diff --git a/.github/workflows/test-build.yml b/.github/workflows/test-build.yml
index 3325566d6a..9b0d078e5c 100644
--- a/.github/workflows/test-build.yml
+++ b/.github/workflows/test-build.yml
@@ -13,6 +13,9 @@ on:
       make-args:
         required: false
         type: string
+      prep-run:
+        required: false
+        type: string
 
 jobs:
 
@@ -42,6 +45,10 @@ jobs:
         run: |
           make -C tools/keytools && make -C tools/bin-assemble
 
+      - name: Pre-build setup
+        if: inputs.prep-run != ''
+        run: ${{inputs.prep-run}}
+
       - name: Build wolfboot
         run: |
           make ${{inputs.make-args}}
diff --git a/.github/workflows/test-configs.yml b/.github/workflows/test-configs.yml
index 54c2309046..7a978caee5 100644
--- a/.github/workflows/test-configs.yml
+++ b/.github/workflows/test-configs.yml
@@ -738,6 +738,14 @@ jobs:
       arch: host
       config-file: ./config/examples/x86_64_efi.config
 
+  aarch64_efi_test:
+    uses: ./.github/workflows/test-build.yml
+    with:
+      arch: aarch64
+      config-file: ./config/examples/aarch64_efi.config
+      # Build gnu-efi for aarch64 (pinned in the script) before wolfboot.efi.
+      prep-run: ./tools/scripts/build-gnu-efi-aarch64.sh
+
   zynqmp_test:
     uses: ./.github/workflows/test-build-aarch64.yml
     with:
diff --git a/.gitignore b/.gitignore
index b1bc7fb6ad..79d9f9d1c4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -421,3 +421,10 @@ sdcard.img
 
 # wolfHSM STM32H5 TZ demo build output
 port/stmicro/stm32h5-tz-wolfhsm/out/
+
+# gnu-efi built for the AArch64 UEFI target and its cloned source
+tools/gnu-efi-aarch64/
+tools/gnu-efi-src/
+# aarch64_efi working/staging dirs (build artifacts, not tracked)
+aarch64_efi-stage/
+tools/qemu-esp/
diff --git a/Makefile b/Makefile
index 2051b7900a..22cce80a9f 100644
--- a/Makefile
+++ b/Makefile
@@ -265,6 +265,9 @@ SIGN_ENV=IMAGE_HEADER_SIZE=$(IMAGE_HEADER_SIZE) \
 
 
 MAIN_TARGET=factory.bin
+# PE/COFF output format for the wolfboot.efi objcopy rule. Overridden per
+# target in arch.mk (e.g. pei-aarch64-little for aarch64_efi).
+EFI_OBJCOPY_TARGET?=pei-x86-64
 TARGET_H_TEMPLATE:=include/target.h.in
 
 ifeq ($(TZEN),1)
@@ -293,6 +296,10 @@ ifeq ($(TARGET),x86_64_efi)
     MAIN_TARGET:=wolfboot.efi
 endif
 
+ifeq ($(TARGET),aarch64_efi)
+    MAIN_TARGET:=wolfboot.efi
+endif
+
 ifeq ($(FSP), 1)
     MAIN_TARGET:=wolfboot_stage1.bin
 endif
@@ -379,7 +386,7 @@ wolfboot.efi: wolfboot.elf
 	$(Q)$(OBJCOPY) -j .rodata -j .text -j .sdata -j .data \
 					-j .dynamic -j .dynsym  -j .rel \
 					-j .rela -j .reloc -j .eh_frame \
-					-O pei-x86-64 --subsystem=10 $^ $@
+					-O $(EFI_OBJCOPY_TARGET) --subsystem=10 $^ $@
 	@echo
 	@echo "\t[SIZE]"
 	$(Q)$(SIZE) wolfboot.efi
diff --git a/arch.mk b/arch.mk
index beeffa4122..4e69a3e6a4 100644
--- a/arch.mk
+++ b/arch.mk
@@ -63,9 +63,20 @@ endif
 
 ## ARM Cortex-A
 ifeq ($(ARCH),AARCH64)
-  CROSS_COMPILE?=aarch64-none-elf-
+  ifeq ($(TARGET),aarch64_efi)
+    # UEFI app: Linux GNU toolchain (freestanding EFI ABI), not aarch64-none-elf-
+    CROSS_COMPILE?=aarch64-linux-gnu-
+  else
+    CROSS_COMPILE?=aarch64-none-elf-
+  endif
   CFLAGS+=-DARCH_AARCH64 -DFAST_MEMCPY
-  OBJS+=src/boot_aarch64.o src/boot_aarch64_start.o
+  ifeq ($(TARGET),aarch64_efi)
+    # UEFI app: gnu-efi CRT0 is the entry; do_boot is in boot_aarch64_efi.o.
+    # Skip the bare-metal reset (boot_aarch64_start.S) and EL2/GIC glue.
+    OBJS+=src/boot_aarch64_efi.o
+  else
+    OBJS+=src/boot_aarch64.o src/boot_aarch64_start.o
+  endif
 
   ifeq ($(TARGET),zynq)
     ARCH_FLAGS=-march=armv8-a+crypto
@@ -1664,6 +1675,37 @@ ifeq ($(TARGET),x86_64_efi)
   UPDATE_OBJS:=src/update_ram.o
 endif
 
