diff --git a/Makefile b/Makefile
index ff2cf39e0..2df5b6452 100644
--- a/Makefile
+++ b/Makefile
@@ -759,6 +759,7 @@ bin_modules-$(CONFIG_KBD) += kbd
 bin_modules-$(CONFIG_ZSTD) += zstd
 bin_modules-$(CONFIG_E2FSPROGS) += e2fsprogs
 bin_modules-$(CONFIG_EXFATPROGS) += exfatprogs
+bin_modules-$(CONFIG_NVMUTIL) += nvmutil
 
 $(foreach m, $(bin_modules-y), \
 	$(call map,initrd_bin_add,$(call bins,$m)) \
@@ -783,6 +784,9 @@ ifeq ($(CONFIG_COREBOOT),y)
 $(eval $(call initrd_bin_add,$(COREBOOT_UTIL_DIR)/cbmem/cbmem))
 #$(eval $(call initrd_bin_add,$(COREBOOT_UTIL_DIR)/superiotool/superiotool))
 #$(eval $(call initrd_bin_add,$(COREBOOT_UTIL_DIR)/inteltool/inteltool))
+ifeq ($(CONFIG_IFDTOOL),y)
+$(eval $(call initrd_bin_add,$(COREBOOT_UTIL_DIR)/ifdtool/ifdtool))
+endif
 endif
 
 $(COREBOOT_UTIL_DIR)/cbmem/cbmem \
@@ -798,6 +802,14 @@ $(COREBOOT_UTIL_DIR)/superiotool/superiotool: \
 	$(build)/$(zlib_dir)/.build \
 	$(build)/$(pciutils_dir)/.build \
 
+$(COREBOOT_UTIL_DIR)/ifdtool/ifdtool: $(build)/$(coreboot_dir)/.configured musl-cross-make
+	+$(call do,MAKE,$(notdir $@),\
+		$(MAKE) -C "$(dir $@)" \
+			DOTCONFIG="$(build)/$(coreboot_dir)/.config" \
+			$(CROSS_TOOLS) \
+			EXTRA_CFLAGS="-Wno-error" \
+	)
+
 #
 # --- INITRD IMAGE CREATION ---
 #
diff --git a/boards/EOL_t480-hotp-maximized/EOL_t480-hotp-maximized.config b/boards/EOL_t480-hotp-maximized/EOL_t480-hotp-maximized.config
index 70befdc5e..382a739c4 100644
--- a/boards/EOL_t480-hotp-maximized/EOL_t480-hotp-maximized.config
+++ b/boards/EOL_t480-hotp-maximized/EOL_t480-hotp-maximized.config
@@ -91,4 +91,8 @@ export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad T480-hotp-maximized"
 export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
 
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 BOARD_TARGETS := t480_me_blobs
diff --git a/boards/EOL_t480-maximized/EOL_t480-maximized.config b/boards/EOL_t480-maximized/EOL_t480-maximized.config
index e7c4a50ce..0ac0125d4 100644
--- a/boards/EOL_t480-maximized/EOL_t480-maximized.config
+++ b/boards/EOL_t480-maximized/EOL_t480-maximized.config
@@ -91,4 +91,8 @@ export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad T480-maximized"
 export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
 
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 BOARD_TARGETS := t480_me_blobs
diff --git a/boards/EOL_t480s-hotp-maximized/EOL_t480s-hotp-maximized.config b/boards/EOL_t480s-hotp-maximized/EOL_t480s-hotp-maximized.config
index 4f933d15c..c118e3dd8 100644
--- a/boards/EOL_t480s-hotp-maximized/EOL_t480s-hotp-maximized.config
+++ b/boards/EOL_t480s-hotp-maximized/EOL_t480s-hotp-maximized.config
@@ -91,4 +91,8 @@ export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad T480S-hotp-maximized"
 export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
 
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 BOARD_TARGETS := t480s_me_blobs
diff --git a/boards/EOL_t480s-maximized/EOL_t480s-maximized.config b/boards/EOL_t480s-maximized/EOL_t480s-maximized.config
index b1478cbc8..ca1903aa2 100644
--- a/boards/EOL_t480s-maximized/EOL_t480s-maximized.config
+++ b/boards/EOL_t480s-maximized/EOL_t480s-maximized.config
@@ -91,4 +91,8 @@ export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad T480S-maximized"
 export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
 
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 BOARD_TARGETS := t480s_me_blobs
diff --git a/boards/EOL_x230-hotp-maximized/EOL_x230-hotp-maximized.config b/boards/EOL_x230-hotp-maximized/EOL_x230-hotp-maximized.config
index cb06d1899..66f54b8b8 100644
--- a/boards/EOL_x230-hotp-maximized/EOL_x230-hotp-maximized.config
+++ b/boards/EOL_x230-hotp-maximized/EOL_x230-hotp-maximized.config
@@ -89,6 +89,10 @@ export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad X230-hotp-maximized"
 export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
 
