diff --git a/Makefile b/Makefile
index a6d31b21..591d3b31 100644
--- a/Makefile
+++ b/Makefile
@@ -50,6 +50,12 @@ endif
 # By default, we are building for x86, up to a board to change this variable
 CONFIG_TARGET_ARCH := x86
 
+# Legacy flash boards have to be handled specifically for some functionality
+# (e.g. they don't generate upgrade packages, lack bash, etc.)  Use this to
+# guard behavior that is specific to legacy flash boards only.  Don't use it for
+# behavior that might be needed for other boards, use specific configs instead.
+CONFIG_LEGACY_FLASH := n
+
 include $(CONFIG)
 
 # Default update package extension is 'zip' unless a brand wants a branded
@@ -164,6 +170,9 @@ payload: $(build)/$(BOARD)/bzImage $(build)/$(initrd_dir)/initrd.cpio.xz
 
 ifeq ($(CONFIG_COREBOOT), y)
 
+# Legacy flash boards don't generate an update package, the only purpose of
+# those boards is to be flashed over vendor firmware via an exploit.
+ifneq ($(CONFIG_LEGACY_FLASH), y)
 # Coreboot targets create an update package that can be applied with integrity
 # verification before flashing (see flash-gui.sh).  The ZIP package format
 # allows other metadata that might be needed to added in the future without
@@ -174,6 +183,7 @@ $(board_build)/$(CB_UPDATE_PKG_FILE): $(board_build)/$(CB_OUTPUT_FILE)
 	cp "$<" "$(board_build)/update_pkg/"
 	cd "$(board_build)/update_pkg" && sha256sum "$(CB_OUTPUT_FILE)" >sha256sum.txt
 	cd "$(board_build)/update_pkg" && zip -9 "$@" "$(CB_OUTPUT_FILE)" sha256sum.txt
+endif
 
 all: $(board_build)/$(CB_OUTPUT_FILE) $(board_build)/$(CB_UPDATE_PKG_FILE)
 ifneq ($(CONFIG_COREBOOT_BOOTBLOCK),)
diff --git a/boards/UNTESTED_t430-legacy-flash/UNTESTED_t430-legacy-flash.config b/boards/UNTESTED_t430-legacy-flash/UNTESTED_t430-legacy-flash.config
index 3d8cdadb..b09fd7ef 100644
--- a/boards/UNTESTED_t430-legacy-flash/UNTESTED_t430-legacy-flash.config
+++ b/boards/UNTESTED_t430-legacy-flash/UNTESTED_t430-legacy-flash.config
@@ -30,6 +30,8 @@ export CONFIG_BOOTSCRIPT=/bin/xx30-flash.init
 export CONFIG_BOARD_NAME="ThinkPad T430-legacy-flash"
 export CONFIG_FLASHROM_OPTIONS="--force --noverify-all -p internal --ifd --image bios"
 
+CONFIG_LEGACY_FLASH=y
+
 # This board is "special" in that we need a 4MB top SPI flashable ROM.
 # This is enough to allow the board to boot into a minimal Heads and read the full Legacy
 # ROM from an external USB media.
diff --git a/boards/x230-legacy-flash/x230-legacy-flash.config b/boards/x230-legacy-flash/x230-legacy-flash.config
index 1ad51a0f..533b5912 100644
--- a/boards/x230-legacy-flash/x230-legacy-flash.config
+++ b/boards/x230-legacy-flash/x230-legacy-flash.config
@@ -31,6 +31,8 @@ export CONFIG_BOOTSCRIPT=/bin/xx30-flash.init
 export CONFIG_BOARD_NAME="ThinkPad X230-legacy-flash"
 export CONFIG_FLASHROM_OPTIONS="--force --noverify-all -p internal --ifd --image bios"
 
+CONFIG_LEGACY_FLASH=y
+
 # This board is "special" in that we need a 4MB top SPI flashable ROM.
 # This is enough to allow the board to boot into a minimal Heads and read the full Legacy
 # ROM from an external USB media.