+ifeq ($(TARGET),aarch64_efi)
+  # Generic AArch64 UEFI application (validated on NVIDIA Jetson Orin Nano).
+  # Build gnu-efi for aarch64 first: ./tools/scripts/build-gnu-efi-aarch64.sh
+  # (override the install path with GNU_EFI_PATH=... if needed).
+  USE_GCC_HEADLESS=0
+  GNU_EFI_PATH?=tools/gnu-efi-aarch64
+  GNU_EFI_LIB_PATH?=$(GNU_EFI_PATH)/lib
+  GNU_EFI_INC_PATH?=$(GNU_EFI_PATH)/include
+  GNU_EFI_CRT0=$(GNU_EFI_LIB_PATH)/crt0-efi-aarch64.o
+  GNU_EFI_LSCRIPT=$(GNU_EFI_LIB_PATH)/elf_aarch64_efi.lds
+  CFLAGS += -fpic -ffreestanding -fno-stack-protector -fno-stack-check \
+            -fshort-wchar -mstrict-align
+  CFLAGS += -I$(GNU_EFI_INC_PATH) -I$(GNU_EFI_INC_PATH)/efi \
+            -I$(GNU_EFI_INC_PATH)/efi/aarch64 \
+            -DTARGET_aarch64_efi -DWOLFBOOT_DUALBOOT
+  # avoid using of fixed LOAD_ADDRESS, uefi target uses dynamic location
+  CFLAGS += -DWOLFBOOT_NO_LOAD_ADDRESS
+  # AArch64 PE/COFF output format for objcopy (see the wolfboot.efi rule).
+  # This binutils exposes it as pei-aarch64-little (not efi-app-aarch64).
+  EFI_OBJCOPY_TARGET=pei-aarch64-little
+  # --allow-multiple-definition: gnu-efi's libefi init.o (pulled in for
+  # InitializeLib) also defines memset/memcpy; wolfBoot's src/string.o comes
+  # first in link order and wins.
+  LDFLAGS = -shared -Bsymbolic --allow-multiple-definition \
+            -L$(GNU_EFI_LIB_PATH) -T$(GNU_EFI_LSCRIPT)
+  LD_START_GROUP = $(GNU_EFI_CRT0)
+  LD_END_GROUP = -lgnuefi -lefi
+  LD = $(CROSS_COMPILE)ld
+  UPDATE_OBJS:=src/update_ram.o
+endif
+
 ifeq ($(ARCH),sim)
   USE_GCC_HEADLESS=0
   LD = gcc
@@ -1914,6 +1956,19 @@ endif
 
 ## Update mechanism
 ifeq ($(ARCH),AARCH64)
+ifeq ($(TARGET),aarch64_efi)
+  # UEFI app: UEFI owns MMU/FDT, so skip the -DMMU/-DWOLFBOOT_FDT DTS path and
+  # fdt.o/gpt.o (like x86_64_efi). update_ram.o is set in the block above.
+  # DEBUG=1: route wolfBoot_printf to the UEFI console (gnu-efi Print).
+  ifeq ($(DEBUG),1)
+    CFLAGS += -DWOLFBOOT_DEBUG_EFI=1
+  endif
+  # Drop -Werror for this target: WOLFBOOT_DEBUG_EFI pulls gnu-efi headers into
+  # every TU and efidebug.h redefines the -DDEBUG object macro as a function
+  # macro. That cpp macro-redefinition warning has no -W name, so it can't be
+  # scoped with -Wno-error=<name>; our own sources are kept warning-clean.
+  CFLAGS := $(filter-out -Werror,$(CFLAGS))
+else
   CFLAGS+=-DMMU -DWOLFBOOT_FDT -DWOLFBOOT_DUALBOOT
   OBJS+=src/fdt.o
   # src/gpt.c provides the CRC32 helpers reused by update_ram.c's uImage
@@ -1934,6 +1989,7 @@ ifeq ($(ARCH),AARCH64)
     # RAM-based boot from external flash (default)
     UPDATE_OBJS:=src/update_ram.o
   endif
+endif
 else
   ifeq ($(DUALBANK_SWAP),1)
     CFLAGS+=-DWOLFBOOT_DUALBOOT
diff --git a/config/examples/aarch64_efi.config b/config/examples/aarch64_efi.config
new file mode 100644
index 0000000000..6d7c9396e5
--- /dev/null
+++ b/config/examples/aarch64_efi.config
@@ -0,0 +1,25 @@
+# AArch64 UEFI application - wolfBoot as a UEFI app (the AArch64 sibling of the
+# x86_64_efi target). Validated on the NVIDIA Jetson Orin Nano (Tegra234).
+#
+# wolfBoot builds as an AArch64 UEFI application (wolfboot.efi) launched by the
+# platform UEFI firmware. It reads kernel.img/update.img from the EFI Simple
+# File System, verifies them, and boots via UEFI LoadImage/StartImage.
+# Modeled on config/examples/x86_64_efi.config.
+#
+# Prerequisite: build gnu-efi for AArch64 first (one-time):
+#   ./tools/scripts/build-gnu-efi-aarch64.sh
+# then:  cp config/examples/aarch64_efi.config .config && make
+#
+# Crypto starts on ED25519/SHA256 (matches the proven x86 EFI target) to
+# de-risk the first build. Switch to ECC384/SHA384 once the port builds and
+# runs: set SIGN?=ECC384, HASH?=SHA384, SPMATH=1 (pulls in SP math objects).
+ARCH=AARCH64
+TARGET=aarch64_efi
+WOLFBOOT_SMALL_STACK=1
+SIGN?=ED25519
+HASH?=SHA256
+DEBUG=1
+SPMATH=0
+# required for keytools
+WOLFBOOT_SECTOR_SIZE?=0x1000
+WOLFBOOT_NO_PARTITIONS=1
diff --git a/docs/Targets.md b/docs/Targets.md
index 0f2cbb352d..b478c15b94 100644
--- a/docs/Targets.md
+++ b/docs/Targets.md
@@ -33,6 +33,7 @@ This README describes configuration of supported targets.
 * [NXP T10xx PPC (T1024 / T1040)](#nxp-qoriq-t10xx-ppc-t1024--t1040)
 * [NXP T2080 PPC](#nxp-qoriq-t2080-ppc)
 * [Qemu x86-64 UEFI](#qemu-x86-64-uefi)
+* [NVIDIA Jetson Orin (aarch64_efi)](#nvidia-jetson-orin-aarch64_efi)
 * [Raspberry Pi pico 2 (rp2350)](#raspberry-pi-pico-rp2350)
 * [Renesas RA6M4](#renesas-ra6m4)
 * [Renesas RX65N](#renesas-rx65n)
@@ -7785,6 +7786,115 @@ You can `Ctrl-C` or login as `root` and power off qemu with `poweroff`
 
