diff --git a/stand/defs.mk b/stand/defs.mk
--- a/stand/defs.mk
+++ b/stand/defs.mk
@@ -62,6 +62,7 @@
 # LUAPATH is where we search for and install lua scripts.
 LUAPATH?=	/boot/lua
 FLUASRC?=	${SRCTOP}/libexec/flua
+FLUALIB?=	${SRCTOP}/lib/flua
 
 LIBSA=		${BOOTOBJ}/libsa/libsa.a
 .if ${MACHINE} == "i386"
diff --git a/stand/i386/loader/Makefile b/stand/i386/loader/Makefile
--- a/stand/i386/loader/Makefile
+++ b/stand/i386/loader/Makefile
@@ -33,7 +33,7 @@
 #
 # will tell you how many kiB of lomem are available.
 #
-LOADERSIZE?=	550000		# Largest known safe size for loader.bin
+LOADERSIZE?=	570000		# Largest known safe size for loader.bin
 
 .PATH:		${BOOTSRC}/i386/loader
 
diff --git a/stand/kboot/kboot/Makefile b/stand/kboot/kboot/Makefile
--- a/stand/kboot/kboot/Makefile
+++ b/stand/kboot/kboot/Makefile
@@ -60,4 +60,11 @@
 DPADD=		${LDR_INTERP} ${LIBOFW} ${LIBSAFDT} ${LIBSA} ${LIBKBOOT}
 LDADD=		${LDR_INTERP} ${LIBOFW} ${LIBSAFDT} ${LIBSA} ${LIBKBOOT}
 
+# Add our own lua bindings until they are universal
+.if ${LOADER_INTERP} == "lua"
+SRCS+=		\
+		lua_bindings.c
+CFLAGS.lua_bindings.c+=  -I${FLUALIB}/libhash
+.endif
+
 .include <bsd.prog.mk>
diff --git a/stand/kboot/kboot/lua_bindings.c b/stand/kboot/kboot/lua_bindings.c
new file mode 100644
--- /dev/null
+++ b/stand/kboot/kboot/lua_bindings.c
@@ -0,0 +1,19 @@
+/*
+ * Copyright (c) 2024 Netflix, Inc.
+ *
+ * SPDX-License-Identifier: BSD-2-Clause
+ */
+
+#include "lua.h"
+#include "lauxlib.h"
+#include "lutils.h"
+#include "lhash.h"
+
+static void
+lua_hash_bindings(lua_State *L)
+{
+	luaL_requiref(L, "hash", luaopen_hash, 1);
+	lua_pop(L, 1);	/* Remove lib */
+}
+
+LUA_COMPILE_SET(lua_hash_bindings);
diff --git a/stand/liblua/Makefile b/stand/liblua/Makefile
--- a/stand/liblua/Makefile
+++ b/stand/liblua/Makefile
@@ -27,6 +27,8 @@
 
 .PATH:	${FLUASRC}/modules
 SRCS+=	lfs.c
+.PATH:	${FLUALIB}/libhash
+SRCS+=	lhash.c
 
 WARNS?=	3
 
@@ -36,6 +38,7 @@
 CFLAGS+= -I${BOOTSRC}/include -I${LIBLUASRC} -I${LUASRC} -I${LDRSRC}
 
 CFLAGS.gfx_utils.c+= -I${SRCTOP}/sys/teken -I${SRCTOP}/contrib/pnglite
+CFLAGS.lhash.c+= -I${FLUALIB}/libhash -I${SRCTOP}/sys/crypto/sha2
 
 .if ${MACHINE_CPUARCH} == "amd64" && ${DO32:U0} == 0
 CFLAGS+=	-fPIC