diff --git a/Makefile b/Makefile
index fbfe3092..e9bad22f 100644
--- a/Makefile
+++ b/Makefile
@@ -26,7 +26,7 @@ ifndef IMAGE
 	$(error IMAGE is not set. Please specify IMAGE=<image> when running make build or make build-dev)
 endif
 
-.PHONY: all build build-dev setup measure clean check-module
+.PHONY: all build build-dev setup measure measure-portable clean check-module
 
 # Default target
 all: build
@@ -52,6 +52,10 @@ measure: ## Export TDX measurements for the built EFI file
 	@$(WRAPPER) measured-boot $(FILE) build/measurements.json --direct-uki
 	echo "Measurements exported to build/measurements.json"
 
+measure-portable: ## Export portable measurements for the built EFI file
+	@$(WRAPPER) bash -c 'attest measure portable "$$1" > build/portable_measurements.json' _ "$(FILE)"
+	echo "Portable measurements exported to build/portable_measurements.json"
+
 measure-gcp: ## Export TDX measurements for GCP
 	@$(WRAPPER) dstack-mr -uki $(FILE) > build/gcp_measurements.json
 	echo "GCP Measurements exported to build/gcp_measurements.json"
diff --git a/README.md b/README.md
index 398917ee..72085b5a 100644
--- a/README.md
+++ b/README.md
@@ -60,6 +60,14 @@ make measure
 
 This generates measurement files in the `build/` directory for attestation and verification.
 
+Alternatively, to get image hashes for 'portable measurement policies':
+
+```bash
+make measure-portable
+```
+
+This will create a file `build/portable_measurements.json` which can be used for [portable measurement policies](https://github.com/flashbots/attested-tls/tree/main/crates/attestation#portable-measurement-policies).
+
 ### Running Images
 
 **Add yourself to the kvm group** (to run QEMU without sudo):
diff --git a/flake.nix b/flake.nix
index b56f7f56..208ffb8b 100644
--- a/flake.nix
+++ b/flake.nix
@@ -49,6 +49,26 @@
       };
       vendorHash = "sha256-glOyRTrIF/zP78XGV+v58a1Bec6C3Fvc5c8G3PglzPM=";
     };
+    attest-src = pkgs.fetchFromGitHub {
+      owner = "Easy-TEE";
+      repo = "attest";
+      rev = "e7f59c78f9eabd5d1ac7c9e96da46027878d038c";
+      hash = "sha256-4PKNsN8j2P6YJfzghz0U28+Bm3BhS/CveR/mSx3oUg8=";
+    };
+    attest = pkgs.rustPlatform.buildRustPackage {
+      pname = "attest";
+      version = "0.0.1";
+      src = attest-src;
+      cargoLock = {
+        lockFile = "${attest-src}/Cargo.lock";
+        outputHashes = {
+          "dcap-qvl-0.3.12" = "sha256-rLTp5wIhXRAcBtJb7lfd1TAg7yPRnwa0cBa1YT4LwKU=";
+          "cc-eventlog-0.5.8" = "sha256-KEauakj53LrhKTc0yYp5SM8ec0cFNm4YVuHCJYiPQjw=";
+        };
+      };
+      cargoBuildFlags = ["-p" "attest-cli" "--no-default-features"];
+      cargoTestFlags = ["-p" "attest-cli" "--no-default-features"];
+    };
     mkosi = system: let
       pkgsForSystem = import nixpkgs {inherit system;};
       mkosiTools = with pkgsForSystem; [
@@ -130,6 +150,7 @@
           (mkosi system)
           measured-boot
           measured-boot-gcp
+          attest
           bash
           curl
           git