 
 
+## NVIDIA Jetson Orin (aarch64_efi)
+
+The `aarch64_efi` target builds wolfBoot as an AArch64 UEFI application (`wolfboot.efi`), the direct counterpart of the [Qemu x86-64 UEFI](#qemu-x86-64-uefi) target. It uses only UEFI Boot Services (no SoC-specific registers), so the same binary runs on any AArch64 UEFI platform. It has been validated on the NVIDIA Jetson Orin Nano Developer Kit (Tegra234), where the on-module UEFI firmware (edk2-nvidia) launches it after the NVIDIA-signed early boot chain (BootROM -> MB1 -> MB2 -> UEFI). wolfBoot reads the next-stage image from the EFI Simple File System, authenticates it with wolfCrypt, and boots it via the UEFI `LoadImage`/`StartImage` services (an AArch64 Linux `Image` is itself a PE/COFF EFI-stub application).
+
+### Prerequisites
+
+ * An AArch64 GNU toolchain (`aarch64-linux-gnu-gcc`)
+ * gnu-efi built for AArch64 (the host distro package is usually x86-only, so build it with the helper script below)
+ * For emulation: `qemu-system-aarch64` plus the AArch64 UEFI firmware (AAVMF, package `qemu-efi-aarch64`)
+
+On a debian-like system:
+
+```
+apt install git make gcc-aarch64-linux-gnu dosfstools mtools
+apt install qemu-system-arm qemu-efi-aarch64   # emulation (optional)
+```
+
+Build the AArch64 gnu-efi runtime once (installs into `tools/gnu-efi-aarch64/`):
+
+```
+./tools/scripts/build-gnu-efi-aarch64.sh
+```
+
+### Configuration
+
+An example configuration is provided in [config/examples/aarch64_efi.config](config/examples/aarch64_efi.config). It selects `ARCH=AARCH64`, `TARGET=aarch64_efi`, and a signature/hash algorithm (ED25519/SHA256 by default). No partition addresses are required -- UEFI provides the storage and dynamic image placement.
+
+### Building
+
+```
+cp config/examples/aarch64_efi.config .config
+make
+```
+
+This produces `wolfboot.efi`, a PE32+ AArch64 EFI application (objcopy output format `pei-aarch64-little`).
+
+### Signing a payload
+
+Sign the image to boot (an AArch64 Linux `Image`, or any EFI application for testing) with the generated key, tagging it with a version. wolfBoot looks for `kernel.img` and `update.img` on the volume it was launched from and boots the higher valid version:
+
+```
+./tools/keytools/sign --ed25519 --sha256 Image wolfboot_signing_private_key.der 1
+cp Image_v1_signed.bin kernel.img
+```
+
+### Running in QEMU
+
+```
+./tools/scripts/aarch64-efi-qemu.sh        # add --gdb to debug with gdb-multiarch
+```
+
+The script exposes a scratch directory to the UEFI firmware as a FAT ESP, copies `wolfboot.efi` (and `kernel.img` from `aarch64_efi-stage/` if present), and auto-runs it.
+
+### Deploying on the Jetson Orin Nano
+
+The Jetson UEFI auto-boots removable media via `\EFI\BOOT\BOOTAA64.EFI`. Place wolfBoot and a signed payload on a FAT32 partition:
+
+```
+\EFI\BOOT\BOOTAA64.EFI   <- wolfboot.efi
+\kernel.img              <- signed payload (read from the volume root)
+\cmdline.txt             <- optional Linux kernel command line (see below)
+```
+
+Insert the card and power on; UEFI auto-launches wolfBoot, which verifies and boots the payload. The debug console on the Orin Nano Developer Kit is the J14 button header (not the 40-pin), 115200 8N1. Example output:
+
+```
+Image base: 0x25E5D4000
+Opening file: kernel.img, size: 57969
+Checking integrity...done
+Verifying signature...done
+Successfully selected image in part: 0
+Firmware Valid
+Booting at 0x5E254100
+Staging kernel at address 5E254100, size: 57969
+```
+
+### Booting Linux
+
+An AArch64 Linux `Image` carries a PE/COFF EFI stub, so wolfBoot boots it with the same `LoadImage`/`StartImage` path used above -- no initrd or bare-metal handoff is needed when the kernel has built-in MMC/ext4 drivers (the NVIDIA L4T kernel does). This has been validated end to end on the Jetson Orin Nano: wolfBoot verifies the signed kernel and boots NVIDIA Jetson Linux (L4T R36.4.4, `5.15.148-tegra`) all the way to an Ubuntu 22.04 login prompt.
+
+Obtain a Tegra234-compatible kernel and root filesystem from the [NVIDIA Jetson Linux (L4T)](https://developer.nvidia.com/embedded/jetson-linux) BSP. The driver package (`Jetson_Linux_R36.x.x_aarch64.tbz2`) contains `Linux_for_Tegra/kernel/Image` and `Linux_for_Tegra/kernel/dtb/tegra234-*.dtb`; the matching `Tegra_Linux_Sample-Root-Filesystem_*.tbz2` provides the rootfs.
+
+Sign the kernel `Image` with the wolfBoot key and name it `kernel.img`:
+
+```
+./tools/keytools/sign --ed25519 --sha256 Linux_for_Tegra/kernel/Image \
+    wolfboot_signing_private_key.der 1
+cp Linux_for_Tegra/kernel/Image_v1_signed.bin kernel.img
+```
+
+Lay out the microSD as a FAT ESP plus a rootfs partition and place:
+
+```
+FAT (p1):   \EFI\BOOT\BOOTAA64.EFI   <- wolfboot.efi (UEFI auto-boots this)
+            \kernel.img              <- signed L4T kernel
+            \cmdline.txt             <- kernel command line (below)
+ext4 (p2):  the L4T sample root filesystem
+```
+
+`cmdline.txt` (read by wolfBoot and passed to the kernel via `LoadOptions`):
+
+```
+root=/dev/mmcblk0p2 rw rootwait console=ttyTCU0,115200
+```
+
+On power-up the Jetson UEFI auto-boots `\EFI\BOOT\BOOTAA64.EFI`; wolfBoot verifies `kernel.img` and hands off to the kernel, which receives the real Tegra234 device tree from the UEFI configuration table (`EFI stub: Using DTB from configuration table`), mounts `mmcblk0p2`, and brings up systemd and the login on the J14 debug console (`ttyTCU0`).
+
+Security note: the plaintext `\cmdline.txt` is not covered by the image signature. For a production trust chain the command line should be authenticated -- baked into the signed image, or supplied via the device-tree `/chosen` bootargs. An initramfs-based flow (rather than a direct `root=` mount) would additionally need initrd support via the `LINUX_EFI_INITRD_MEDIA_GUID` LoadFile2 protocol, which this target does not currently implement.
+
 ## Intel x86_64 with Intel FSP support
 
