+# - nvmutil
 export CONFIG_COREBOOT=y
 export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
@@ -67,6 +68,10 @@ CONFIG_FBWHIPTAIL=y
 #SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
 CONFIG_DROPBEAR=n
 
+#tools for mac-randomization
+export CONFIG_NVMUTIL=n
+export CONFIG_IFDTOOL=n
+
 #Enable DEBUG output
 export CONFIG_DEBUG_OUTPUT=n
 export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=n
@@ -80,7 +85,8 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="ThinkPad X220-hotp-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal:ich_spi_mode=hwseq"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal:ich_spi_mode=hwseq"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
 
 #Include bits related to sandybridge ME blob download/neutering down to BUP
 BOARD_TARGETS := xx20_me_blobs
diff --git a/boards/EOL_x220-maximized/EOL_x220-maximized.config b/boards/EOL_x220-maximized/EOL_x220-maximized.config
index fdc5da0df..0d1166ef5 100644
--- a/boards/EOL_x220-maximized/EOL_x220-maximized.config
+++ b/boards/EOL_x220-maximized/EOL_x220-maximized.config
@@ -11,7 +11,8 @@
 #
 # Doesn't include (to fit in 7mb image)
 # - dropbear
-
+# - ifdtool
+# - nvmutil
 export CONFIG_COREBOOT=y
 export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
@@ -66,6 +67,10 @@ CONFIG_FBWHIPTAIL=y
 #SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
 CONFIG_DROPBEAR=n
 
+#tools for mac-randomization
+export CONFIG_NVMUTIL=n
+export CONFIG_IFDTOOL=n
+
 #Enable DEBUG output
 export CONFIG_DEBUG_OUTPUT=n
 export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=n
@@ -79,7 +84,8 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="ThinkPad X220-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal:ich_spi_mode=hwseq"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal:ich_spi_mode=hwseq"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
 
 #Include bits related to sandybridge ME blob download/neutering down to BUP
 BOARD_TARGETS += xx20_me_blobs
diff --git a/boards/EOL_x230-hotp-maximized-fhd_edp/EOL_x230-hotp-maximized-fhd_edp.config b/boards/EOL_x230-hotp-maximized-fhd_edp/EOL_x230-hotp-maximized-fhd_edp.config
index 463839fd0..b8d11f411 100644
--- a/boards/EOL_x230-hotp-maximized-fhd_edp/EOL_x230-hotp-maximized-fhd_edp.config
+++ b/boards/EOL_x230-hotp-maximized-fhd_edp/EOL_x230-hotp-maximized-fhd_edp.config
@@ -76,6 +76,10 @@ CONFIG_FBWHIPTAIL=y
 #SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
 #CONFIG_DROPBEAR=y
 
+#tools for mac-randomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 #Enable DEBUG output
 export CONFIG_DEBUG_OUTPUT=n
 export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=n
@@ -89,7 +93,8 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad X230-hotp-maximized-eDP"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
 
 #Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx30_me_blobs
diff --git a/boards/EOL_x230-hotp-maximized/EOL_x230-hotp-maximized.config b/boards/EOL_x230-hotp-maximized/EOL_x230-hotp-maximized.config
index cb06d1899..eeea0ff47 100644
--- a/boards/EOL_x230-hotp-maximized/EOL_x230-hotp-maximized.config
+++ b/boards/EOL_x230-hotp-maximized/EOL_x230-hotp-maximized.config
@@ -66,6 +66,10 @@ CONFIG_FBWHIPTAIL=y
 #SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
 #CONFIG_DROPBEAR=y
 
+#tools for mac-randomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 #Runtime configuration
 #Automatically boot if HOTP is valid
 export CONFIG_AUTO_BOOT_TIMEOUT=5
@@ -87,7 +91,8 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad X230-hotp-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
 
