diff --git a/meta-security/classes/dm-verity-img.bbclass b/meta-security/classes/dm-verity-img.bbclass
index d809985..045c860 100644
--- a/meta-security/classes/dm-verity-img.bbclass
+++ b/meta-security/classes/dm-verity-img.bbclass
@@ -10,11 +10,22 @@
 # assure data integrity, the root hash must be stored in a trusted location
 # or cryptographically signed and verified.
 #
+# Optionally, we can store the hash data on a separate device or partition
+# for improved compartmentalization and ease of use/deployment.
+#
 # Usage:
 #     DM_VERITY_IMAGE = "core-image-full-cmdline" # or other image
 #     DM_VERITY_IMAGE_TYPE = "ext4" # or ext2, ext3 & btrfs
+#     DM_VERITY_SEPARATE_HASH = "1" # optional; store hash on separate dev
 #     IMAGE_CLASSES += "dm-verity-img"
 #
+# Using the GPT UUIDs specified in the standard can also be useful in that
+# they are displayed and translated in cfdisk output.
+#
+#     DM_VERITY_ROOT_GUID = <UUID for your architecture and root-fs>
+#     DM_VERITY_RHASH_GUID = <UUID for your architecture and verity-hash>
+# https://uapi-group.org/specifications/specs/discoverable_partitions_specification/
+
 # The resulting image can then be used to implement the device mapper block
 # integrity checking on the target device.
 
@@ -28,13 +39,23 @@
 # Define the hash block size to use in veritysetup.
 DM_VERITY_IMAGE_HASH_BLOCK_SIZE ?= "4096"
 
+# Should we store the hash data on a separate device/partition?
+DM_VERITY_SEPARATE_HASH ?= "0"
+
+# These are arch specific.  We could probably intelligently auto-assign these?
+# Take x86-64 values as defaults. No impact on functionality currently.
+# See SD_GPT_ROOT_X86_64 and SD_GPT_ROOT_X86_64_VERITY in the spec.
+# Note - these are passed directly to sgdisk so hyphens needed.
+DM_VERITY_ROOT_GUID ?= "4f68bce3-e8cd-4db1-96e7-fbcaf984b709"
+DM_VERITY_RHASH_GUID ?= "2c7357ed-ebd2-46d9-aec1-23d437ec2bf5"
+
 # Process the output from veritysetup and generate the corresponding .env
 # file. The output from veritysetup is not very machine-friendly so we need to
 # convert it to some better format. Let's drop the first line (doesn't contain
 # any useful info) and feed the rest to a script.
 process_verity() {
     local ENV="${STAGING_VERITY_DIR}/${IMAGE_BASENAME}.$TYPE.verity.env"
-    install -d ${STAGING_VERITY_DIR}
+    local WKS_INC="${STAGING_VERITY_DIR}/${IMAGE_BASENAME}.$TYPE.wks.in"
     rm -f $ENV
 
     # Each line contains a key and a value string delimited by ':'. Read the
@@ -51,6 +72,43 @@
 
     # Add partition size
     echo "DATA_SIZE=$SIZE" >> $ENV
+
+    # Add whether we are storing the hash data separately
+    echo "SEPARATE_HASH=${DM_VERITY_SEPARATE_HASH}" >> $ENV
+
+    # Configured for single partition use of veritysetup?  OK, we are done.
+    if [ ${DM_VERITY_SEPARATE_HASH} -eq 0 ]; then
+        return
+    fi
+
+    # Craft up the UUIDs that are part of the verity standard for root & hash
+    # while we are here and in shell.  Re-read our output to get ROOT_HASH
+    # and then cut it in 1/2 ; HI for data UUID and LO for hash-data UUID.
+    # https://uapi-group.org/specifications/specs/discoverable_partitions_specification/
+
+    ROOT_HASH=$(cat $ENV | grep ^ROOT_HASH | sed 's/ROOT_HASH=//' | tr a-f A-F)
+    ROOT_HI=$(echo "obase=16;ibase=16;$ROOT_HASH/2^80" | /usr/bin/bc)
+    ROOT_LO=$(echo "obase=16;ibase=16;$ROOT_HASH%2^80" | /usr/bin/bc)
+
+    # Hyphenate as per UUID spec and as expected by wic+sgdisk parameters.
+    # Prefix with leading zeros, in case hash chunks weren't using highest bits
+    # "bc" needs upper case, /dev/disk/by-partuuid/ is lower case. <sigh>
+    ROOT_UUID=$(echo 00000000$ROOT_HI | sed 's/.*\(.\{32\}\)$/\1/' | \
+        sed 's/./-&/9;s/./-&/14;s/./-&/19;s/./-&/24' | tr A-F a-f )
+    RHASH_UUID=$(echo 00000000$ROOT_LO | sed 's/.*\(.\{32\}\)$/\1/' | \
+        sed 's/./-&/9;s/./-&/14;s/./-&/19;s/./-&/24' | tr A-F a-f )
+
+    # Emit the values needed for a veritysetup run in the initramfs
+    echo "ROOT_UUID=$ROOT_UUID" >> $ENV
+    echo "RHASH_UUID=$RHASH_UUID" >> $ENV
+
+    # Create wks.in fragment with build specific UUIDs for partitions.
+    # Unfortunately the wks.in does not support line continuations...
+    # First, the unappended filesystem data partition.
+    echo 'part / --source rawcopy --ondisk sda --sourceparams="file=${IMGDEPLOYDIR}/${DM_VERITY_IMAGE}-${MACHINE}.${DM_VERITY_IMAGE_TYPE}.verity" --part-name verityroot --part-type="${DM_VERITY_ROOT_GUID}"'" --uuid=\"$ROOT_UUID\"" > $WKS_INC
+
+    # note: no default mount point for hash data partition
+    echo 'part --source rawcopy --ondisk sda --sourceparams="file=${IMGDEPLOYDIR}/${DM_VERITY_IMAGE}-${MACHINE}.${DM_VERITY_IMAGE_TYPE}.vhash" --part-name verityhash --part-type="${DM_VERITY_RHASH_GUID}"'" --uuid=\"$RHASH_UUID\"" >> $WKS_INC
 }
 