 This setup is more complex than the UEFI approach described earlier, but allows
diff --git a/hal/aarch64_efi.c b/hal/aarch64_efi.c
new file mode 100644
index 0000000000..33e4680338
--- /dev/null
+++ b/hal/aarch64_efi.c
@@ -0,0 +1,382 @@
+/* aarch64_efi.c
+ *
+ * Copyright (C) 2026 wolfSSL Inc.
+ *
+ * This file is part of wolfBoot.
+ *
+ * wolfBoot is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfBoot is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+
+/* Generic AArch64 UEFI-application HAL (validated on NVIDIA Jetson Orin Nano,
+ * Tegra234 / Cortex-A78AE).
+ *
+ * wolfBoot runs here as an AArch64 UEFI application (wolfboot.efi), launched
+ * by the platform UEFI firmware. It reads the kernel image from the EFI
+ * Simple File System, verifies it with wolfCrypt, and hands off to it via
+ * the UEFI LoadImage/StartImage services (the AArch64 Linux Image is itself
+ * a PE/COFF EFI-stub application). UEFI owns DRAM/MMU/GIC state, so this HAL
+ * needs no bare-metal init; the flash ops are stubs and storage/console come
+ * from UEFI Boot Services. This is the AArch64 sibling of hal/x86_64_efi.c. */
+
+#include <stdint.h>
+#include <target.h>
+
+#include "image.h"
+#include "loader.h"
+#include "printf.h"
+
+#ifdef TARGET_aarch64_efi
+
+/* -DDEBUG (object macro from DEBUG=1) collides with gnu-efi efidebug.h's
+ * DEBUG(a); drop it before the EFI headers (unused here). */
+#undef DEBUG
+
+#include <efi/efi.h>
+#include <efi/efilib.h>
+
+#ifdef __WOLFBOOT
+void hal_init(void)
+{
+}
+
+void hal_prepare_boot(void)
+{
+}
+
+#endif
+
+#define PAGE_SIZE 0x1000
+#define EFI_DEVICE_PATH_PROTOCOL_HW_TYPE 0x01
+#define EFI_DEVICE_PATH_PROTOCOL_MEM_SUBTYPE 0x03
+
+static EFI_SYSTEM_TABLE *gSystemTable;
+static EFI_HANDLE gImageHandle;
+EFI_PHYSICAL_ADDRESS kernel_addr;
+EFI_PHYSICAL_ADDRESS update_addr;
+
+/* Optional Linux kernel command line, read from \cmdline.txt on the ESP and
+ * handed to the kernel EFI stub via LoadOptions (see aarch64_efi_do_boot). */
+static CHAR16 *kernel_cmdline = NULL;
+static UINTN   kernel_cmdline_bytes = 0;
+
+int RAMFUNCTION hal_flash_write(uintptr_t address, const uint8_t *data, int len)
+{
+    return 0;
+}
+
+void RAMFUNCTION hal_flash_unlock(void)
+{
+}
+
+void RAMFUNCTION hal_flash_lock(void)
+{
+}
+
+int RAMFUNCTION hal_flash_erase(uintptr_t address, int len)
+{
+    return 0;
+}
+
+void* hal_get_primary_address(void)
+{
+    return (void*)kernel_addr;
+}
+
+void* hal_get_update_address(void)
+{
+  return (void*)update_addr;
+}
+
+void *hal_get_dts_address(void)
+{
+    return NULL;
+}
+
+void *hal_get_dts_update_address(void)
+{
+    return NULL;
+}
+
+static void panic()
+{
+    while(1) {}
+}
+
+void RAMFUNCTION aarch64_efi_do_boot(uint32_t *boot_addr)
+{
+    uint32_t *size;
+    uint8_t* manifest = ((uint8_t*)boot_addr) - IMAGE_HEADER_SIZE;
+    MEMMAP_DEVICE_PATH mem_path_device[2];
+    EFI_HANDLE kernelImageHandle;
+    EFI_STATUS status;
+    EFI_LOADED_IMAGE *kernel_li = NULL;
+    EFI_GUID lipGuid = EFI_LOADED_IMAGE_PROTOCOL_GUID;
+
+    size = (uint32_t *)(manifest + 4);
+
+    mem_path_device->Header.Type = EFI_DEVICE_PATH_PROTOCOL_HW_TYPE;
+    mem_path_device->Header.SubType = EFI_DEVICE_PATH_PROTOCOL_MEM_SUBTYPE;
+    mem_path_device->MemoryType = EfiLoaderData;
+    mem_path_device->StartingAddress = (EFI_PHYSICAL_ADDRESS)boot_addr;
+    mem_path_device->EndingAddress = (EFI_PHYSICAL_ADDRESS)((uint8_t*)boot_addr+*size);
+    SetDevicePathNodeLength(&mem_path_device->Header,
+                            sizeof(MEMMAP_DEVICE_PATH));
+
+    SetDevicePathEndNode(&mem_path_device[1].Header);
+
+    wolfBoot_printf("Staging kernel at address %p, size: %u\n", (void*)boot_addr, *size);
