diff --git a/MODULE.bazel b/MODULE.bazel
index edad5adc8af39a53287bb7290da1e84f80466a4d..35e4382d4de1b801e0690de1ec1220c8bee482fc 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -29,7 +29,7 @@ resolved = use_repo_rule("@toolchain_utils//toolchain/resolved:defs.bzl", "toolc
         name = "resolved-{}".format(kind),
         toolchain_type = "//labgrid/toolchain/{}:type".format(kind),
     )
-    for kind in ("executor", "qemu-system")
+    for kind in ("qemu-system", "qemu-img")
 ]
 
 register_toolchains("//labgrid/toolchain/...")
@@ -307,6 +307,10 @@ download_archive = use_repo_rule("@download_utils//download/archive:defs.bzl", "
         ("arm64", "qemu-system-x86", "7.2+dfsg-7+deb12u7", "q", "qemu", "sha256-r+gePAEzWb7l094dhRMRGwTAoqRDStPhIx2QbtCdz4M="),
         ("arm64", "tar", "1.34+dfsg-1.2+deb12u1", "t", "tar", "sha256-BKlF1PJAaPnUxEKUAU71oz/GF5pXAhl4r8fQg1jhPfM="),
         ("arm64", "zlib1g", "1.2.13.dfsg-1", "z", "zlib", "sha256-Uri4oUW74ZVruoIDT3cCLL7ww9CIXJ4y2YF6eTL+GRM="),
+
+        # qemu-img is part of qemu-utils
+        ("amd64", "qemu-utils", "7.2+dfsg-7+deb12u7", "q", "qemu", "sha256-0i92MwSRbc/9p8+Doz0xlNcDQaiqlHc6Adhg1+O3Q4A="),
+        ("arm64", "qemu-utils", "7.2+dfsg-7+deb12u7", "q", "qemu", "sha256-R4UJ3wFxoh3JdL1lpFUmT5PF3opsbUM9EPKtdSCYaWM="),
     )
 ]
 