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 #Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx30_me_blobs
 
diff --git a/boards/EOL_x230-maximized/EOL_x230-maximized.config b/boards/EOL_x230-maximized/EOL_x230-maximized.config
index f5edab489..746fc0d60 100644
--- a/boards/EOL_x230-maximized/EOL_x230-maximized.config
+++ b/boards/EOL_x230-maximized/EOL_x230-maximized.config
@@ -77,6 +77,10 @@ export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad X230-maximized"
 export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
 
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 #Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx30_me_blobs
 
diff --git a/boards/novacustom-v540tu/novacustom-v540tu.config b/boards/novacustom-v540tu/novacustom-v540tu.config
index 8cf4e7628..157efd88a 100644
--- a/boards/novacustom-v540tu/novacustom-v540tu.config
+++ b/boards/novacustom-v540tu/novacustom-v540tu.config
@@ -90,3 +90,7 @@ export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="NovaCustom V540TU"
 export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=n
+export CONFIG_IFDTOOL=n
diff --git a/boards/novacustom-v560tu/novacustom-v560tu.config b/boards/novacustom-v560tu/novacustom-v560tu.config
index 280c86018..7f5678de6 100644
--- a/boards/novacustom-v560tu/novacustom-v560tu.config
+++ b/boards/novacustom-v560tu/novacustom-v560tu.config
@@ -90,3 +90,8 @@ export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="NovaCustom V560TU"
 export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=n
+export CONFIG_IFDTOOL=n
+
diff --git a/initrd/bin/gui-init.sh b/initrd/bin/gui-init.sh
index ce03d953b..12f7d2bf8 100755
--- a/initrd/bin/gui-init.sh
+++ b/initrd/bin/gui-init.sh
@@ -628,8 +628,7 @@ show_main_menu() {
 
 show_options_menu() {
 	TRACE_FUNC
-	whiptail_type $BG_COLOR_MAIN_MENU --title "$CONFIG_BRAND_NAME Options" \
-		--menu "" 0 80 10 \
+	local menu_options=(
 		'b' ' Boot Options -->' \
 		't' ' TPM/TOTP/HOTP Options -->' \
 		'i' ' Investigate integrity discrepancies -->' \
@@ -637,6 +636,13 @@ show_options_menu() {
 		'u' ' Update checksums and sign all files in /boot' \
 		'c' ' Change configuration settings -->' \
 		'f' ' Flash/Update the BIOS -->' \
+	)
+
+	if [ "$CONFIG_NVMUTIL" = "y" ] && [ "$CONFIG_IFDTOOL" = "y" ]; then
+	      menu_options+=('m' ' Ethernet MAC address randomization -->')
+	fi
+
+	menu_options+=(
 		'g' ' GPG Options -->' \
 		'F' ' OEM Factory Reset / Re-Ownership -->' \
 		'C' ' Reencrypt LUKS container -->' \
@@ -644,6 +650,11 @@ show_options_menu() {
 		'R' ' Check/Update file hashes on root disk -->' \
 		'x' ' Exit to recovery shell' \
 		'r' ' <-- Return to main menu' \
+	)
+
+	whiptail_type $BG_COLOR_MAIN_MENU --title "$CONFIG_BRAND_NAME Options" \
+		--menu "" 0 80 10 \
+		"${menu_options[@]}" \
 		2>/tmp/whiptail || recovery "GUI menu failed"
 
 	option=$(cat /tmp/whiptail)
@@ -669,6 +680,9 @@ show_options_menu() {
 	f)
 		flash-gui.sh
 		;;
+	m)
+		mac_randomization_options_menu
+		;;
 	g)
 		gpg-gui.sh
 		;;
@@ -905,6 +919,128 @@ force_unsafe_boot() {
 	fi
 }
 