+    status = uefi_call_wrapper(gSystemTable->BootServices->LoadImage,
+                               6,
+                               0, /* bool */
+                               gImageHandle,
+                               (EFI_DEVICE_PATH*)mem_path_device,
+                               boot_addr,
+                               *size,
+                               &kernelImageHandle);
+    if (status != EFI_SUCCESS) {
+        wolfBoot_printf("can't load kernel image from memory\n");
+        panic();
+    }
+
+    /* Pass the kernel command line (from \cmdline.txt) to the loaded image via
+     * LoadOptions for the Linux EFI stub. For a production trust chain the
+     * cmdline should be authenticated (in the signed image or DT /chosen), not
+     * a plaintext file. A direct root= boot needs no initrd; an initramfs flow
+     * would add it via LINUX_EFI_INITRD_MEDIA_GUID (LoadFile2). */
+    if (kernel_cmdline != NULL) {
+        status = uefi_call_wrapper(gSystemTable->BootServices->HandleProtocol, 3,
+                                   kernelImageHandle, &lipGuid,
+                                   (void**)&kernel_li);
+        if (status == EFI_SUCCESS && kernel_li != NULL) {
+            kernel_li->LoadOptions = kernel_cmdline;
+            kernel_li->LoadOptionsSize = (UINT32)kernel_cmdline_bytes;
+        }
+    }
+
+    status = uefi_call_wrapper(gSystemTable->BootServices->StartImage,
+                               3,
+                               kernelImageHandle, 0, NULL);
+    if (status != EFI_SUCCESS) {
+        wolfBoot_printf("can't load kernel image from memory\n");
+        panic();
+    }
+}
+
+static UINT64 FileSize(EFI_FILE_HANDLE FileHandle)
+{
+    EFI_FILE_INFO *FileInfo;
+    UINT64 ret;
+
+    FileInfo = LibFileInfo(FileHandle);
+    if (FileInfo == NULL) {
+        panic();
+        return 0; /* Never reached, for static analyzer */
+    }
+
+    ret = FileInfo->FileSize;
+    FreePool(FileInfo);
+
+    return ret;
+}
+
+static EFI_FILE_HANDLE GetVolume(EFI_HANDLE image)
+{
+    EFI_GUID fsGuid = EFI_SIMPLE_FILE_SYSTEM_PROTOCOL_GUID;
+    EFI_GUID lipGuid = EFI_LOADED_IMAGE_PROTOCOL_GUID;
+    EFI_LOADED_IMAGE *loaded_image = NULL;
+    EFI_FILE_IO_INTERFACE *IOVolume;
+    EFI_FILE_HANDLE Volume;
+    EFI_STATUS status;
+
+    status = uefi_call_wrapper(BS->HandleProtocol, 3,
+                               image, &lipGuid, (void **) &loaded_image);
+    if (status != EFI_SUCCESS)
+        panic();
+
+    status = uefi_call_wrapper(BS->HandleProtocol, 3,
+                               loaded_image->DeviceHandle,
+                               &fsGuid, (VOID*)&IOVolume);
+    if (status != EFI_SUCCESS)
+        panic();
+
+    status = uefi_call_wrapper(IOVolume->OpenVolume, 2, IOVolume, &Volume);
+
+    if (status != EFI_SUCCESS)
+        panic();
+
+    return Volume;
+}
+
+static EFI_FILE_HANDLE openFile(CHAR16 *file, EFI_FILE_HANDLE volume)
+{
+    EFI_FILE_HANDLE file_handle;
+    EFI_STATUS status;
+
+    status = uefi_call_wrapper(volume->Open, 5,
+                               volume,
+                               &file_handle,
+                               file,
+                               EFI_FILE_MODE_READ,
+                               EFI_FILE_READ_ONLY | EFI_FILE_HIDDEN | EFI_FILE_SYSTEM);
+
+    if (status != EFI_SUCCESS)
+        file_handle = NULL;
+
+    return file_handle;
+}
+
+static int open_kernel_image(EFI_FILE_HANDLE vol, CHAR16 *filename,
+        EFI_PHYSICAL_ADDRESS *_addr, uint32_t *sz)
+{
+    EFI_FILE_HANDLE file;
+    EFI_STATUS status;
+    UINTN readsz;
+
+    file = openFile(filename, vol);