 #Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx30_me_blobs
diff --git a/boards/EOL_x230-hotp-maximized_usb-kb/EOL_x230-hotp-maximized_usb-kb.config b/boards/EOL_x230-hotp-maximized_usb-kb/EOL_x230-hotp-maximized_usb-kb.config
index fff75bca8..d77ea13bd 100644
--- a/boards/EOL_x230-hotp-maximized_usb-kb/EOL_x230-hotp-maximized_usb-kb.config
+++ b/boards/EOL_x230-hotp-maximized_usb-kb/EOL_x230-hotp-maximized_usb-kb.config
@@ -68,6 +68,10 @@ CONFIG_FBWHIPTAIL=y
 #SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
 #CONFIG_DROPBEAR=y
 
+#tools for mac-randomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 #Enable DEBUG output
 export CONFIG_DEBUG_OUTPUT=n
 export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=n
@@ -81,7 +85,8 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad X230-hotp-maximized_usb-kb"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
 
 #Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx30_me_blobs
diff --git a/boards/EOL_x230-maximized-fhd_edp/EOL_x230-maximized-fhd_edp.config b/boards/EOL_x230-maximized-fhd_edp/EOL_x230-maximized-fhd_edp.config
index a7855c198..b8ebe2179 100644
--- a/boards/EOL_x230-maximized-fhd_edp/EOL_x230-maximized-fhd_edp.config
+++ b/boards/EOL_x230-maximized-fhd_edp/EOL_x230-maximized-fhd_edp.config
@@ -75,6 +75,10 @@ CONFIG_FBWHIPTAIL=y
 #SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
 #CONFIG_DROPBEAR=y
 
+#tools for mac-randomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 #Enable DEBUG output
 export CONFIG_DEBUG_OUTPUT=n
 export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=n
@@ -88,7 +92,8 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad X230-maximized-eDP"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
 
 #Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx30_me_blobs
diff --git a/boards/EOL_x230-maximized/EOL_x230-maximized.config b/boards/EOL_x230-maximized/EOL_x230-maximized.config
index f5edab489..38f60cc25 100644
--- a/boards/EOL_x230-maximized/EOL_x230-maximized.config
+++ b/boards/EOL_x230-maximized/EOL_x230-maximized.config
@@ -62,6 +62,10 @@ CONFIG_FBWHIPTAIL=y
 #SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
 #CONFIG_DROPBEAR=y
 
+#tools for mac-randomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 #Enable DEBUG output
 export CONFIG_DEBUG_OUTPUT=n
 export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=n
@@ -75,7 +79,8 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad X230-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
 
 #Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx30_me_blobs
diff --git a/boards/EOL_x280-hotp-maximized/EOL_x280-hotp-maximized.config b/boards/EOL_x280-hotp-maximized/EOL_x280-hotp-maximized.config
index c044a8b5f..de173b3c4 100644
--- a/boards/EOL_x280-hotp-maximized/EOL_x280-hotp-maximized.config
+++ b/boards/EOL_x280-hotp-maximized/EOL_x280-hotp-maximized.config
@@ -69,6 +69,10 @@ CONFIG_FBWHIPTAIL=y
 #SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
 #CONFIG_DROPBEAR=y
 
+#tools for mac-randomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 #Runtime configuration
 #Automatically boot if HOTP is valid
 export CONFIG_AUTO_BOOT_TIMEOUT=5
@@ -89,6 +93,7 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad X280-hotp-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
 
 BOARD_TARGETS := x280_me_blobs
diff --git a/boards/EOL_x280-maximized/EOL_x280-maximized.config b/boards/EOL_x280-maximized/EOL_x280-maximized.config
index 87e04b4ab..bcfd76040 100644
--- a/boards/EOL_x280-maximized/EOL_x280-maximized.config
+++ b/boards/EOL_x280-maximized/EOL_x280-maximized.config
@@ -75,6 +75,10 @@ CONFIG_FBWHIPTAIL=y
 #SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
 CONFIG_DROPBEAR=y
 
