diff --git a/src/cmd-buildextend-installer b/src/cmd-buildextend-installer
index 0047b2a847..458aa9482d 100755
--- a/src/cmd-buildextend-installer
+++ b/src/cmd-buildextend-installer
@@ -128,12 +128,11 @@ def generate_iso():
 
     tmpisofile = os.path.join(tmpdir, iso_name)
     img_metal_obj = buildmeta['images'].get('metal')
-    img_metal = None
-    if img_metal_obj is not None:
-        img_metal = os.path.join(builddir, img_metal_obj['path'])
-        img_src = img_metal
-    else:
-        img_src = os.path.join(builddir, buildmeta['images']['qemu']['path'])
+    if img_metal_obj is None:
+        raise Exception("ISO generation requires `metal` image")
+
+    img_metal = os.path.join(builddir, img_metal_obj['path'])
+    img_metal_checksum = img_metal_obj['sha256']
 
     # Find the directory under `/usr/lib/modules/<kver>` where the
     # kernel/initrd live. It will be the 2nd entity output by
@@ -171,8 +170,6 @@ def generate_iso():
     if is_fulliso:
         tmp_initramfs = os.path.join(tmpdir, 'initramfs')
 
-        if img_metal is None:
-            raise Exception("fulliso requires `metal` image")
         metal_dest_basename = os.path.basename(img_metal) + '.xz'
         metal_dest = os.path.join(tmpisoroot, metal_dest_basename)
         with open(metal_dest, 'wb') as f:
@@ -182,7 +179,7 @@ def generate_iso():
         # In the fulliso case, we copy the squashfs to the ISO root.
         print(f'Compressing squashfs with {squashfs_compression}')
         run_verbose(['/usr/lib/coreos-assembler/gf-mksquashfs',
-                    img_src, os.path.join(tmpisoroot, 'root.squashfs'), squashfs_compression])
+                    img_metal, os.path.join(tmpisoroot, 'root.squashfs'), squashfs_compression])
         # Just pad with NUL bytes for the ISO image.  We'll truncate the
         # padding off again when copying the PXE initrd.
         with open(tmp_initramfs, 'wb') as fdst:
@@ -195,15 +192,22 @@ def generate_iso():
     elif is_live:
         tmp_squashfs = os.path.join(tmpdir, 'root.squashfs')
         tmp_cpio = os.path.join(tmpdir, 'root.cpio')
+        tmp_osmet = os.path.join(tmpdir, 'osmet.bin')
         tmp_initramfs = os.path.join(tmpdir, 'initramfs')
 
+        print(f'Generating osmet file')
+        run_verbose(['/usr/lib/coreos-assembler/osmet-pack',
+                     img_metal, tmp_osmet, img_metal_checksum])
+
         print(f'Compressing squashfs with {squashfs_compression}')
         run_verbose(['/usr/lib/coreos-assembler/gf-mksquashfs',
-                     img_src, tmp_squashfs, squashfs_compression])
+                     img_metal, tmp_squashfs, squashfs_compression])
+        # create a CPIO layer which holds the root squashfs and osmet binary
+        cpio_input_files = [tmp_squashfs, tmp_osmet]
         run_verbose(['cpio', '-o', '-H', 'newc', '-R', 'root:root',
                 '--quiet', '--reproducible', '--force-local',
                 '-D', os.path.dirname(tmp_squashfs), '-O', tmp_cpio],
-                input=os.path.basename(tmp_squashfs).encode())
+                input=('\n'.join(cpio_input_files)).encode())
         # Compression is redundant but the kernel requires it
         run_verbose(['gzip', '-1', tmp_cpio])
 
@@ -223,7 +227,7 @@ def generate_iso():
 
     # Read and filter kernel arguments for substituting into ISO bootloader
     result = run_verbose(['/usr/lib/coreos-assembler/gf-get-kargs',
-            img_src], stdout=subprocess.PIPE, text=True)
+            img_metal], stdout=subprocess.PIPE, text=True)
     kargs_array = [karg for karg in result.stdout.split()
             if karg.split('=')[0] not in live_exclude_kargs]
     kargs_array.append(f"coreos.liveiso={volid}")
diff --git a/src/osmet-pack b/src/osmet-pack
new file mode 100755
index 0000000000..4f2b8f085b
--- /dev/null
+++ b/src/osmet-pack
@@ -0,0 +1,61 @@
+#!/bin/bash
+set -euo pipefail
+
+if [ ! -f /etc/cosa-supermin ]; then
+    dn=$(dirname "$0")
+    # shellcheck source=src/cmdlib.sh
+    . "${dn}"/cmdlib.sh
+
+    img_src=$1; shift
+    osmet_dest=$1; shift
+    checksum=$1; shift
+    coreinst=${1:-}
+
+    workdir=$(pwd)
+    TMPDIR=tmp/tmp-osmet-pack
+    rm -rf "${TMPDIR}"
+    mkdir -p "${TMPDIR}"
+
+    if [[ $img_src == *.gz || $img_src == *.xz ]]; then
+        img="$(basename "$img_src")"
+        fatal "Cannot pack osmet from $img; not an uncompressed image"
+    fi
+
+    set -- "${TMPDIR}/osmet.bin" "${checksum}"
+    if [ -n "${coreinst:-}" ]; then
+        cp "${coreinst}" "${TMPDIR}/coreos-installer"
+        set -- "$@" "${TMPDIR}/coreos-installer"
+    fi
+
+    runvm -drive "if=virtio,id=coreos,format=raw,readonly=on,file=${img_src}" -- \
+        /usr/lib/coreos-assembler/osmet-pack "$@"
+
+    mv "${TMPDIR}/osmet.bin" "${osmet_dest}"
+    rm -rf "${TMPDIR}"
+
+    exit 0
+fi
+
+# This runs inside supermin
+
+osmet_dest=$1; shift
+checksum=$1; shift
+coreinst=${1:-}
+
+set -x
+
+# we want /dev/disk symlinks for coreos-installer
+/usr/lib/systemd/systemd-udevd --daemon
+/usr/sbin/udevadm trigger --settle
+
+if [ -z "${coreinst}" ]; then
+    mkdir -p /sysroot
+    mount -o ro /dev/disk/by-label/root /sysroot
+    osname=$(ls /sysroot/ostree/deploy)
+    deploydir=$(find "/sysroot/ostree/deploy/$osname/deploy" -mindepth 1 -maxdepth 1 -type d)
+    coreinst=${deploydir}/usr/bin/coreos-installer
+fi
+
+RUST_BACKTRACE=1 "${coreinst}" osmet pack /dev/vda \
+    --checksum "${checksum}" \
+    --output "${osmet_dest}"