+    if (file == NULL)
+        return -1;
+
+    *sz =  FileSize(file);
+    wolfBoot_printf("Opening file: %s, size: %u\n", filename, *sz);
+    status = uefi_call_wrapper(BS->AllocatePages,
+                          4,
+                          AllocateAnyPages,
+                          EfiLoaderData,
+                          (*sz/PAGE_SIZE) + 1, _addr);
+    if (status != EFI_SUCCESS) {
+        wolfBoot_printf("can't get memory at specified address %d\n", status);
+        uefi_call_wrapper(file->Close, 1, file);
+        return status;
+    }
+
+    /* EFI_FILE Read() takes UINTN *BufferSize and VOID *Buffer. On AArch64
+     * uefi_call_wrapper is a native passthrough (no arg casting), so pass the
+     * correct types explicitly rather than a uint32_t pointer and an integer
+     * address. */
+    readsz = (UINTN)*sz;
+    status = uefi_call_wrapper(file->Read, 3, file, &readsz,
+                               (void*)(uintptr_t)*_addr);
+    *sz = (uint32_t)readsz;
+    uefi_call_wrapper(file->Close, 1, file); /* done with the file */
+    if (status != EFI_SUCCESS) {
+        wolfBoot_printf("can't read kernel image %d\n", status);
+        return status;
+    }
+
+    if (*sz < IMAGE_HEADER_SIZE) {
+        wolfBoot_printf("Image smaller than the header\n");
+        return -1;
+    }
+
+    return 0;
+}
+
+/* Read an optional \cmdline.txt (ASCII) from the ESP into a widechar buffer
+ * for the kernel LoadOptions. No-op (leaves kernel_cmdline NULL) if absent. */
+static void read_cmdline(EFI_FILE_HANDLE vol)
+{
+    EFI_FILE_HANDLE file;
+    EFI_STATUS status;
+    UINT64 sz;
+    UINTN readsz, i, n;
+    uint8_t *ascii = NULL;
+    CHAR16 *wide = NULL;
+
+    file = openFile(L"cmdline.txt", vol);
+    if (file == NULL)
+        return; /* optional */
+
+    sz = FileSize(file);
+    if (sz == 0 || sz > 4096) {
+        uefi_call_wrapper(file->Close, 1, file);
+        return;
+    }
+
+    status = uefi_call_wrapper(BS->AllocatePool, 3, EfiLoaderData,
+                               (UINTN)sz, (void**)&ascii);
+    if (status != EFI_SUCCESS || ascii == NULL) {
+        uefi_call_wrapper(file->Close, 1, file);
+        return;
+    }
+
+    readsz = (UINTN)sz;
+    status = uefi_call_wrapper(file->Read, 3, file, &readsz, ascii);
+    uefi_call_wrapper(file->Close, 1, file); /* done with the file */
+    if (status != EFI_SUCCESS) {
+        FreePool(ascii);
+        return;
+    }
+
+    /* trim trailing CR/LF/whitespace */
+    n = (UINTN)readsz;
+    while (n > 0 && (ascii[n-1] == '\n' || ascii[n-1] == '\r' ||
+                     ascii[n-1] == ' '  || ascii[n-1] == '\t'))
+        n--;
+
+    status = uefi_call_wrapper(BS->AllocatePool, 3, EfiLoaderData,
+                               (n + 1) * sizeof(CHAR16), (void**)&wide);
+    if (status != EFI_SUCCESS || wide == NULL) {
+        FreePool(ascii);
+        return;
+    }
+    for (i = 0; i < n; i++)
+        wide[i] = (CHAR16)ascii[i];
+    wide[n] = 0;
+    FreePool(ascii);
+
+    kernel_cmdline = wide;
+    kernel_cmdline_bytes = (n + 1) * sizeof(CHAR16);
+    wolfBoot_printf("Kernel cmdline (%d chars) from cmdline.txt\n", (int)n);
+}
+
+EFI_STATUS
+EFIAPI
+efi_main (EFI_HANDLE ImageHandle, EFI_SYSTEM_TABLE *SystemTable)
+{
+    CHAR16 *kernel_filename = L"kernel.img";
+    CHAR16 *update_filename = L"update.img";
+    EFI_LOADED_IMAGE *loaded_image = NULL;
+    EFI_FILE_HANDLE vol;
+    EFI_STATUS status;
+    uint32_t kernel_size, update_size;
+
+    InitializeLib(ImageHandle, SystemTable);
+    gSystemTable = SystemTable;
+    gImageHandle = ImageHandle;
+
+    status = uefi_call_wrapper(SystemTable->BootServices->HandleProtocol,
