diff --git a/distro/update/keys/repository.pub b/distro/update/keys/repository.pub
new file mode 100644
index 0000000..f208b08
--- /dev/null
+++ b/distro/update/keys/repository.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG/zdos/update/key/placeholder zdos-update-repo-key
diff --git a/distro/update/rollback-policy.yaml b/distro/update/rollback-policy.yaml
new file mode 100644
index 0000000..f69b2f2
--- /dev/null
+++ b/distro/update/rollback-policy.yaml
@@ -0,0 +1,6 @@
+policy: "ZDOS Rollback Policy"
+mechanism: "A/B_slots"
+conditions:
+  - "boot_failure"
+  - "kernel_panic"
+boot_attempts_before_rollback: 3
diff --git a/distro/update/update-policy.yaml b/distro/update/update-policy.yaml
new file mode 100644
index 0000000..26f992e
--- /dev/null
+++ b/distro/update/update-policy.yaml
@@ -0,0 +1,8 @@
+policy: "ZDOS Update Policy"
+channels:
+  - "stable"
+  - "preview"
+requirements:
+  minimum_version: "0.2.0"
+  signature_verification: strict
+offline_updates: supported
diff --git a/distro/verity/roothash.pub b/distro/verity/roothash.pub
new file mode 100644
index 0000000..f41869a
--- /dev/null
+++ b/distro/verity/roothash.pub
@@ -0,0 +1 @@
+# Placeholder per la chiave/hash dm-verity per proteggere il rootfs