+#tools for mac-randomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 #Runtime configuration
 #Automatically boot if HOTP is valid
 export CONFIG_AUTO_BOOT_TIMEOUT=5
@@ -95,6 +99,7 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad X280-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
 
 BOARD_TARGETS := x280_me_blobs
diff --git a/boards/EOL_z220-cmt-hotp-maximized/EOL_z220-cmt-hotp-maximized.config b/boards/EOL_z220-cmt-hotp-maximized/EOL_z220-cmt-hotp-maximized.config
index 600df1a24..180b20f91 100644
--- a/boards/EOL_z220-cmt-hotp-maximized/EOL_z220-cmt-hotp-maximized.config
+++ b/boards/EOL_z220-cmt-hotp-maximized/EOL_z220-cmt-hotp-maximized.config
@@ -57,6 +57,11 @@ CONFIG_FBWHIPTAIL=y
 CONFIG_LINUX_USB=y
 CONFIG_MOBILE_TETHERING=y
 
+#Additional tools:
+#tools for mac-randomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 export CONFIG_TPM=y
 #Enable DEBUG output
 export CONFIG_DEBUG_OUTPUT=n
@@ -71,7 +76,9 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Hewlett-Packard Z220 Convertible Minitower (HOTP)"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
+
 CONFIG_HOTPKEY=y
 export CONFIG_AUTO_BOOT_TIMEOUT=5
 
diff --git a/boards/EOL_z220-cmt-maximized/EOL_z220-cmt-maximized.config b/boards/EOL_z220-cmt-maximized/EOL_z220-cmt-maximized.config
index 2f0d51c1f..df2dee0ad 100644
--- a/boards/EOL_z220-cmt-maximized/EOL_z220-cmt-maximized.config
+++ b/boards/EOL_z220-cmt-maximized/EOL_z220-cmt-maximized.config
@@ -57,6 +57,11 @@ CONFIG_FBWHIPTAIL=y
 CONFIG_LINUX_USB=y
 CONFIG_MOBILE_TETHERING=y
 
+#Additional tools:
+#tools for mac-randomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 export CONFIG_TPM=y
 #Enable DEBUG output
 export CONFIG_DEBUG_OUTPUT=n
@@ -71,7 +76,8 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Hewlett-Packard Z220 Convertible Minitower"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
 
 # Make the Coreboot build depend on the following 3rd party blobs:
 $(build)/coreboot-$(CONFIG_COREBOOT_VERSION)/$(BOARD)/.build: \
diff --git a/boards/novacustom-v540tu/novacustom-v540tu.config b/boards/novacustom-v540tu/novacustom-v540tu.config
index 8cf4e7628..572732744 100644
--- a/boards/novacustom-v540tu/novacustom-v540tu.config
+++ b/boards/novacustom-v540tu/novacustom-v540tu.config
@@ -68,6 +68,10 @@ CONFIG_FBWHIPTAIL=y
 #SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
 #CONFIG_DROPBEAR=y
 
+#tools for mac-randomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 #Runtime configuration
 #Automatically boot if HOTP is valid
 export CONFIG_AUTO_BOOT_TIMEOUT=5
@@ -89,4 +93,5 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="NovaCustom V540TU"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
diff --git a/boards/novacustom-v560tu/novacustom-v560tu.config b/boards/novacustom-v560tu/novacustom-v560tu.config
index 280c86018..ebd3f57fd 100644
--- a/boards/novacustom-v560tu/novacustom-v560tu.config
+++ b/boards/novacustom-v560tu/novacustom-v560tu.config
@@ -68,6 +68,10 @@ CONFIG_FBWHIPTAIL=y
 #SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
 #CONFIG_DROPBEAR=y
 
