diff --git a/.gitignore b/.gitignore
index e17ecc2bc42a3267f9e1a6060c6d2c27b0ab5312..a6637c35557856bce726c69c5a58f4e8ff57ac69 100644
--- a/.gitignore
+++ b/.gitignore
@@ -16,4 +16,6 @@ Session.vim
 .netrwhist
 *~
 
+cipd.gni
 last-update
+third_party/
diff --git a/cipd-update.sh b/cipd-update.sh
new file mode 100755
index 0000000000000000000000000000000000000000..01049bd5f9aeae3923468aa8683fc0fc55d0e57b
--- /dev/null
+++ b/cipd-update.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# Copyright 2018 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+set -ex
+
+readonly SCRIPT_ROOT="$(cd $(dirname ${BASH_SOURCE[0]} ) && pwd)"
+readonly FUCHSIA_ROOT="${SCRIPT_ROOT}/.."
+readonly BUILD_ROOT="${FUCHSIA_ROOT}/build"
+readonly BUILDTOOLS_DIR="${FUCHSIA_ROOT}/buildtools"
+readonly CIPD="${BUILDTOOLS_DIR}/cipd"
+
+INTERNAL_ACCESS=false
+if [[ "$(${CIPD} ls fuchsia_internal)" != "No matching packages." ]]; then
+  INTERNAL_ACCESS=true
+fi
+echo "internal_access = ${INTERNAL_ACCESS}" > "${SCRIPT_ROOT}/cipd.gni"
+
+declare -a ENSURE_FILES=("${SCRIPT_ROOT}/cipd.ensure")
+if $INTERNAL_ACCESS; then
+  ENSURE_FILES+=("${SCRIPT_ROOT}/cipd_internal.ensure")
+fi
+
+(sed '/^\$/!d' "${ENSURE_FILES[@]}" && sed '/^\$/d' "${ENSURE_FILES[@]}") |
+  ${CIPD} ensure -ensure-file - -root ${BUILD_ROOT} -log-level warning
diff --git a/cipd.ensure b/cipd.ensure
new file mode 100644
index 0000000000000000000000000000000000000000..455af147b0d78712570b9ade224ea044cb3a3a03
--- /dev/null
+++ b/cipd.ensure
@@ -0,0 +1,22 @@
+# Copyright 2018 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Note: changes to this file will require updating cipd.versions, which
+# can be done by running `./cipd ensure-file-resolve -ensure-file cipd.ensure`
+# from this directory.
+
+$ResolvedVersions cipd.versions
+
+# This tells CIPD to fix up manually deleted files.
+$ParanoidMode CheckPresence
+
+$VerifiedPlatform linux-amd64
+$VerifiedPlatform mac-amd64
+
+# Linux sysroot
+@Subdir third_party/sysroot/linux-x64
+fuchsia/sysroot/linux-amd64 git_revision:3a257b6f56d9f934e852c84c5b82f6c6b71a6182
+
+@Subdir third_party/sysroot/linux-arm64
+fuchsia/sysroot/linux-arm64 git_revision:3a257b6f56d9f934e852c84c5b82f6c6b71a6182
diff --git a/cipd.versions b/cipd.versions
new file mode 100644
index 0000000000000000000000000000000000000000..72979a86f9af077b27a756b1e4eaeb10ded5becc
--- /dev/null
+++ b/cipd.versions
@@ -0,0 +1,10 @@
+# This file is auto-generated by 'cipd ensure-file-resolve'.
+# Do not modify manually. All changes will be overwritten.
+
+fuchsia/sysroot/linux-amd64
+	git_revision:3a257b6f56d9f934e852c84c5b82f6c6b71a6182
+	IiFVaKmy2J6nGBAa91I2LqanvcDAUPjUpakpxSp4thEC
+
+fuchsia/sysroot/linux-arm64
+	git_revision:3a257b6f56d9f934e852c84c5b82f6c6b71a6182
+	dEnIcxu8ZQD2MwA1ZUK_SINW9z2kHtrsreAJ6lcD39UC
diff --git a/cipd_internal.ensure b/cipd_internal.ensure
new file mode 100644
index 0000000000000000000000000000000000000000..8e27530486f39fa4caa1a46e71f6bbb80c090a23
--- /dev/null
+++ b/cipd_internal.ensure
@@ -0,0 +1,5 @@
+# Copyright 2018 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+$ParanoidMode CheckPresence