+                               3,
+                               ImageHandle,
+                               &LoadedImageProtocol,
+                               (void **)&loaded_image);
+
+    if (status == EFI_SUCCESS)
+        wolfBoot_printf("Image base: 0x%lx\n", loaded_image->ImageBase);
+    vol = GetVolume(ImageHandle);
+    read_cmdline(vol);
+    open_kernel_image(vol, kernel_filename, &kernel_addr, &kernel_size);
+    open_kernel_image(vol, update_filename, &update_addr, &update_size);
+
+    if (kernel_addr == 0 && update_addr == 0) {
+        wolfBoot_printf("No image to load\n");
+        panic();
+    }
+
+    wolfBoot_start();
+
+    return EFI_SUCCESS;
+}
+
+#endif /* TARGET_aarch64_efi */
diff --git a/hal/aarch64_efi.ld b/hal/aarch64_efi.ld
new file mode 100644
index 0000000000..c38b3a4446
--- /dev/null
+++ b/hal/aarch64_efi.ld
@@ -0,0 +1,3 @@
+# aarch64_efi is a UEFI application target; the link uses the linker script
+# provided by gnu-efi (elf_aarch64_efi.lds via GNU_EFI_LSCRIPT). This is an
+# empty file to appease the Makefile (mirrors hal/x86_64_efi.ld).
diff --git a/src/boot_aarch64_efi.c b/src/boot_aarch64_efi.c
new file mode 100644
index 0000000000..fc65c21da7
--- /dev/null
+++ b/src/boot_aarch64_efi.c
@@ -0,0 +1,49 @@
+/* boot_aarch64_efi.c
+ *
+ * Copyright (C) 2026 wolfSSL Inc.
+ *
+ * This file is part of wolfBoot.
+ *
+ * wolfBoot is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfBoot is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+
+/* AArch64 UEFI-application boot glue (generic AArch64 UEFI target).
+ *
+ * When wolfBoot is built as a UEFI application the gnu-efi CRT0 is the entry
+ * point and efi_main() (hal/aarch64_efi.c) does all the work, so none of the
+ * bare-metal reset / EL2->EL1 / cache-teardown path in boot_aarch64.c applies.
+ * This provides the do_boot() the updater (src/update_ram.c) calls; it simply
+ * forwards the verified image to the UEFI LoadImage/StartImage handoff in
+ * hal/aarch64_efi.c. Mirrors src/boot_x86_64.c. */
+
+#include <stdint.h>
+
+#include "image.h"
+#include "loader.h"
+#include "wolfboot/wolfboot.h"
+
+#ifdef TARGET_aarch64_efi
+
+/* aarch64_efi never defines MMU (UEFI owns MMU/FDT), so do_boot has only the
+ * app-only form; it forwards the verified image to the LoadImage/StartImage
+ * handoff in hal/aarch64_efi.c. */
+extern void RAMFUNCTION aarch64_efi_do_boot(uint32_t *boot_addr);
+
+void RAMFUNCTION do_boot(const uint32_t *app_offset)
+{
+    aarch64_efi_do_boot((uint32_t *)app_offset);
+}
+
+#endif /* TARGET_aarch64_efi */
diff --git a/tools/keytools/keygen.c b/tools/keytools/keygen.c
index 0482305dee..3751f588af 100644
--- a/tools/keytools/keygen.c
+++ b/tools/keytools/keygen.c
@@ -156,7 +156,7 @@ const char Store_hdr[] = "\n"
     "#define KEYSTORE_SECTION __attribute__((section (\"__KEYSTORE,__keystore\")))\n"
     "#elif defined(__CCRX__) || defined(WOLFBOOT_RENESAS_RSIP) || defined(WOLFBOOT_RENESAS_TSIP) || defined(WOLFBOOT_RENESAS_SCEPROTECT)\n"
     "#define KEYSTORE_SECTION /* Renesas RX */\n"
-    "#elif defined(TARGET_x86_64_efi)\n"
+    "#elif defined(TARGET_x86_64_efi) || defined(TARGET_aarch64_efi)\n"
     "#define KEYSTORE_SECTION\n"
     "#else\n"
     "#define KEYSTORE_SECTION __attribute__((section (\".keystore\")))\n"
diff --git a/tools/scripts/aarch64-efi-qemu.sh b/tools/scripts/aarch64-efi-qemu.sh
new file mode 100644
index 0000000000..d707ea9e40
--- /dev/null
+++ b/tools/scripts/aarch64-efi-qemu.sh
@@ -0,0 +1,45 @@
+#!/bin/bash
+# Run the aarch64_efi wolfboot.efi in QEMU aarch64 UEFI for fast iteration/debug.
+# No hardware / USB stick needed: a scratch dir is exposed to UEFI as a FAT ESP.