+#tools for mac-randomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 #Runtime configuration
 #Automatically boot if HOTP is valid
 export CONFIG_AUTO_BOOT_TIMEOUT=5
@@ -89,4 +93,5 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="NovaCustom V560TU"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"
+export CONFIG_FLASH_TOOL="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd -i bios -i me -i fd"
diff --git a/initrd/bin/flash.sh b/initrd/bin/flash.sh
index 716b4f050..047f41064 100755
--- a/initrd/bin/flash.sh
+++ b/initrd/bin/flash.sh
@@ -18,6 +18,32 @@ case "$CONFIG_FLASH_OPTIONS" in
   ;;
 esac
 
+# Adjust CONFIG_FLASH_OPTIONS depending on which function invoked this
+# script. The caller must set CHANGE_FLASH_OPTIONS, e.g:
+#   CHANGE_FLASH_OPTIONS=whole_spi flash.sh "$ROM"
+#   CHANGE_FLASH_OPTIONS=gbe_only flash.sh "$ROM"
+# In all other cases, leave CONFIG_FLASH_OPTIONS untouched.
+if [ -n "$CHANGE_FLASH_OPTIONS" ] && [ -z "$CONFIG_FLASH_TOOL" ]; then
+  DIE "ERROR: CONFIG_FLASH_TOOL is not set for board $CONFIG_BOARD!\n\nBoards enabling the ethernet MAC randomization feature (CONFIG_NVMUTIL / CONFIG_IFDTOOL) must define CONFIG_FLASH_TOOL, otherwise the flash command would be empty. Aborting."
+fi 
+
+case "$CHANGE_FLASH_OPTIONS" in
+  whole_spi )
+    DEBUG "flash.sh: called from show_mac()"
+    CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL}"
+  ;;
+  gbe_only )
+  DEBUG "flash.sh: called from mac_randomization(), adding gbe"
+    # --noverify-all: only verify the included (gbe) region, not the whole
+    # 32MB SPI, after writing. See flashprog(8): automatic verification after
+    # -w reads out the whole chip unless not-included regions are skipped.
+    CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_TOOL} --ifd --image gbe --noverify-all"
+  ;;
+  * )
+    : # no change
+  ;;
+esac
+
 flash_rom() {
   ROM=$1
   if [ "$READ" -eq 1 ]; then
diff --git a/initrd/bin/gui-init.sh b/initrd/bin/gui-init.sh
index ce03d953b..9fc4e6415 100755
--- a/initrd/bin/gui-init.sh
+++ b/initrd/bin/gui-init.sh
@@ -628,8 +628,7 @@ show_main_menu() {
 
 show_options_menu() {
 	TRACE_FUNC
-	whiptail_type $BG_COLOR_MAIN_MENU --title "$CONFIG_BRAND_NAME Options" \
-		--menu "" 0 80 10 \
+	local menu_options=(
 		'b' ' Boot Options -->' \
 		't' ' TPM/TOTP/HOTP Options -->' \
 		'i' ' Investigate integrity discrepancies -->' \
@@ -637,6 +636,13 @@ show_options_menu() {
 		'u' ' Update checksums and sign all files in /boot' \
 		'c' ' Change configuration settings -->' \
 		'f' ' Flash/Update the BIOS -->' \
+	)
+
+	if [ "$CONFIG_NVMUTIL" = "y" ] && [ "$CONFIG_IFDTOOL" = "y" ]; then
+	      menu_options+=('m' ' Ethernet MAC address randomization -->')
+	fi
+
+	menu_options+=(
 		'g' ' GPG Options -->' \
 		'F' ' OEM Factory Reset / Re-Ownership -->' \
 		'C' ' Reencrypt LUKS container -->' \
@@ -644,6 +650,11 @@ show_options_menu() {
 		'R' ' Check/Update file hashes on root disk -->' \
 		'x' ' Exit to recovery shell' \
 		'r' ' <-- Return to main menu' \
+	)
+
+	whiptail_type $BG_COLOR_MAIN_MENU --title "$CONFIG_BRAND_NAME Options" \
+		--menu "" 0 80 10 \
+		"${menu_options[@]}" \
 		2>/tmp/whiptail || recovery "GUI menu failed"
 
 	option=$(cat /tmp/whiptail)
@@ -669,6 +680,9 @@ show_options_menu() {
 	f)
 		flash-gui.sh
 		;;
+	m)
+		mac_randomization_options_menu
+		;;
 	g)
 		gpg-gui.sh
 		;;
@@ -905,6 +919,33 @@ force_unsafe_boot() {
 	fi
 }
 
