diff --git a/src/include/antirollback.h b/src/include/antirollback.h
index 942793a62b..5ba36f7e65 100644
--- a/src/include/antirollback.h
+++ b/src/include/antirollback.h
@@ -12,6 +12,7 @@
 #include "tpm_lite/tss_constants.h"
 
 struct vb2_context;
+enum vb2_pcr_digest;
 
 /* TPM NVRAM location indices. */
 #define FIRMWARE_NV_INDEX               0x1007
@@ -50,6 +51,12 @@ uint32_t antirollback_lock_space_firmware(void);
  * only.
  */
 
+/**
+ * Ask vboot for a digest and extend a TPM PCR with it.
+ */
+uint32_t tpm_extend_pcr(struct vb2_context *ctx, int pcr,
+			enum vb2_pcr_digest which_digest);
+
 /**
  * Issue a TPM_Clear and reenable/reactivate the TPM.
  */
diff --git a/src/lib/tlcl.c b/src/lib/tlcl.c
index c37b51a532..ccf4e8004b 100644
--- a/src/lib/tlcl.c
+++ b/src/lib/tlcl.c
@@ -320,7 +320,8 @@ uint32_t tlcl_extend(int pcr_num, const uint8_t* in_digest,
 	if (result != TPM_SUCCESS)
 		return result;
 
-	memcpy(out_digest, response + kTpmResponseHeaderLength,
-	       kPcrDigestLength);
+	if (out_digest)
+		memcpy(out_digest, response + kTpmResponseHeaderLength,
+		       kPcrDigestLength);
 	return result;
 }
diff --git a/src/vendorcode/google/chromeos/vboot2/antirollback.c b/src/vendorcode/google/chromeos/vboot2/antirollback.c
index f420d16114..407b19cecd 100644
--- a/src/vendorcode/google/chromeos/vboot2/antirollback.c
+++ b/src/vendorcode/google/chromeos/vboot2/antirollback.c
@@ -35,6 +35,23 @@
 		}							\
 	} while (0)
 
+
+uint32_t tpm_extend_pcr(struct vb2_context *ctx, int pcr,
+			enum vb2_pcr_digest which_digest)
+{
+	uint8_t buffer[VB2_PCR_DIGEST_RECOMMENDED_SIZE];
+	uint32_t size = sizeof(buffer);
+	int rv;
+
+	rv = vb2api_get_pcr_digest(ctx, which_digest, buffer, &size);
+	if (rv != VB2_SUCCESS)
+		return rv;
+	if (size < TPM_PCR_DIGEST)
+		return VB2_ERROR_UNKNOWN;
+
+	return tlcl_extend(pcr, buffer, NULL);
+}
+
 uint32_t tpm_clear_and_reenable(void)
 {
 	VBDEBUG("TPM: Clear and re-enable\n");
diff --git a/src/vendorcode/google/chromeos/vboot2/verstage.c b/src/vendorcode/google/chromeos/vboot2/verstage.c
index 06d76fe24a..0ce4e89246 100644
--- a/src/vendorcode/google/chromeos/vboot2/verstage.c
+++ b/src/vendorcode/google/chromeos/vboot2/verstage.c
@@ -205,6 +205,12 @@ static void save_if_needed(struct vb2_context *ctx)
 	}
 }
 
+static uint32_t extend_pcrs(struct vb2_context *ctx)
+{
+	return tpm_extend_pcr(ctx, 0, BOOT_MODE_PCR) ||
+	       tpm_extend_pcr(ctx, 1, HWID_DIGEST_PCR);
+}
+
 /**
  * Verify and select the firmware in the RW image
  *
@@ -248,6 +254,7 @@ void verstage_main(void)
 		printk(BIOS_INFO, "Recovery requested (%x)\n", rv);
 		/* If we need recovery mode, leave firmware selection now */
 		save_if_needed(&ctx);
+		extend_pcrs(&ctx);	/* ignore failures */
 		timestamp_add_now(TS_END_VBOOT);
 		return;
 	}
@@ -284,6 +291,14 @@ void verstage_main(void)
 		vboot_reboot();
 	}
 
+	rv = extend_pcrs(&ctx);
+	if (rv) {
+		printk(BIOS_WARNING, "Failed to extend TPM PCRs (%#x)\n", rv);
+		vb2api_fail(&ctx, VB2_RECOVERY_RO_TPM_U_ERROR, rv);
+		save_if_needed(&ctx);
+		vboot_reboot();
+	}
+
 	/* Lock TPM */
 	rv = antirollback_lock_space_firmware();
 	if (rv) {