+#
+#   ./tools/scripts/aarch64-efi-qemu.sh            # run, auto-launch wolfboot.efi
+#   ./tools/scripts/aarch64-efi-qemu.sh --gdb      # freeze at reset for gdb (-s -S)
+#
+# In another shell for --gdb:
+#   gdb-multiarch wolfboot.elf -ex 'target remote :1234'
+set -e
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+ESP="$ROOT/tools/qemu-esp"
+CODE=/usr/share/AAVMF/AAVMF_CODE.fd
+VARS_SRC=/usr/share/AAVMF/AAVMF_VARS.fd
+
+for f in "$CODE" "$VARS_SRC"; do
+    [ -r "$f" ] || { echo "Missing $f -- install qemu-efi-aarch64"; exit 1; }
+done
+command -v qemu-system-aarch64 >/dev/null || { echo "Install qemu-system-arm"; exit 1; }
+
+mkdir -p "$ESP"
+cp "$ROOT/wolfboot.efi" "$ESP"/
+cp "$ROOT/aarch64_efi-stage/kernel.img" "$ESP"/ 2>/dev/null || true
+# optional Linux kernel command line (M3): read by wolfboot as \cmdline.txt
+cp "$ROOT/aarch64_efi-stage/cmdline.txt" "$ESP"/ 2>/dev/null || true
+# auto-run wolfboot.efi from the UEFI shell
+printf 'fs0:\r\nwolfboot.efi\r\n' > "$ESP/startup.nsh"
+
+VARS="$ROOT/tools/qemu-esp/AAVMF_VARS.fd"
+cp "$VARS_SRC" "$VARS"
+
+GDB_ARGS=""
+if [ "$1" = "--gdb" ]; then
+    GDB_ARGS="-s -S"
+    echo "GDB mode: qemu frozen. In another shell:"
+    echo "  gdb-multiarch $ROOT/wolfboot.elf -ex 'target remote :1234'"
+fi
+
+exec qemu-system-aarch64 \
+    -machine virt -cpu cortex-a72 -m 1024 -smp 1 \
+    -drive if=pflash,format=raw,file="$CODE",readonly=on \
+    -drive if=pflash,format=raw,file="$VARS" \
+    -drive format=raw,file=fat:rw:"$ESP" \
+    -net none -nographic $GDB_ARGS
diff --git a/tools/scripts/build-gnu-efi-aarch64.sh b/tools/scripts/build-gnu-efi-aarch64.sh
new file mode 100644
index 0000000000..5e746d0427
--- /dev/null
+++ b/tools/scripts/build-gnu-efi-aarch64.sh
@@ -0,0 +1,44 @@
+#!/bin/bash
+# Build gnu-efi for AArch64 (for the wolfBoot aarch64_efi UEFI target).
+# Installs crt0-efi-aarch64.o, elf_aarch64_efi.lds, libgnuefi.a, libefi.a
+# and the EFI headers into tools/gnu-efi-aarch64/ inside the wolfBoot tree.
+#
+# GNU_EFI_REF is pinned to a released tag so the runtime CRT0/linker-script/libs
+# are reproducible and auditable (the aarch64_efi link depends on the exact
+# revision -- see the --allow-multiple-definition note in arch.mk). Override:
+#   CROSS_COMPILE=... GNU_EFI_REF=... ./build-gnu-efi-aarch64.sh
+set -e
+
+CROSS_COMPILE="${CROSS_COMPILE:-aarch64-linux-gnu-}"
+GNU_EFI_REF="${GNU_EFI_REF:-4.0.4}"
+
+# Resolve wolfBoot root (this script lives in tools/scripts/)
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PREFIX="$ROOT/tools/gnu-efi-aarch64"
+SRC="$ROOT/tools/gnu-efi-src"
+
+echo "== gnu-efi aarch64 build =="
+echo "   CROSS_COMPILE=$CROSS_COMPILE"
+echo "   PREFIX=$PREFIX"
+
+# gnu-efi upstream (Nigel Croxon, the gnu-efi maintainer). Pin to $GNU_EFI_REF;
+# if the tree already exists, force it onto that ref (reproducible re-runs).
+if [ ! -d "$SRC/.git" ]; then
+    git clone --depth 1 -b "$GNU_EFI_REF" https://github.com/ncroxon/gnu-efi "$SRC"
+else
+    git -C "$SRC" fetch --depth 1 origin tag "$GNU_EFI_REF" 2>/dev/null \
+        || git -C "$SRC" fetch --depth 1 origin "$GNU_EFI_REF"
+    git -C "$SRC" checkout -q "$GNU_EFI_REF" 2>/dev/null \
+        || git -C "$SRC" checkout -q FETCH_HEAD
+    make -C "$SRC" ARCH=aarch64 clean >/dev/null 2>&1 || true
+fi
+
+make -C "$SRC" ARCH=aarch64 CROSS_COMPILE="$CROSS_COMPILE" -j"$(nproc)"
+make -C "$SRC" ARCH=aarch64 CROSS_COMPILE="$CROSS_COMPILE" \
+    PREFIX=/ INSTALLROOT="$PREFIX" install
+
+echo "== installed files =="
+find "$PREFIX" -name 'crt0-efi-aarch64.o' -o -name 'elf_aarch64_efi.lds' \
+    -o -name 'libgnuefi.a' -o -name 'libefi.a' | sort
+echo "== done =="