diff --git a/release/Makefile.oracle b/release/Makefile.oracle
new file mode 100644
--- /dev/null
+++ b/release/Makefile.oracle
@@ -0,0 +1,85 @@
+#
+# Makefile for preparing & uploading Oracle Cloud images from existing
+# .raw files created by cloudware-release.
+#
+
+# base name for the final image to be uploaded via pre-approved curl URI
+# TODO check if this should this vary between snapshots & releases?
+ORACLE_BASENAME=	${OSRELEASE}-${BUILDDATE}-${GITREV}
+ORACLE_PORTS_LIST=	ftp/curl emulators/qemu@nox11 archivers/gtar
+CLEANFILES+=	cw-oracle-portinstall
+
+cw-oracle-portinstall: .PHONY
+.if !exists(/usr/local/bin/curl) || !exists(/usr/local/bin/qemu-img) || !exists(/usr/local/bin/gtar)
+. if !exists(${PORTSDIR}/Makefile)
+.  if !exists(/usr/local/sbin/pkg-static)
+	env ASSUME_ALWAYS_YES=yes pkg bootstrap -yf
+.  endif
+	env ASSUME_ALWAYS_YES=yes pkg install -y ${ORACLE_PORTS_LIST}
+. else
+	env UNAME_r=${UNAME_r} make -C \
+		${PORTSDIR}/archivers/gtar \
+	    BATCH=1 WRKDIRPREFIX=/tmp/ports DISTDIR=/tmp/distfiles \
+	    all install clean
+	env UNAME_r=${UNAME_r} make -C \
+		${PORTSDIR}/ftp/curl \
+	    BATCH=1 WRKDIRPREFIX=/tmp/ports DISTDIR=/tmp/distfiles \
+	    all install clean
+	# TODO we only need qemu-img but tools flavor does not do zstd yet
+	env UNAME_r=${UNAME_r} FLAVOR=nox11 make -C \
+		${PORTSDIR}/emulators/qemu \
+	    BATCH=1 WRKDIRPREFIX=/tmp/ports DISTDIR=/tmp/distfiles \
+	    all install clean
+. endif
+.endif
+
+.for _FS in ${ORACLE_FSLIST}
+ORACLE_OCI_LIST+=	cw-oracle-${_FS}.oci
+ORACLE_UPLOAD_LIST+=	cw-oracle-upload-${_FS}
+CLEANFILES+=		cw-oracle-${_FS}.oci
+ORACLE_TMP=		cw-oracle-${_FS}.oci.tmpdir
+CLEANFILES+=		${ORACLE_TMP}/output.QCOW2 ${ORACLE_TMP}/image_metadata.json
+ORACLE_METADATA=	${.CURDIR}/scripts/oracle/
+
+cw-oracle-${_FS}.oci: cw-oracle-${_FS}-raw
+	# TODO is this OK?
+	mkdir -p ${ORACLE_TMP}
+
+	# create architecture-specific metadata
+	env TARGET=${TARGET} OSRELEASE=${OSRELEASE} \
+		jq \
+		--slurpfile arm64 ${ORACLE_METADATA}/arm64.shapeCompatibilities.json \
+		--slurpfile amd64 ${ORACLE_METADATA}/amd64.shapeCompatibilities.json \
+		--rawfile caps ${ORACLE_METADATA}imageCapabilityData.json \
+		-f ${ORACLE_METADATA}/metadata.jq \
+		${ORACLE_METADATA}/base.json \
+		| jq . > ${ORACLE_TMP}/image_metadata.json
+
+	# convert raw image to native qcow2 to have zstd compression
+	# this saves ~ 8GiB per image
+	qemu-img convert -S 512b -p -O qcow2 -c -o compression_type=zstd \
+		${.OBJDIR}/${ORACLE${_FS:tu}RAWIMAGE} \
+		${ORACLE_TMP}/output.QCOW2
+
+	# TODO does OCI only support GNU tar format
+	gtar cf ${.TARGET} -C ${ORACLE_TMP} \
+		image_metadata.json output.QCOW2
+
+	# cleanup
+	rm -rf ${ORACLE_TMP}
+	echo "Oracle image ${.TARGET} is ready for upload."