diff --git a/debian/amd64/qemu-utils/BUILD.bazel b/debian/amd64/qemu-utils/BUILD.bazel
new file mode 100644
index 0000000000000000000000000000000000000000..211e8536b5f397337b49eeadf607d2252fc396e3
--- /dev/null
+++ b/debian/amd64/qemu-utils/BUILD.bazel
@@ -0,0 +1,14 @@
+load("//debian/launcher:defs.bzl", "debian_launcher")
+load("//debian/patchelf:defs.bzl", "debian_patchelf")
+load(":srcs.bzl", "SRCS")
+
+debian_patchelf(
+    name = "patched",
+    srcs = SRCS,
+)
+
+debian_launcher(
+    name = "qemu-img",
+    src = ":patched",
+    visibility = ["//:__subpackages__"],
+)
diff --git a/debian/amd64/qemu-utils/srcs.bzl b/debian/amd64/qemu-utils/srcs.bzl
new file mode 100644
index 0000000000000000000000000000000000000000..28e6365aea950f97f58b41a9b6279a8eaede34a1
--- /dev/null
+++ b/debian/amd64/qemu-utils/srcs.bzl
@@ -0,0 +1,28 @@
+visibility("//debian/amd64/qemu-utils/...")
+
+SRCS = (
+    "@amd64-gcc-12-base//:data.tar.xz",
+    "@amd64-libaio1//:data.tar.xz",
+    "@amd64-libblkid1//:data.tar.xz",
+    "@amd64-libc6//:data.tar.xz",
+    "@amd64-libffi8//:data.tar.xz",
+    "@amd64-libfuse3-3//:data.tar.xz",
+    "@amd64-libgcc-s1//:data.tar.xz",
+    "@amd64-libglib2.0-0//:data.tar.xz",
+    "@amd64-libgmp10//:data.tar.xz",
+    "@amd64-libgnutls30//:data.tar.xz",
+    "@amd64-libhogweed6//:data.tar.xz",
+    "@amd64-libidn2-0//:data.tar.xz",
+    "@amd64-libmount1//:data.tar.xz",
+    "@amd64-libnettle8//:data.tar.xz",
+    "@amd64-libnuma1//:data.tar.xz",
+    "@amd64-libp11-kit0//:data.tar.xz",
+    "@amd64-libpcre2-8-0//:data.tar.xz",
+    "@amd64-libselinux1//:data.tar.xz",
+    "@amd64-libtasn1-6//:data.tar.xz",
+    "@amd64-libunistring2//:data.tar.xz",
+    "@amd64-liburing2//:data.tar.xz",
+    "@amd64-libzstd1//:data.tar.xz",
+    "@amd64-qemu-utils//:data.tar.xz",
+    "@amd64-zlib1g//:data.tar.xz",
+)
diff --git a/debian/arm64/qemu-utils/BUILD.bazel b/debian/arm64/qemu-utils/BUILD.bazel
new file mode 100644
index 0000000000000000000000000000000000000000..211e8536b5f397337b49eeadf607d2252fc396e3
--- /dev/null
+++ b/debian/arm64/qemu-utils/BUILD.bazel
@@ -0,0 +1,14 @@
+load("//debian/launcher:defs.bzl", "debian_launcher")
+load("//debian/patchelf:defs.bzl", "debian_patchelf")
+load(":srcs.bzl", "SRCS")
+
+debian_patchelf(
+    name = "patched",
+    srcs = SRCS,
+)
+
+debian_launcher(
+    name = "qemu-img",
+    src = ":patched",
+    visibility = ["//:__subpackages__"],
+)
diff --git a/debian/arm64/qemu-utils/srcs.bzl b/debian/arm64/qemu-utils/srcs.bzl
new file mode 100644
index 0000000000000000000000000000000000000000..312846dc8ee22eaa82e99aba0f4563054dfb772b
--- /dev/null
+++ b/debian/arm64/qemu-utils/srcs.bzl
@@ -0,0 +1,28 @@
+visibility("//debian/arm64/qemu-utils/...")
+
+SRCS = (
+    "@arm64-gcc-12-base//:data.tar.xz",
+    "@arm64-libaio1//:data.tar.xz",
+    "@arm64-libblkid1//:data.tar.xz",
+    "@arm64-libc6//:data.tar.xz",
+    "@arm64-libffi8//:data.tar.xz",
+    "@arm64-libfuse3-3//:data.tar.xz",
+    "@arm64-libgcc-s1//:data.tar.xz",
+    "@arm64-libglib2.0-0//:data.tar.xz",
+    "@arm64-libgmp10//:data.tar.xz",
+    "@arm64-libgnutls30//:data.tar.xz",
+    "@arm64-libhogweed6//:data.tar.xz",
+    "@arm64-libidn2-0//:data.tar.xz",
+    "@arm64-libmount1//:data.tar.xz",
+    "@arm64-libnettle8//:data.tar.xz",
+    "@arm64-libnuma1//:data.tar.xz",
+    "@arm64-libp11-kit0//:data.tar.xz",
+    "@arm64-libpcre2-8-0//:data.tar.xz",
+    "@arm64-libselinux1//:data.tar.xz",
+    "@arm64-libtasn1-6//:data.tar.xz",
+    "@arm64-libunistring2//:data.tar.xz",
+    "@arm64-liburing2//:data.tar.xz",
+    "@arm64-libzstd1//:data.tar.xz",
+    "@arm64-qemu-utils//:data.tar.xz",
+    "@arm64-zlib1g//:data.tar.xz",
+)
diff --git a/labgrid/toolchain/qemu-img/BUILD.bazel b/labgrid/toolchain/qemu-img/BUILD.bazel
new file mode 100644
index 0000000000000000000000000000000000000000..e9c4580fd96c5da37a730b567ea1d8efa5355063
--- /dev/null
+++ b/labgrid/toolchain/qemu-img/BUILD.bazel
@@ -0,0 +1,46 @@
+load("@toolchain_utils//toolchain/info:defs.bzl", "toolchain_info")
+load("@toolchain_utils//toolchain/test:defs.bzl", "toolchain_test")
+
+toolchain_type(
+    name = "type",
+    visibility = ["//visibility:public"],
+)
+
+[
+    (
+        toolchain_info(
+            name = "{}-{}-qemu-img".format(cpu, os),
+            target = "//debian/{}/qemu-utils:qemu-img".format(cpu),
+            variable = "QEMU_IMG",
+        ),
+        toolchain(
+            name = "{}-{}-qemu-img-toolchain".format(cpu, os),
+            exec_compatible_with = [
+                "@platforms//cpu:{}".format({
+                    "amd64": "x86_64",
+                    "arm64": "aarch64",
+                }[cpu]),
+                "@platforms//os:{}".format(os),
+            ],
+            toolchain = "{}-{}-qemu-img".format(cpu, os),
+            toolchain_type = ":type",
+        ),
+    )
+    for cpu, os in (
+        ("amd64", "linux"),
+        ("arm64", "linux"),
+    )
+]
+
+alias(
+    name = "resolved",
+    actual = "@resolved-qemu-img",
+    visibility = ["//visibility:public"],
+)
+
+toolchain_test(
+    name = "test",
+    size = "small",
+    args = ["--version"],
+    toolchains = [":resolved"],
+)
diff --git a/qemu/debian/image/BUILD.bazel b/qemu/debian/image/BUILD.bazel
index 81e0b2c3c326a7f26441481fea12f554ffa7be0b..dbb29073c1e189436f1b8918c73d804c4fa02579 100644
--- a/qemu/debian/image/BUILD.bazel
+++ b/qemu/debian/image/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@bazel_skylib//rules:build_test.bzl", "build_test")
 
 alias(
-    name = "image",
+    name = "cloudvm",
     actual = select(
         {
             "@platforms//cpu:aarch64": "@arm64-debian.12-gnu-qemu//:image.qcow2",
@@ -9,7 +9,25 @@ alias(
         },
         no_match_error = "No QEMU Debian image for platform.",
     ),
-    visibility = ["//:__subpackages__"],
+    visibility = ["//visibility:private"],
+)
+
+genrule(
+    name = "resize",
+    srcs = [":cloudvm"],
+    outs = ["resized.qcow2"],
+    cmd = "$(CP) $< $@ && $(location //labgrid/toolchain/qemu-img:resolved) resize $@ +2G",
+    toolchains = [
+        "//labgrid/toolchain/qemu-img:resolved",
+        "@rules_coreutils//coreutils/toolchain/cp:resolved",
+    ],
+    visibility = ["//visibility:private"],
+)
+
+alias(
+    name = "image",
+    actual = ":resized.qcow2",
+    visibility = ["//visibility:public"],
 )
 
 build_test(