diff --git a/debian/changelog b/debian/changelog
new file mode 100644
index 0000000..cbe63a4
--- /dev/null
+++ b/debian/changelog
@@ -0,0 +1,5 @@
+runonce (0.1) UNRELEASED; urgency=medium
+
+  * Initial release.
+
+ -- AIY Projects <support-aiyprojects@google.com>  Fri, 04 Jan 2019 15:15:00 -0800
diff --git a/debian/compat b/debian/compat
new file mode 100644
index 0000000..f599e28
--- /dev/null
+++ b/debian/compat
@@ -0,0 +1 @@
+10
diff --git a/debian/control b/debian/control
new file mode 100644
index 0000000..073cf07
--- /dev/null
+++ b/debian/control
@@ -0,0 +1,20 @@
+Source: runonce
+Maintainer: AIY Projects <support-aiyprojects@google.com>
+Build-Depends: debhelper
+Section: misc
+Priority: optional
+
+Package: runonce
+Section: misc
+Priority: optional
+Architecture: all
+Depends: ${misc:Depends}
+Description: Performs initial system setup work
+ This package contains the initial "run once" systemd service that performs
+ initial startup work such as resizing the root filesystem to match the emmc
+ size, adding in known users, enabling services that users will likely want by
+ default, and other housekeeping behaviors (such as forcing a regeneration of
+ ssh host keys).
+ .
+ This package is mostly empty, save for the runonce systemd service, so
+ removing it should have little effect on a running system.
diff --git a/debian/copyright b/debian/copyright
new file mode 100644
index 0000000..97bcf5a
--- /dev/null
+++ b/debian/copyright
@@ -0,0 +1,7 @@
+Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: runonce
+Source: https://aiyprojects.googlesource.com/runonce
+
+Files: *
+Copyright: Copyright 2019 Google, LLC <support-aiyprojects@google.com>
+License: Apache-2.0
diff --git a/debian/dirs b/debian/dirs
new file mode 100644
index 0000000..e185240
--- /dev/null
+++ b/debian/dirs
@@ -0,0 +1,2 @@
+etc/runonce.d
+var/cache/runonce
diff --git a/debian/rules b/debian/rules
new file mode 100755
index 0000000..522626d
--- /dev/null
+++ b/debian/rules
@@ -0,0 +1,11 @@
+#!/usr/bin/make -f
+# -*- makefile -*-
+
+%:
+	dh $@ --with systemd
+
+override_dh_systemd_enable:
+	dh_systemd_enable --name=runonce
+
+override_dh_systemd_start:
+	dh_systemd_start --no-start
diff --git a/debian/runonce.install b/debian/runonce.install
new file mode 100644
index 0000000..4e66675
--- /dev/null
+++ b/debian/runonce.install
@@ -0,0 +1,2 @@
+usr /
+etc /
diff --git a/debian/runonce.service b/debian/runonce.service
new file mode 100644
index 0000000..0187236
--- /dev/null
+++ b/debian/runonce.service
@@ -0,0 +1,13 @@
+[Unit]
+Description=Scripts that should be run only once
+Before=basic.target network-pre.target
+After=sysinit.target local-fs.target
+DefaultDependencies=no
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/sbin/runonce
+
+[Install]
+WantedBy=basic.target
diff --git a/usr/sbin/runonce b/usr/sbin/runonce
new file mode 100755
index 0000000..bd1c0ae
--- /dev/null
+++ b/usr/sbin/runonce
@@ -0,0 +1,42 @@
+#!/bin/bash
+
+# Given a script and it's content SHA-1, determine if it should run based upon
+# whether its content has changed.
+#
+# Returns 0 if the script should run, other values indicate it should not run.
+#
+function should-run-script {
+    local script="$1"; shift
+    local script_sha1="$1"; shift
+    
+    if [[ -f /var/cache/runonce/$fname ]]; then
+        previous_sha1=$(cat /var/cache/runonce/$fname)
+
+        if [[ $script_sha1 == $previous_sha1 ]]; then
+            return 1
+        fi
+    fi
+
+    return 0
+}
+
+function main {
+    local script=""
+
+    for script in /etc/runonce.d/*; do
+        local script_sha1=$(sha1sum $script |awk '{ print $1 }')
+
+        if ! should-run-script $script $script_sha1; then
+            continue;
+        fi
+
+        $script
+
+        if [[ $? == 0 ]]; then
+            local fname=$(basename $script)
+            echo $script_sha1 > /var/cache/runonce/$fname
+        fi
+    done
+}
+
+main