+
+cw-oracle-upload-${_FS}: cw-oracle-${_FS}.oci
+.if !defined(ORACLE_PAR_URL) || empty(ORACLE_PAR_URL)
+	@echo "--------------------------------------------------------------"
+	@echo ">>> ORACLE_PAR_URL must be set for Oracle image upload"
+	@echo "--------------------------------------------------------------"
+	@false
+.endif
+	curl -s ${ORACLE_PAR_URL}/${ORACLE_BASENAME}-${_FS}.oci --upload-file cw-oracle-${_FS}.oci
+	echo "Oracle image cw-oracle-${_FS}.oci uploaded as ${ORACLE_BASENAME}-${_FS}.oci"
+	touch ${.TARGET}
+.endfor
+
+cw-oracle-prepare: ${ORACLE_OCI_LIST}
+cw-oracle-upload: cw-oracle-portinstall ${ORACLE_UPLOAD_LIST}
diff --git a/release/Makefile.vm b/release/Makefile.vm
--- a/release/Makefile.vm
+++ b/release/Makefile.vm
@@ -274,5 +274,6 @@
 .include "${.CURDIR}/Makefile.ec2"
 .include "${.CURDIR}/Makefile.firecracker"
 .include "${.CURDIR}/Makefile.gce"
+.include "${.CURDIR}/Makefile.oracle"
 .include "${.CURDIR}/Makefile.vagrant"
 .include "${.CURDIR}/Makefile.inc1"
diff --git a/release/scripts/oracle/amd64.shapeCompatibilities.json b/release/scripts/oracle/amd64.shapeCompatibilities.json
new file mode 100644
--- /dev/null
+++ b/release/scripts/oracle/amd64.shapeCompatibilities.json
@@ -0,0 +1 @@
+[]
diff --git a/release/scripts/oracle/arm64.shapeCompatibilities.json b/release/scripts/oracle/arm64.shapeCompatibilities.json
new file mode 100644
--- /dev/null
+++ b/release/scripts/oracle/arm64.shapeCompatibilities.json
@@ -0,0 +1,24 @@
+[
+  {
+    "internalShapeName": "VM.Standard.A1.Flex",
+    "ocpuConstraints": {
+      "min": 1,
+      "max": 80
+    },
+    "memoryConstraints": {
+      "minInGBs": 1,
+      "maxInGBs": 512
+    }
+  },
+  {
+    "internalShapeName": "VM.Standard.A2.Flex",
+    "ocpuConstraints": {
+      "min": 1,
+      "max": 78
+    },
+    "memoryConstraints": {
+      "minInGBs": 1,
+      "maxInGBs": 946
+    }
+  }
+]
diff --git a/release/scripts/oracle/base.json b/release/scripts/oracle/base.json
new file mode 100644
--- /dev/null
+++ b/release/scripts/oracle/base.json
@@ -0,0 +1,22 @@
+{
+  "version": 2,
+  "externalLaunchOptions": {
+    "firmware": "UEFI_64",
+    "networkType": "PARAVIRTUALIZED",
+    "bootVolumeType": "PARAVIRTUALIZED",
+    "remoteDataVolumeType": "PARAVIRTUALIZED",
+    "localDataVolumeType": "PARAVIRTUALIZED",
+    "launchOptionsSource": "PARAVIRTUALIZED",
+    "pvAttachmentVersion": 2,
+    "pvEncryptionInTransitEnabled": false,
+    "consistentVolumeNamingEnabled": false
+  },
+  "imageCapabilityData": "REPLACEME",
+  "imageCapsFormatVersion": "23cfd738-ad9c-4f56-9281-67be6c8cd14c",
+  "operatingSystem": "REPLACEME",
+  "operatingSystemVersion": "REPLACEME",
+  "additionalMetadata": {
+    "shapeCompatibilities": "REPLACEME"
+  }
+}
+
diff --git a/release/scripts/oracle/imageCapabilityData.json b/release/scripts/oracle/imageCapabilityData.json
new file mode 100644
--- /dev/null
+++ b/release/scripts/oracle/imageCapabilityData.json
@@ -0,0 +1 @@
+{"capabilities":{"Compute.AMD_SecureEncryptedVirtualization":{"descriptorType":"boolean","defaultValue":false},"Storage.BootVolumeType":{"descriptorType":"enumstring","values":["ISCSI","PARAVIRTUALIZED","SCSI","IDE","NVME"],"defaultValue":"PARAVIRTUALIZED"},"Storage.Iscsi.MultipathDeviceSupported":{"descriptorType":"boolean","defaultValue":false},"Storage.ParaVirtualization.EncryptionInTransit":{"descriptorType":"boolean","defaultValue":true},"Storage.ConsistentVolumeNaming":{"descriptorType":"boolean","defaultValue":true},"Compute.SecureBoot":{"descriptorType":"boolean","defaultValue":false},"Storage.ParaVirtualization.AttachmentVersion":{"descriptorType":"enuminteger","values":[1,2],"defaultValue":2},"Storage.LocalDataVolumeType":{"descriptorType":"enumstring","values":["ISCSI","PARAVIRTUALIZED","SCSI","IDE","NVME"],"defaultValue":"PARAVIRTUALIZED"},"Network.AttachmentType":{"descriptorType":"enumstring","values":["PARAVIRTUALIZED","VDPA"],"defaultValue":"PARAVIRTUALIZED"},"Storage.RemoteDataVolumeType":{"descriptorType":"enumstring","values":["ISCSI","PARAVIRTUALIZED","SCSI","IDE","NVME"],"defaultValue":"PARAVIRTUALIZED"},"Compute.LaunchMode":{"descriptorType":"enumstring","values":["NATIVE","EMULATED","VDPA","PARAVIRTUALIZED","CUSTOM"],"defaultValue":"PARAVIRTUALIZED"},"Network.IPv6Only":{"descriptorType":"boolean","defaultValue":false},"Compute.Firmware":{"descriptorType":"enumstring","values":["BIOS","UEFI_64"],"defaultValue":"UEFI_64"}}}
diff --git a/release/scripts/oracle/metadata.jq b/release/scripts/oracle/metadata.jq
new file mode 100644
--- /dev/null
+++ b/release/scripts/oracle/metadata.jq
@@ -0,0 +1,12 @@
+.
++ {
+	operatingSystem: "FreeBSD",
+	operatingSystemVersion: env.OSRELEASE,
+	imageCapabilityData: $caps,
+	additionalMetadata: {
+		shapeCompatibilities: (
+			if   env.TARGET == "arm64" then $arm64
+			elif env.TARGET == "amd64" then $amd64
+			else [] end )
+	}
+}