diff --git a/.gitignore b/.gitignore
index e160c08..94bde07 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,3 +7,4 @@ raspi*.sha256
 raspi_0w.yaml
 raspi_2.yaml
 raspi_3.yaml
+raspi_4.yaml
diff --git a/Makefile b/Makefile
index 0677a75..1e14008 100644
--- a/Makefile
+++ b/Makefile
@@ -1,9 +1,14 @@
 all: shasums
 
-shasums: raspi_0w.sha256 raspi_2.sha256 raspi_3.sha256 raspi_0w.xz.sha256 raspi_2.xz.sha256 raspi_3.xz.sha256
-xzimages: raspi_0w.img.xz raspi_2.img.xz raspi_3.img.xz
-images: raspi_0w.img raspi_2.img raspi_3.img
-yaml: raspi_0w.yaml raspi_2.yaml raspi_3.yaml
+# List all the supported and built Pi platforms here. They get expanded
+# to names like 'raspi_2.yaml' and 'raspi_0w.img.xz'.
+BUILD_PLATFORMS := 0w 2 3 4
+
+platforms := $(addprefix raspi_,$(BUILD_PLATFORMS))
+shasums: $(addsuffix .sha256,$(platforms)) $(addsuffix .xz.sha256,$(platforms))
+xzimages: $(addsuffix .img.xz,$(platforms))
+images: $(addsuffix .img,$(platforms))
+yaml: $(addsuffix .yaml,$(platforms))
 
 raspi_0w.yaml: raspi_master.yaml
 	cat raspi_master.yaml | sed "s/__ARCH__/armel/" | \
@@ -29,6 +34,18 @@ raspi_3.yaml: raspi_master.yaml
 	sed "s/__OTHER_APT_ENABLE__//" |\
 	sed "s/__HOST__/rpi3/" > $@
 
+raspi_4.yaml: raspi_master.yaml
+	cat raspi_master.yaml | sed "s/__ARCH__/arm64/" | \
+	sed "s#raspi3-firmware#raspi3-firmware/unstable#" | \
+	sed "s#apt-get update#echo 'APT::Default-Release \"stable\";' > /etc/apt/apt.conf\n      apt-get update#" | \
+	sed "s#cmdline.txt#cmdline.txt\n      sed -i 's/cma=64M //' /boot/firmware/cmdline.txt\n      sed -i 's/cma=\\\$$CMA //' /etc/kernel/postinst.d/z50-raspi-firmware#" | \
+	sed "s/__LINUX_IMAGE__/linux-image-arm64\/unstable/" | \
+	sed "s/__EXTRA_PKGS__/- firmware-brcm80211/" | \
+	sed "s/__DTB__/\\/usr\\/lib\\/linux-image-*-arm64\\/broadcom\\/bcm*rpi*.dtb/" |\
+	sed "s/__OTHER_APT_ENABLE__/deb http:\/\/deb.debian.org\/debian\/ unstable main contrib non-free # raspi 4 needs the latest kernel (5.5 or higher) and raspi-firmware newer than buster's/" |\
+	sed "s#hostname\"#hostname\"\n      wget https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/plain/brcm/brcmfmac43455-sdio.raspberrypi,4-model-b.txt -P \"\\\$${ROOT?}/lib/firmware/brcm\"#" |\
+	sed "s/__HOST__/rpi4/" > $@
+
 %.sha256: %.img.xz
 	echo $@
 	sha256sum $(@:sha256=img) > $@
@@ -49,17 +66,17 @@ _ck_root:
 	[ `whoami` = 'root' ] # Only root can summon vmdb2 ☹
 
 _clean_yaml:
-	rm -f raspi_0w.yaml raspi_2.yaml raspi_3.yaml
+	rm -f $(addsuffix .yaml,$(platforms))
 _clean_images:
-	rm -f raspi_0w.img raspi_2.img raspi_3.img
+	rm -f $(addsuffix .img,$(platforms))
 _clean_xzimages:
-	rm -f raspi_0w.img.xz raspi_2.img.xz raspi_3.img.xz
+	rm -f $(addsuffix .img.xz,$(platforms))
 _clean_shasums:
-	rm -f raspi_0w.sha256 raspi_2.sha256 raspi_3.sha256 raspi_0w.xz.sha256 raspi_2.xz.sha256 raspi_3.xz.sha256
+	rm -f $(addsuffix .sha256,$(platforms)) $(addsuffix .xz.sha256,$(platforms))
 _clean_logs:
-	rm -f raspi_0w.log raspi_2.log raspi_3.log
+	rm -f $(addsuffix .log,$(platforms))
 _clean_tarballs:
-	rm -f raspi_0w.tar.gz raspi_2.tar.gz raspi_3.tar.gz
+	rm -f $(addsuffix .tar.gz,$(platforms))
 clean: _clean_xzimages _clean_images _clean_shasums _clean_yaml _clean_tarballs _clean_logs
 
 .PHONY: _ck_root _build_img clean _clean_images _clean_yaml _clean_tarballs _clean_logs
diff --git a/eth0 b/eth0
index 910e081..bd9102f 100644
--- a/eth0
+++ b/eth0
@@ -3,5 +3,5 @@ auto eth0
 # TODO: switch back to iptables-persistent once it re-enters testing
 iface eth0 inet dhcp
 # We don't currently support setup of firewalls here.
-#	pre-up iptables-restore < /etc/iptables/rules.v4
-#	pre-up ip6tables-restore < /etc/iptables/rules.v6
+#	pre-up iptables-restore < /etc/iptables/rules.v4 || true
+#	pre-up ip6tables-restore < /etc/iptables/rules.v6 || ture