diff --git a/meta-phosphor/recipes-core/dropbear/dropbear/dropbear-migrate-key-location.service b/meta-phosphor/recipes-core/dropbear/dropbear/dropbear-migrate-key-location.service
new file mode 100644
index 0000000..f8c12bf
--- /dev/null
+++ b/meta-phosphor/recipes-core/dropbear/dropbear/dropbear-migrate-key-location.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=Migrate dropbear keys from /var/lib to /etc
+Before=dropbearkey.service
+ConditionPathExists=/var/lib/dropbear/dropbear_rsa_host_key
+
+[Service]
+RemainAfterExit=yes
+Type=oneshot
+ExecStart=/usr/libexec/dropbear/migrate-key-location
+
+[Install]
+WantedBy=dropbearkey.service
diff --git a/meta-phosphor/recipes-core/dropbear/dropbear/migrate-key-location b/meta-phosphor/recipes-core/dropbear/dropbear/migrate-key-location
new file mode 100644
index 0000000..ce96894
--- /dev/null
+++ b/meta-phosphor/recipes-core/dropbear/dropbear/migrate-key-location
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+if [ ! -e /etc/dropbear/dropbear_rsa_host_key ]; then
+    if [ -e /var/lib/dropbear/dropbear_rsa_host_key ]; then
+        echo "Migrating Dropbear key from /var/lib to /etc."
+        mkdir -p /etc/dropbear
+        mv /var/lib/dropbear/dropbear_rsa_host_key /etc/dropbear
+    else
+        echo "No Dropbear key found in /var/lib."
+    fi
+fi
diff --git a/meta-phosphor/recipes-core/dropbear/dropbear_%.bbappend b/meta-phosphor/recipes-core/dropbear/dropbear_%.bbappend
index a3cbd1b..6448fbf 100644
--- a/meta-phosphor/recipes-core/dropbear/dropbear_%.bbappend
+++ b/meta-phosphor/recipes-core/dropbear/dropbear_%.bbappend
@@ -6,8 +6,21 @@
 SRC_URI += "file://dropbearkey.service \
             file://localoptions.h \
             file://dropbear.default \
+            file://dropbear-migrate-key-location.service \
+            file://migrate-key-location \
            "
 
 # pull in OpenSSH's /usr/libexec/sftp-server so we don't have to rely
 # on the crufty old scp protocol for file transfer
 RDEPENDS:${PN} += "openssh-sftp-server"
+
+# Add service to migrate the dropbear keys from /var/lib to /etc.
+do_install:append() {
+    install -d ${D}${base_libdir}/systemd/system
+    install -m 0644 ${WORKDIR}/dropbear-migrate-key-location.service \
+        ${D}${base_libdir}/systemd/system
+
+    install -d ${D}${libexecdir}/${BPN}
+    install -m 0755 ${WORKDIR}/migrate-key-location ${D}${libexecdir}/${BPN}
+}
+SYSTEMD_SERVICE:${PN}:append = " dropbear-migrate-key-location.service"
diff --git a/meta-phosphor/recipes-phosphor/images/obmc-phosphor-image.bb b/meta-phosphor/recipes-phosphor/images/obmc-phosphor-image.bb
index 974b911..7759b7e 100644
--- a/meta-phosphor/recipes-phosphor/images/obmc-phosphor-image.bb
+++ b/meta-phosphor/recipes-phosphor/images/obmc-phosphor-image.bb
@@ -39,7 +39,7 @@
         obmc-user-mgmt-ldap \
         ${@bb.utils.contains_any('DISTRO_FEATURES', \
             'obmc-ubi-fs phosphor-mmc obmc-static-norootfs', \
-            'read-only-rootfs', '', d)} \
+            'read-only-rootfs overlayfs-etc', '', d)} \
         ssh-server-dropbear \
         obmc-debug-collector \
         obmc-network-mgmt \
@@ -49,3 +49,15 @@
 # The shadow recipe provides the binaries(like useradd, usermod) needed by the
 # phosphor-user-manager.
 ROOTFS_RO_UNNEEDED:remove = "shadow"
+
+# We need to set overlayfs-etc so that the dropbear/openssh keys don't end up
+# in a volatile file system, but we always have our own init that sets these
+# up.  Add enough bogus values here that rootfs-postcommands.bbclass does what
+# we want without overlayfs-etc.bbclass messing things up.
+OVERLAYFS_ETC_USE_ORIG_INIT_NAME="0"
+OVERLAYFS_ETC_MOUNT_POINT = "/this/is/unused"
+OVERLAYFS_ETC_FSTYPE = "not_a_fs_type"
+OVERLAYFS_ETC_DEVICE = "/dev/null"
+python create_overlayfs_etc_preinit:append() {
+    os.unlink(preinitPath)
+}