+mac_randomization_options_menu() {
+	TRACE_FUNC
+	whiptail_type $BG_COLOR_MAIN_MENU --title "Ethernet MAC randomization" \
+		--menu "Select An Option" 0 80 10 \
+		'r' 'Generate a fully randomized ethernet MAC address' \
+		'i' 'Use a intel based universal pattern (OUI) to generate a random ethernet MAC address' \
+		's' 'Show the current ethernet MAC address' \
+		'm' ' <-- Return to main menu' \
+		2>/tmp/whiptail || recovery "GUI menu failed"
+
+	option=$(cat /tmp/whiptail)
+	case "$option" in
+	r)
+		change_mac "random"
+		;;
+	i)
+		change_mac "intel"
+		;;
+	s)
+		show_mac
+		clean_up_mac
+		;;
+	m) ;;
+
+	esac
+}
+
 # gui-init start
 TRACE_FUNC
 
diff --git a/initrd/etc/functions.sh b/initrd/etc/functions.sh
index 2f5f6a15e..1792ec9d9 100644
--- a/initrd/etc/functions.sh
+++ b/initrd/etc/functions.sh
@@ -3671,3 +3671,112 @@ _build_final_cmdline() {
 	echo "$_combined"
 }
 
+# Show current MAC address
+show_mac(){
+	TRACE_FUNC
+	
+	if [ "$CONFIG_IFDTOOL" = "y" ]; then
+
+		# read whole SPI-chip and save it to /tmp/$CONFIG_BOARD.rom
+		CHANGE_FLASH_OPTIONS=whole_spi /bin/flash.sh -r /tmp/${CONFIG_BOARD}.rom
+
+		# test if file is > 0 byte
+		if [ ! -s /tmp/${CONFIG_BOARD}.rom ]; then
+			whiptail_error --title 'ERROR' --msgbox "Unable to read BIOS" 0 80
+			recovery
+		fi
+	(
+		cd /tmp
+		# Extract GBE from ifdtool
+		ifdtool -x ${CONFIG_BOARD}.rom
+		if [ ! -s flashregion_3_gbe.bin ]; then
+			whiptail_error --title 'ERROR' --msgbox "Unable to extract gbe region" 0 80
+			recovery
+		fi
+
+		# Show just the current MAC, cut the rest
+		DUMP_OUTPUT=$(nvm flashregion_3_gbe.bin dump)
+		# Find the line that contains the MAC address and print
+		CURRENT_MAC=$(printf "%s\n" "$DUMP_OUTPUT" | sed -n 's/^MAC (part 0): //p')
+    		whiptail_type $BG_COLOR_MAIN_MENU --title "Show current MAC address" --msgbox "Current MAC address: $CURRENT_MAC" 0 80
+	)
+	else 		whiptail_error --title 'ERROR' --msgbox "Ifdtool is needed" 0 80
+	
+	fi
+	
+}
+
+change_mac() {
+	TRACE_FUNC
+
+	local mac_type="$1"
+
+	if [ "$CONFIG_IFDTOOL" = "y" ] && [ "$CONFIG_NVMUTIL" = "y" ]; then
+
+		show_mac
+
+		# Change MAC address randomly
+		# "nvmutil cannot specify multicast addresses"
+		# "nvmutil cannot specify 00:00:00:00:00:00"
+		# "randomly generated addresses are always unicast and local"
+		# See https://libreboot.org/docs/install/nvmutil.html
+
+		# Change MAC address randomly with intel OUI
+		# MAC Prefix: 00:1F:3B
+		# MAC Range: 00:1F:3B:00:00:00 - 00:1F:3B:FF:FF:FF
+		# See https://uic.io/en/mac/address/001f3b/