 verity_setup() {
@@ -58,6 +116,12 @@
     local INPUT=${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.$TYPE
     local SIZE=$(stat --printf="%s" $INPUT)
     local OUTPUT=$INPUT.verity
+    local OUTPUT_HASH=$INPUT.verity
+    local HASH_OFFSET=""
+    local SETUP_ARGS=""
+    local SAVED_ARGS="${STAGING_VERITY_DIR}/${IMAGE_BASENAME}.$TYPE.verity.args"
+
+    install -d ${STAGING_VERITY_DIR}
 
     if [ ${DM_VERITY_IMAGE_DATA_BLOCK_SIZE} -ge ${DM_VERITY_IMAGE_HASH_BLOCK_SIZE} ]; then
         align=${DM_VERITY_IMAGE_DATA_BLOCK_SIZE}
@@ -66,11 +130,33 @@
     fi
     SIZE=$(expr \( $SIZE + $align - 1 \) / $align \* $align)
 
+    # Assume some users may want separate hash vs. appended hash
+    if [ ${DM_VERITY_SEPARATE_HASH} -eq 1 ]; then
+        OUTPUT_HASH=$INPUT.vhash
+    else
+        HASH_OFFSET="--hash-offset="$SIZE
+    fi
+
     cp -a $INPUT $OUTPUT
 
+    SETUP_ARGS=" \
+        --data-block-size=${DM_VERITY_IMAGE_DATA_BLOCK_SIZE} \
+        --hash-block-size=${DM_VERITY_IMAGE_HASH_BLOCK_SIZE} \
+        $HASH_OFFSET format $OUTPUT $OUTPUT_HASH \
+    "
+
+    echo "veritysetup $SETUP_ARGS" > $SAVED_ARGS
+
     # Let's drop the first line of output (doesn't contain any useful info)
     # and feed the rest to another function.
-    veritysetup --data-block-size=${DM_VERITY_IMAGE_DATA_BLOCK_SIZE} --hash-block-size=${DM_VERITY_IMAGE_HASH_BLOCK_SIZE} --hash-offset=$SIZE format $OUTPUT $OUTPUT | tail -n +2 | process_verity
+    veritysetup $SETUP_ARGS | tail -n +2 | process_verity
+}
+
+# make "dateless" symlink for the hash so the wks can find it.
+verity_hash() {
+    cd ${IMGDEPLOYDIR}
+    ln -sf ${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.${DM_VERITY_IMAGE_TYPE}.vhash \
+        ${IMAGE_BASENAME}-${MACHINE}.${DM_VERITY_IMAGE_TYPE}.vhash
 }
 
 VERITY_TYPES = " \
@@ -83,10 +169,12 @@
 CONVERSIONTYPES += "verity"
 CONVERSION_CMD:verity = "verity_setup ${type}"
 CONVERSION_DEPENDS_verity = "cryptsetup-native"
+IMAGE_CMD:vhash = "verity_hash"
 
 python __anonymous() {
     verity_image = d.getVar('DM_VERITY_IMAGE')
     verity_type = d.getVar('DM_VERITY_IMAGE_TYPE')
+    verity_hash = d.getVar('DM_VERITY_SEPARATE_HASH')
     image_fstypes = d.getVar('IMAGE_FSTYPES')
     pn = d.getVar('PN')
 
@@ -101,6 +189,8 @@
         bb.fatal('DM_VERITY_IMAGE_TYPE must contain exactly one type')
 
     d.appendVar('IMAGE_FSTYPES', ' %s.verity' % verity_type)
+    if verity_hash == "1":
+        d.appendVar('IMAGE_FSTYPES', ' vhash')
 
     # If we're using wic: we'll have to use partition images and not the rootfs
     # source plugin so add the appropriate dependency.