diff --git a/meta-balena-common/recipes-support/hostapp-update-hooks/hostapp-update-hooks.bb b/meta-balena-common/recipes-support/hostapp-update-hooks/hostapp-update-hooks.bb
index c418763098..9db3dea31c 100644
--- a/meta-balena-common/recipes-support/hostapp-update-hooks/hostapp-update-hooks.bb
+++ b/meta-balena-common/recipes-support/hostapp-update-hooks/hostapp-update-hooks.bb
@@ -55,7 +55,7 @@ RDEPENDS:${PN} = " \
     os-helpers-sb \
     "
 
-RDEPENDS:${PN}:append = "${@bb.utils.contains('MACHINE_FEATURES', 'efi', ' efivar efitools-utils', '',d)}"
+RDEPENDS:${PN}:append = "${@bb.utils.contains('MACHINE_FEATURES', 'efi', ' efivar efitools-utils tcgtool', '',d)}"
 
 do_install() {
 	mkdir -p ${D}${sysconfdir}/hostapp-update-hooks.d/
diff --git a/meta-balena-common/recipes-support/tcgtool/tcgtool_git.bb b/meta-balena-common/recipes-support/tcgtool/tcgtool_git.bb
new file mode 100644
index 0000000000..834a05c296
--- /dev/null
+++ b/meta-balena-common/recipes-support/tcgtool/tcgtool_git.bb
@@ -0,0 +1,20 @@
+DESCRIPTION = "Pack efivar data for hashing to extend PCRs"
+LICENSE = "Apache-2.0"
+LIC_FILES_CHKSUM = "file://${BALENA_COREBASE}/COPYING.Apache-2.0;md5=89aea4e17d99a7cacdbeed46a0096b10"
+SRC_URI = "git://github.com/balena-os/tcgtool.git;branch=master;protocol=https"
+SRCREV = "633b7d7617873a58f38cbe5b414d5f43f04355df"
+
+S = "${WORKDIR}/git"
+
+do_compile() {
+    oe_runmake ${PN}
+}
+
+do_install() {
+    install -d ${D}${bindir}
+    install -m 755 ${B}/${PN} ${D}${bindir}/${PN}
+}
+
+BB_STRICT_CHECKSUM = "0"
+
+BBCLASSEXTEND = "native"