diff --git a/src/include/cbmem.h b/src/include/cbmem.h
index c5cd52a80b..07e5645397 100644
--- a/src/include/cbmem.h
+++ b/src/include/cbmem.h
@@ -84,6 +84,7 @@
 #define CBMEM_ID_STAGEx_CACHE	0x57a9e100
 #define CBMEM_ID_TIMESTAMP	0x54494d45
 #define CBMEM_ID_VBOOT_HANDOFF	0x780074f0
+#define CBMEM_ID_VBOOT_WORKBUF	0x78007343
 #define CBMEM_ID_WIFI_CALIBRATION 0x57494649
 
 #ifndef __ASSEMBLER__
@@ -128,6 +129,7 @@
 	{ CBMEM_ID_SPINTABLE,		"SPIN TABLE " }, \
 	{ CBMEM_ID_TIMESTAMP,		"TIME STAMP " }, \
 	{ CBMEM_ID_VBOOT_HANDOFF,	"VBOOT      " }, \
+	{ CBMEM_ID_VBOOT_WORKBUF,	"VBOOT WORK " }, \
 	{ CBMEM_ID_WIFI_CALIBRATION,	"WIFI CLBR  " },
 
 struct cbmem_entry;
diff --git a/src/vendorcode/google/chromeos/vboot2/Kconfig b/src/vendorcode/google/chromeos/vboot2/Kconfig
index bb6c1add0a..a086785e3f 100644
--- a/src/vendorcode/google/chromeos/vboot2/Kconfig
+++ b/src/vendorcode/google/chromeos/vboot2/Kconfig
@@ -101,3 +101,13 @@ config VBOOT_BOOT_LOADER_INDEX
 	help
 	  This is the index of the bootloader component in the verified
 	  firmware block.
+
+config VBOOT_DYNAMIC_WORK_BUFFER
+	bool "Vboot's work buffer is dynamically allocated."
+	default n
+	depends on VBOOT_VERIFY_FIRMWARE
+	help
+	  This option is used when there isn't enough pre-main memory
+	  ram to allocate the vboot work buffer. That means vboot verification
+	  is after memory init and requires main memory to back the work
+	  buffer.
diff --git a/src/vendorcode/google/chromeos/vboot2/common.c b/src/vendorcode/google/chromeos/vboot2/common.c
index 289005c996..deb0c8816c 100644
--- a/src/vendorcode/google/chromeos/vboot2/common.c
+++ b/src/vendorcode/google/chromeos/vboot2/common.c
@@ -18,6 +18,7 @@
  */
 
 #include <cbfs.h>
+#include <cbmem.h>
 #include <console/console.h>
 #include <reset.h>
 #include "../chromeos.h"
@@ -25,14 +26,23 @@
 #include "../vboot_handoff.h"
 #include "misc.h"
 
+static const size_t vb_work_buf_size = 16 * KiB;
+
 struct vb2_working_data * const vboot_get_working_data(void)
 {
-	return (struct vb2_working_data *)_vboot2_work;
+	if (IS_ENABLED(CONFIG_VBOOT_DYNAMIC_WORK_BUFFER))
+		/* cbmem_add() does a cbmem_find() first. */
+		return cbmem_add(CBMEM_ID_VBOOT_WORKBUF, vb_work_buf_size);
+	else
+		return (struct vb2_working_data *)_vboot2_work;
 }
 
 size_t vb2_working_data_size(void)
 {
-	return _vboot2_work_size;
+	if (IS_ENABLED(CONFIG_VBOOT_DYNAMIC_WORK_BUFFER))
+		return vb_work_buf_size;
+	else
+		return _vboot2_work_size;
 }
 
 void *vboot_get_work_buffer(struct vb2_working_data *wd)