+		# There are a lot of prefixes from intel, this one is randomly picked
+
+		case "$mac_type" in
+			"random")
+				MAC_PATTERN="xx:xx:xx:xx:xx:xx"
+				;;
+			"intel")
+				MAC_PATTERN="00:1f:3b:xx:xx:xx"
+				;;
+			*)
+				return 0
+				;;
+		esac
+
+		# Set mac to users choice
+		nvm /tmp/flashregion_3_gbe.bin setmac "$MAC_PATTERN"
+
+		# Show MAC address to be flashed
+		NEWDUMP_OUTPUT=$(nvm /tmp/flashregion_3_gbe.bin dump)
+		# Find the line that contains the MAC address and print
+		CHANGED_MAC=$(printf "%s\n" "$NEWDUMP_OUTPUT" | sed -n 's/^MAC (part 0): //p')
+		whiptail_warning --title "Change ethernet MAC" --msgbox "New, modified ethernet MAC address to be flashed: $CHANGED_MAC" 0 80
+
+		# Decision: flash the new MAC address?
+		if whiptail_warning --title "Change ethernet MAC" --yesno "Do you really want to change the ethernet MAC address?" 0 80 --no-button "Do not change" --yes-button "Change"; then
+			# Insert modified GBE into ${CONFIG_BOARD}.rom
+			if ! ifdtool -i gbe:/tmp/flashregion_3_gbe.bin /tmp/${CONFIG_BOARD}.rom; then
+				whiptail_error --title "Error" --msgbox "Failed to insert modified GBE!" 0 80
+				recovery
+			fi
+
+			# Flash back modified GBE only
+			if  CHANGE_FLASH_OPTIONS=gbe_only /bin/flash.sh /tmp/${CONFIG_BOARD}.rom.new; then
+				whiptail_type $BG_COLOR_MAIN_MENU --title "Change ethernet MAC" --msgbox "Flashing completed successfully!" 0 80
+			else
+				whiptail_error --title "Error" --msgbox "Flashing FAILED!" 0 80
+				recovery
+			fi
+		else
+			whiptail_warning --title "Canceled" --msgbox "Ethernet MAC address change canceled." 0 80
+			clean_up_mac 
+		fi
+
+	else 
+		whiptail_error --title 'ERROR' --msgbox "Ifdtool and nvmutil is needed for mac randomization" 0 80
+		clean_up_mac
+	fi
+
+	clean_up_mac
+}
+
+clean_up_mac(){
+	# Don't leave temporary files lying around
+	rm -f /tmp/${CONFIG_BOARD}.* /tmp/flashregion_*.bin
+}
diff --git a/modules/nvmutil b/modules/nvmutil
new file mode 100644
index 000000000..570869bbe
--- /dev/null
+++ b/modules/nvmutil
@@ -0,0 +1,18 @@
+modules-$(CONFIG_NVMUTIL) += nvmutil
+
+nvmutil_version := 26.01rev1
+nvmutil_base_dir := lbmk
+nvmutil_dir := lbmk/util/nvmutil
+nvmutil_tar := $(nvmutil_version).tar.gz
+nvmutil_url := https://codeberg.org/libreboot/lbmk/archive/$(nvmutil_version).tar.gz
+nvmutil_hash := 05ad4171b211258afc4bc2211fac274566e63726016c735b9ca6742302488e3c
+
+
+nvmutil_configure :=
+nvmutil_target := \
+	$(MAKE_JOBS) \
+	$(CROSS_TOOLS) \
+	CFLAGS="$(CFLAGS) -Os -Wall -Wextra -std=c99 -pedantic"
+
+nvmutil_output := nvm
+nvmutil_depends := $(musl_dep)