diff --git a/package/czechlight-cfg-fs/Config.in b/package/czechlight-cfg-fs/Config.in
index c3c5a46..d44d14a 100644
--- a/package/czechlight-cfg-fs/Config.in
+++ b/package/czechlight-cfg-fs/Config.in
@@ -1,7 +1,11 @@
 config BR2_PACKAGE_CZECHLIGHT_CFG_FS
-	bool "Prepare the /cfg partition"
+	bool "Prepare persistent /cfg partition and /etc overlay"
+	depends on BR2_INIT_SYSTEMD
 	help
-	  This is required for RAUC to work properly.
+	  This is required for RAUC to work properly.  It creates a blank FS
+	  image, configures systemd to mount it, and ensures that its contents
+	  get restored to /etc at boot.  The /etc is set up as a RW overlay on
+	  top of a read-only rootfs.
 
 if BR2_PACKAGE_CZECHLIGHT_CFG_FS
 
diff --git a/package/czechlight-cfg-fs/cfg-restore-etc.service b/package/czechlight-cfg-fs/cfg-restore-etc.service
new file mode 100644
index 0000000..d735d99
--- /dev/null
+++ b/package/czechlight-cfg-fs/cfg-restore-etc.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=Restore /etc from the Persistent config
+DefaultDependencies=no
+Conflicts=umount.target
+Before=local-fs.target umount.target
+After=cfg.mount etc-overlay.service
+Requires=cfg.mount etc-overlay.service
+ConditionDirectoryNotEmpty=/cfg/etc
+
+[Service]
+Type=oneshot
+ExecStart=/bin/sh -c 'cp -a /cfg/etc/* /etc/'
diff --git a/package/czechlight-cfg-fs/czechlight-cfg-fs.mk b/package/czechlight-cfg-fs/czechlight-cfg-fs.mk
index 2409b82..6798e68 100644
--- a/package/czechlight-cfg-fs/czechlight-cfg-fs.mk
+++ b/package/czechlight-cfg-fs/czechlight-cfg-fs.mk
@@ -1,4 +1,3 @@
-CZECHLIGHT_CFG_FS_INSTALL_TARGET = NO
 CZECHLIGHT_CFG_FS_INSTALL_IMAGES = YES
 CZECHLIGHT_CFG_FS_DEPENDENCIES = host-e2fsprogs
 
@@ -13,4 +12,18 @@
 $(error CZECHLIGHT_CFG_FS_SIZE cannot be empty)
 endif
 
+define CZECHLIGHT_CFG_FS_INSTALL_TARGET_CMDS
+	$(INSTALL) -D -m 0644 \
+		$(BR2_EXTERNAL_CZECHLIGHT_PATH)/package/czechlight-cfg-fs/etc-overlay.service \
+		$(TARGET_DIR)/usr/lib/systemd/system/etc-overlay.service
+	ln -sf ../etc-overlay.service $(TARGET_DIR)/usr/lib/systemd/system/local-fs.target.wants/
+	$(INSTALL) -D -m 0755 \
+		$(BR2_EXTERNAL_CZECHLIGHT_PATH)/package/czechlight-cfg-fs/czechlight-cfg-mount-generator \
+		$(TARGET_DIR)/usr/lib/systemd/system-generators/czechlight-cfg-mount-generator
+	$(INSTALL) -D -m 0644 \
+		$(BR2_EXTERNAL_CZECHLIGHT_PATH)/package/czechlight-cfg-fs/cfg-restore-etc.service \
+		$(TARGET_DIR)/usr/lib/systemd/system/cfg-restore-etc.service
+	ln -sf ../cfg-restore-etc.service $(TARGET_DIR)/usr/lib/systemd/system/local-fs.target.wants/
+endef
+
 $(eval $(generic-package))
diff --git a/package/czechlight-cfg-fs/czechlight-cfg-mount-generator b/package/czechlight-cfg-fs/czechlight-cfg-mount-generator
new file mode 100755
index 0000000..3197722
--- /dev/null
+++ b/package/czechlight-cfg-fs/czechlight-cfg-mount-generator
@@ -0,0 +1,47 @@
+#!/bin/sh
+
+set -e
+
+if grep -q rauc.slot=A /proc/cmdline; then
+  RAUC_SLOT_NO=0
+  RAUC_SLOT_NAME=A
+elif grep -q rauc.slot=B /proc/cmdline; then
+  RAUC_SLOT_NO=1
+  RAUC_SLOT_NAME=B
+else
+  echo "Cannot determine active RAUC rootfs slot"
+  exit 1
+fi
+
+# sed magic:
+# 1) use `sed -n` so that we only print what's explicitly printed
+# 2) anchor the search between the "[slot.cfg.$RAUC_SLOT_NO]" and any other section
+# 3) look for a line beginning with "device="
+# 4) take stuff which is behind the "="
+# 5) print it
+DEVICE=$(sed -n "/\[slot\.cfg\.${RAUC_SLOT_NO}\]/,/\[.*\]/{/^device=/s/\(.*\)=\(.*\)/\\2/p}" /etc/rauc/system.conf)
+
+if [ x$DEVICE -eq x ]; then
+  echo "Cannot determine device for /cfg from RAUC"
+  exit 1
+fi
+
+if [ ! -b $DEVICE ]; then
+  echo "Device ${DEVICE} is not a block device"
+  exit 1
+fi
+
+cat > $1/cfg.mount <<EOF
+[Unit]
+Description=Persistent config (slot ${RAUC_SLOT_NAME})
+DefaultDependencies=no
+Conflicts=umount.target
+Before=local-fs.target umount.target
+After=swap.target
+
+[Mount]
+What=${DEVICE}
+Where=/cfg
+Type=auto
+Options=relatime,nosuid,nodev
+EOF
diff --git a/package/czechlight-cfg-fs/etc-overlay.service b/package/czechlight-cfg-fs/etc-overlay.service
new file mode 100644
index 0000000..625e72b
--- /dev/null
+++ b/package/czechlight-cfg-fs/etc-overlay.service
@@ -0,0 +1,18 @@
+[Unit]
+Description=Overlay filesystem over /etc
+DefaultDependencies=no
+Conflicts=umount.target
+Before=local-fs.target umount.target
+After=swap.target \x2eov.mount
+
+[Service]
+Type=oneshot
+ExecStart=/bin/mkdir /.ov/etc-u
+ExecStart=/bin/mkdir /.ov/etc-w
+# Moving /etc/machine-id. Cannot --move, we have to --bind.
+ExecStart=/bin/touch /.ov/etc-machine-id
+ExecStart=/bin/mount --bind /etc/machine-id /.ov/etc-machine-id
+ExecStart=/bin/umount /etc/machine-id
+ExecStart=/bin/mount overlay -t overlay /etc -olowerdir=/etc,upperdir=/.ov/etc-u,workdir=/.ov/etc-w
+ExecStart=/bin/mount --bind /.ov/etc-machine-id /etc/machine-id
+ExecStart=/bin/umount /.ov/etc-machine-id