diff --git a/Makefile b/Makefile
index a4588c393..0859c37c6 100644
--- a/Makefile
+++ b/Makefile
@@ -17,7 +17,7 @@ COMMON_ARGS += --platform=$(PLATFORM)
 empty :=
 space = $(empty) $(empty)
 
-TARGETS =  ca-certificates  cni  containerd cryptsetup dosfstools  eudev  fhs  grub ipmitool  iptables ipxe kernel  kmod  libaio libjson-c liblzma libpopt libressl  libseccomp  linux-firmware lvm2  musl  open-iscsi  open-isns raspberrypi-firmware runc  socat  syslinux u-boot  util-linux  xfsprogs
+TARGETS =  ca-certificates  cni  containerd imgcrypt  cryptsetup dosfstools  eudev  fhs  grub ipmitool  iptables ipxe kernel  kmod  libaio libjson-c liblzma libpopt libressl  libseccomp  linux-firmware lvm2  musl  open-iscsi  open-isns raspberrypi-firmware runc  socat  syslinux u-boot  util-linux  xfsprogs
 
 all: $(TARGETS) ## Builds all known pkgs.
 
diff --git a/imgcrypt/pkg.yaml b/imgcrypt/pkg.yaml
new file mode 100644
index 000000000..cca4cf934
--- /dev/null
+++ b/imgcrypt/pkg.yaml
@@ -0,0 +1,31 @@
+name: imgcrypt
+variant: scratch
+shell: /toolchain/bin/bash
+dependencies:
+  - stage: base
+  - stage: ca-certificates
+steps:
+  - sources:
+        # sync with version and revision in build
+      - url: https://github.com/containerd/imgcrypt/archive/refs/tags/v1.1.1.tar.gz
+        destination: imgcrypt.tar.gz
+        sha256: 13ec4d41e870ac8e3d2ec407bc8694379a8cd4b81c958f61f6f24efd7df88c64
+        sha512: 626e2689c1b3efbc81d2697a83b985f92a8adb08eae8547a7f45d39a46b1bd4d020adb0728bec86fcffd29602ef38547a8d4f1441e1437ec04e8b5964821adcd
+    env:
+      GOPATH: /go
+    prepare:
+      - |
+        mkdir -p ${GOPATH}/src/
+        tar -xzf imgcrypt.tar.gz --strip-components=1 -C ${GOPATH}/src/
+    build:
+      - |
+        export PATH=${PATH}:${TOOLCHAIN}/go/bin
+        cd ${GOPATH}/src/
+        make bin/ctd-decoder VERSION=v1.1.1
+    install:
+      - |
+        mkdir -p /rootfs/bin
+        mv ${GOPATH}/src/bin/ctd-decoder /rootfs/bin
+finalize:
+  - from: /rootfs
+    to: /