+clean_up_mac(){
+	# Don't leave temporary files lying around
+	if [ "$pwd" != "/tmp" ]; then
+		cd /tmp | return 1
+	fi
+
+	rm -f backup.* flashregion_*.bin
+}
+
+mac_randomization_options_menu() {
+	TRACE_FUNC
+	whiptail_type $BG_COLOR_MAIN_MENU --title "Ethernet MAC randomization" \
+		--menu "Select An Option" 0 80 10 \
+		'r' 'Generate a fully randomized ethernet MAC address' \
+		'i' 'Use a intel based universal pattern (OUI) to generate a random ethernet MAC address' \
+		's' 'Show the current ethernet MAC address' \
+		'm' ' <-- Return to main menu' \
+		2>/tmp/whiptail || recovery "GUI menu failed"
+
+	option=$(cat /tmp/whiptail)
+	case "$option" in
+	r)
+		change_mac "random"
+		;;
+	i)
+		change_mac "intel"
+		;;
+	s)
+		show_mac
+		clean_up_mac
+		;;
+	m) ;;
+
+	esac
+}
+
+# Show current MAC address
+show_mac(){
+	TRACE_FUNC
+	# Backup rom
+	flashprog -p internal -r /tmp/backup.rom
+	# test if file is > 0 byte
+	if [ ! -s /tmp/backup.rom ]; then
+		whiptail_error --title 'ERROR' --msgbox "Unable to read BIOS" 0 80
+		recovery
+	fi
+
+	cd /tmp
+	# Extract GBE from ifdtool
+	ifdtool -x backup.rom
+	if [ ! -s flashregion_3_gbe.bin ]; then
+		whiptail_error --title 'ERROR' --msgbox "Unable to extract gbe region" 0 80
+		recovery
+	fi
+
+	# Show just the current MAC, cut the rest
+	DUMP_OUTPUT=$(nvm flashregion_3_gbe.bin dump)
+	CURRENT_MAC=$(printf "%s\n" "$DUMP_OUTPUT" | sed -n '2p')
+	    whiptail_type $BG_COLOR_MAIN_MENU --title "Show current MAC address" --msgbox "Current MAC address: $CURRENT_MAC" 0 80
+}
+
+change_mac() {
+	TRACE_FUNC
+	local mac_type="$1"
+
+	show_mac
+
+	# Change MAC address randomly
+	# "nvmutil cannot specify multicast addresses"
+	# "nvmutil cannot specify 00:00:00:00:00:00"
+	# "randomly generated addresses are always unicast and local"
+	# See https://libreboot.org/docs/install/nvmutil.html
+
+	# Change MAC address randomly with intel OUI
+	# MAC Prefix: 00:1F:3B
+	# MAC Range: 00:1F:3B:00:00:00 - 00:1F:3B:FF:FF:FF
+	# See https://uic.io/en/mac/address/001f3b/
+	# There are a lot of prefixes from intel, this one is randomly picked
+
+	case "$mac_type" in
+		"random")
+			MAC_PATTERN="??:??:??:??:??:??"
+			;;
+		"intel")
+			MAC_PATTERN="00:1f:3b:??:??:??"
+			;;
+		*)
+			return 0
+			;;
+	esac
+
+	# Set mac to users choice
+	nvm flashregion_3_gbe.bin setmac "$MAC_PATTERN"
+
+	# Show MAC address to be flashed
+	NEWDUMP_OUTPUT=$(nvm flashregion_3_gbe.bin dump)
+	CHANGED_MAC=$(printf "%s\n" "$NEWDUMP_OUTPUT" | sed -n '2p')
+	whiptail_warning --title "Change ethernet MAC" --msgbox "Changed ethernet MAC address: $CHANGED_MAC" 0 80
+
+	# Decision: flash the new MAC address?
+	if whiptail_warning --title "Change ethernet MAC" --yesno "Do you really want to change the ethernet MAC address?" 0 80 --no-button "Do not change" --yes-button "Change"; then
+		# Insert modified GBE into backup.rom
+		if ! ifdtool -i gbe:flashregion_3_gbe.bin backup.rom; then
+			whiptail_error --title "Error" --msgbox "Failed to insert modified GBE!" 0 80
+			recovery
+		fi
+
+		# Flash back modified GBE only
+		if flashprog -p internal --ifd -i gbe -w backup.rom.new; then
+			whiptail_type $BG_COLOR_MAIN_MENU --title "Change ethernet MAC" --msgbox "Flashing completed successfully!" 0 80
+		else
+			whiptail_error --title "Error" --msgbox "Flashing FAILED!" 0 80
+			recovery
+		fi
+	else
+		whiptail_warning --title "Canceled" --msgbox "Ethernet MAC address change canceled." 0 80
+		clean_up_mac
+	fi
+
+	clean_up_mac
+}
+
 # gui-init start
 TRACE_FUNC
 
diff --git a/modules/nvmutil b/modules/nvmutil
new file mode 100644
index 000000000..570869bbe
--- /dev/null
+++ b/modules/nvmutil
@@ -0,0 +1,18 @@
+modules-$(CONFIG_NVMUTIL) += nvmutil
+
+nvmutil_version := 26.01rev1
+nvmutil_base_dir := lbmk
+nvmutil_dir := lbmk/util/nvmutil
+nvmutil_tar := $(nvmutil_version).tar.gz
+nvmutil_url := https://codeberg.org/libreboot/lbmk/archive/$(nvmutil_version).tar.gz
+nvmutil_hash := 05ad4171b211258afc4bc2211fac274566e63726016c735b9ca6742302488e3c
+
+
+nvmutil_configure :=
+nvmutil_target := \
+	$(MAKE_JOBS) \
+	$(CROSS_TOOLS) \
+	CFLAGS="$(CFLAGS) -Os -Wall -Wextra -std=c99 -pedantic"
+
+nvmutil_output := nvm
+nvmutil_depends := $(musl_dep)