diff --git a/debos-recipes/examples/overlayfs-tools-overlay/sbin/overlay-do b/debos-recipes/examples/overlayfs-tools-overlay/sbin/overlay-do
new file mode 100755
index 00000000..2f41d5a9
--- /dev/null
+++ b/debos-recipes/examples/overlayfs-tools-overlay/sbin/overlay-do
@@ -0,0 +1,52 @@
+#!/bin/sh
+# Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+# SPDX-License-Identifier: BSD-3-Clause
+
+set -eux
+
+OVERLAY_IMG="/overlay.img"
+OVERLAY_DIR="/overlay"
+UPPER_DIR="/overlay/upper"
+MERGED_DIR="/overlay/merged"
+WORK_DIR="/overlay/work"
+LOWER_DIR="/"
+BINDMOUNTS="/dev /dev/pts /proc /run /sys"
+
+die() {
+    echo "$*" >&2
+    exit 1
+}
+
+cleanup() {
+    for fs in $(echo ${BINDMOUNTS} | rev); do
+        umount "${MERGED_DIR}/${fs}" || true
+    done
+    umount "${MERGED_DIR}" || true
+    umount "${OVERLAY_DIR}" || true
+    rmdir -v "${OVERLAY_DIR}" || true
+}
+
+trap cleanup EXIT
+
+if ! [ -e "${OVERLAY_IMG}" ]; then
+    die "Overlay ${OVERLAY_IMG} not found"
+fi
+
+if [ -d "${OVERLAY_DIR}" ]; then
+    die "Overlay tree already present; cleanup with umount ${MERGED_DIR} ${OVERLAY_DIR} && rmdir ${OVERLAY_DIR}"
+fi
+
+mkdir -v "${OVERLAY_DIR}"
+mount -o loop "${OVERLAY_IMG}" "${OVERLAY_DIR}"
+mount -t overlay \
+    overlay \
+    "-olowerdir=${LOWER_DIR},upperdir=${UPPER_DIR},workdir=${WORK_DIR}" \
+    "${MERGED_DIR}"
+
+for fs in $BINDMOUNTS; do
+    mount --bind "${fs}" "${MERGED_DIR}/${fs}"
+done
+
+echo "Running $* in merged chroot" >&2
+chroot "${MERGED_DIR}" "$@"
+
diff --git a/debos-recipes/examples/overlayfs-tools.yaml b/debos-recipes/examples/overlayfs-tools.yaml
new file mode 100644
index 00000000..552a2804
--- /dev/null
+++ b/debos-recipes/examples/overlayfs-tools.yaml
@@ -0,0 +1,54 @@
+{{- $overlaysize := or .overlaysize "2GiB" }}
+
+architecture: arm64
+
+# this recipe uses overlayfs to install a few extra packages only relevant for
+# testing; the resulting image file can be used during factory testing to
+# provide extra commands, and then removed from the filesystem
+#
+# to run a command from the overlay:
+#     /sbin/overlay-do <command ...>
+# to remove the overlay:
+#     shred -n 1 -v -u /overlay.img
+
+actions:
+  - action: run
+    description: Create overlayfs
+    chroot: true
+    command: |
+      set -eux
+      # create a sparse file to hold the overlay filesystem
+      truncate -s "{{$overlaysize}}" overlay.img
+      mkfs.ext4 /overlay.img
+      # debug
+      cat /proc/filesystems || true
+      lsmod || true
+      losetup -a || true
+      ls /lib/modules || true
+      uname -a || true
+      mkdir -vp /overlay
+      mount -o loop /overlay.img /overlay
+      # create directories needed to mount overlay
+      mkdir -v /overlay/merged /overlay/upper /overlay/work
+      umount /overlay
+      rmdir -vp /overlay
+
+  - action: overlay
+    description: Apply overlayfs overlay
+    source: overlayfs-tools-overlay
+
+  - action: run
+    description: Modernize APT sources
+    chroot: true
+    command: |
+      set -eux
+      # install gst-launch and some difficult to redistribute gstreamer plugins
+      /sbin/overlay-do \
+          apt -y install \
+              gstreamer1.0-libav \
+              gstreamer1.0-plugins-bad \
+              gstreamer1.0-plugins-ugly \
+              gstreamer1.0-tools
+
+# Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+# SPDX-License-Identifier: BSD-3-Clause
diff --git a/debos-recipes/qualcomm-linux-debian-rootfs.yaml b/debos-recipes/qualcomm-linux-debian-rootfs.yaml
index 56d437da..5f1d61a4 100644
--- a/debos-recipes/qualcomm-linux-debian-rootfs.yaml
+++ b/debos-recipes/qualcomm-linux-debian-rootfs.yaml
@@ -297,6 +297,9 @@ actions:
           qcom/qcs6490-rb3gen2.dtb \
           qcom/qrb2210-rb1.dtb
 
+  - action: recipe
+    recipe: examples/overlayfs-tools.yaml
+
   - action: pack
     description: Create root filesystem tarball
     file: rootfs.tar.gz