diff --git a/server/build_image.py b/server/build_image.py
index 854d389..262962f 100755
--- a/server/build_image.py
+++ b/server/build_image.py
@@ -68,28 +68,33 @@ FLAGS = parser.parse_args()
 
 class ImageBuilder(object):
 
-  _BASE_PACKAGES = [
+  _BASE_PACKAGES = {
     'devscripts',
     'nano',
     'iputils-ping',
     'linux-firmware',
-    'linux-firmware-nonfree',
     'ubuntu-minimal',
     'ubuntu-standard',
     'user-setup',
-  ]
+  }
 
-  _SUITES = [
+  _RELEASE_PACKAGES = {
+    'trusty': {
+      'linux-firmware-nonfree',
+    },
+  }
+
+  _SUITES = {
     '%(release)s',
     '%(release)s-updates',
-  ]
+  }
 
-  _SECTIONS = [
+  _SECTIONS = {
     'main',
     'restricted',
     'universe',
     'multiverse',
-  ]
+  }
 
   _DIVERSIONS = {
     '/sbin/initctl': '/bin/true',
@@ -229,7 +234,7 @@ class ImageBuilder(object):
         'apt-get',
         'install',
         '--assume-yes',
-        *self._BASE_PACKAGES,
+        *(self._BASE_PACKAGES | self._RELEASE_PACKAGES.get(self._release, set())),
         env=env)
 
   def _WriteVersion(self, chroot_path, timestamp):
diff --git a/server/module_lib/icon_lib.py b/server/module_lib/icon_lib.py
index f60691b..5d35da4 100644
--- a/server/module_lib/icon_lib.py
+++ b/server/module_lib/icon_lib.py
@@ -6,6 +6,13 @@ import subprocess
 import sys
 
 
+class Error(Exception):
+  pass
+
+class SubprocessFailure(Error):
+  pass
+
+
 class IconModule(object):
 
   def __init__(self, chroot_path):
@@ -13,7 +20,11 @@ class IconModule(object):
 
   def Exec(self, *args, **kwargs):
     print('+', args)
-    subprocess.check_call(args, **kwargs)
+    try:
+      subprocess.check_call(args, **kwargs)
+    except subprocess.CalledProcessError as e:
+      print('ERROR:', e)
+      raise SubprocessFailure(e)
 
   def ExecChroot(self, *args, **kwargs):
     self.Exec('chroot', self._chroot_path, *args, **kwargs)
diff --git a/server/modules/iconograph.py b/server/modules/iconograph.py
index e60045a..51b876a 100755
--- a/server/modules/iconograph.py
+++ b/server/modules/iconograph.py
@@ -34,7 +34,7 @@ FLAGS = parser.parse_args()
 def main():
   module = icon_lib.IconModule(FLAGS.chroot_path)
   module.InstallPackages(
-      'daemontools-run', 'genisoimage', 'git', 'python3-openssl',
+      'upstart', 'daemontools-run', 'genisoimage', 'git', 'python3-openssl',
       'python3-requests', 'python3-ws4py')
 
   os.makedirs(os.path.join(FLAGS.chroot_path, 'icon', 'config'), exist_ok=True)
diff --git a/server/modules/systemid.py b/server/modules/systemid.py
index 3e89b83..feba9a8 100755
--- a/server/modules/systemid.py
+++ b/server/modules/systemid.py
@@ -3,6 +3,8 @@
 import argparse
 import os
 
+import icon_lib
+
 
 parser = argparse.ArgumentParser(description='iconograph systemid')
 parser.add_argument(
@@ -14,10 +16,27 @@ FLAGS = parser.parse_args()
 
 
 def main():
+  module = icon_lib.IconModule(FLAGS.chroot_path)
+
   os.mkdir(os.path.join(FLAGS.chroot_path, 'systemid'))
 
-  init = os.path.join(FLAGS.chroot_path, 'etc', 'init', 'systemid.conf')
-  with open(init, 'w') as fh:
+  tool_path = os.path.join(FLAGS.chroot_path, 'icon', 'systemid')
+  os.makedirs(tool_path, exist_ok=True)
+
+  script = os.path.join(tool_path, 'startup.sh')
+  with open(script, 'w') as fh:
+    os.fchmod(fh.fileno(), 0o755)
+    fh.write("""\
+#!/bin/bash
+mount -o data=journal,noatime,sync LABEL=SYSTEMID /systemid
+. /systemid/systemid
+echo ${SYSTEMID} > /etc/hostname
+hostname --file /etc/hostname
+grep ${SYSTEMID} /etc/hosts >/dev/null || echo "127.0.2.1 ${SYSTEMID}" >> /etc/hosts
+""")
+
+  upstart = os.path.join(FLAGS.chroot_path, 'etc', 'init', 'systemid.conf')
+  with open(upstart, 'w') as fh:
     fh.write("""
 description "Mount /systemid"
 
@@ -27,15 +46,41 @@ task
 emits systemid-ready
 
 script
-  mount -o data=journal,noatime,sync LABEL=SYSTEMID /systemid
-  . /systemid/systemid
-  echo ${SYSTEMID} > /etc/hostname
-  hostname --file /etc/hostname
-  grep ${SYSTEMID} /etc/hosts >/dev/null || echo "127.0.2.1 ${SYSTEMID}" >> /etc/hosts
+  /icon/systemid/startup.sh
   initctl emit --no-wait systemid-ready
 end script
 """)
 
+  systemd = os.path.join(FLAGS.chroot_path, 'lib', 'systemd', 'system', 'systemid.service')
+  with open(systemd, 'w') as fh:
+    fh.write("""
+[Unit]
+Description=Mount /systemid and configure from it
+DefaultDependencies=no
+Conflicts=shutdown.target
+After=systemd-remount-fs.service
+Before=sysinit.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/icon/systemid/startup.sh
+
+[Install]
+WantedBy=sysinit.target
+""")
+  try:
+    module.ExecChroot(
+        'systemctl',
+        'unmask',
+        'systemid.service')
+    module.ExecChroot(
+        'systemctl',
+        'enable',
+        'systemid.service')
+  except icon_lib.SubprocessFailure:
+    # trusty backwards-compat
+    pass
 
 if __name__ == '__main__':
   main()