diff --git a/Makefile b/Makefile
index cbc3b03a1..df6f5b364 100644
--- a/Makefile
+++ b/Makefile
@@ -19,8 +19,10 @@ DOCKER_TAG := testing
 PLATFORM := linux/amd64,linux/arm64,linux/arm/v6
 
 # gokrazy image
-IMAGE_FILE := evcc_$(TAG_NAME).image
-IMAGE_OPTIONS := -hostname evcc -http_port 8080 github.com/gokrazy/serial-busybox github.com/gokrazy/breakglass github.com/gokrazy/mkfs github.com/gokrazy/wifi github.com/evcc-io/evcc
+GOK_DIR := packaging/gokrazy
+GOK_NETDEV := user,id=net0,hostfwd=tcp::8080-:80,hostfwd=tcp::8022-:22,hostfwd=tcp::8888-:8080
+GOK := gok -i evcc --parent_dir $(GOK_DIR)
+IMAGE_FILE := evcc_$(TAG_NAME).img
 
 # deb
 PACKAGES = ./release
@@ -104,25 +106,32 @@ apt-release::
 		cloudsmith push deb evcc/stable/any-distro/any-version $(file); \
 	)
 
-# gokrazy image
-gokrazy::
-	go install github.com/gokrazy/tools/cmd/gokr-packer@main
-	mkdir -p flags/github.com/gokrazy/breakglass
-	echo "-forward=private-network" > flags/github.com/gokrazy/breakglass/flags.txt
-	mkdir -p env/github.com/evcc-io/evcc
-	echo "EVCC_NETWORK_PORT=80" > env/github.com/evcc-io/evcc/env.txt
-	echo "EVCC_DATABASE_DSN=/perm/evcc.db" >> env/github.com/evcc-io/evcc/env.txt
-	mkdir -p buildflags/github.com/evcc-io/evcc
-	echo "$(BUILD_TAGS),gokrazy" > buildflags/github.com/evcc-io/evcc/buildflags.txt
-	echo "-ldflags=$(LD_FLAGS)" >> buildflags/github.com/evcc-io/evcc/buildflags.txt
-	gokr-packer -hostname evcc -http_port 8080 -overwrite=$(IMAGE_FILE) -target_storage_bytes=1258299392 $(IMAGE_OPTIONS)
+# gokrazy
+gok::
+	which gok || go install github.com/gokrazy/tools/cmd/gok@main
+	# https://stackoverflow.com/questions/1250079/how-to-escape-single-quotes-within-single-quoted-strings
+	sed 's!"GoBuildFlags": null!"GoBuildFlags": ["$(BUILD_TAGS) -trimpath -ldflags='"'"'$(LD_FLAGS)'"'"'"]!g' $(GOK_DIR)/config.tmpl.json > $(GOK_DIR)/evcc/config.json
+	${GOK} add .
+	# ${GOK} add tailscale.com/cmd/tailscaled
+	# ${GOK} add tailscale.com/cmd/tailscale
+
+# build image
+gok-image:: gok
+	${GOK} overwrite --full=$(IMAGE_FILE) --target_storage_bytes=1258299392
 	# gzip -f $(IMAGE_FILE)
 
-gokrazy-run::
-	MACHINE=arm64 IMAGE_FILE=$(IMAGE_FILE) ./packaging/gokrazy/run.sh
+# run qemu
+gok-run:: gok
+	${GOK} vm run --netdev $(GOK_NETDEV)
 
-gokrazy-update::
-	gokr-packer -update yes $(IMAGE_OPTIONS)
+# run qemu on mac
+gok-mac:: gok
+	mv $(GOK_DIR)/evcc/config.json $(GOK_DIR)/evcc/linux.json
+	sed 's!"SerialConsole": "ttyAMA0,115200"!"KernelPackage": "github.com/gokrazy/kernel.arm64",'\\n'    "SerialConsole": "ttyAMA0,115200"!g' $(GOK_DIR)/evcc/linux.json > $(GOK_DIR)/evcc/config.json
+	${GOK} vm run --netdev $(GOK_NETDEV)
+
+gok-update::
+	${GOK} update yes $(IMAGE_OPTIONS)
 
 soc::
 	@echo Version: $(VERSION) $(SHA) $(BUILD_DATE)
diff --git a/cmd/root.go b/cmd/root.go
index d5cbb4cd7..e453aed3f 100644
--- a/cmd/root.go
+++ b/cmd/root.go
@@ -290,7 +290,8 @@ func runRoot(cmd *cobra.Command, args []string) {
 
 	httpd.RegisterSystemHandler(valueChan, cache, auth, func() {
 		log.INFO.Println("evcc was stopped by user. OS should restart the service. Or restart manually.")
-		once.Do(func() { close(stopC) }) // signal loop to end
+		err = errors.New("restart required") // https://gokrazy.org/development/process-interface/
+		once.Do(func() { close(stopC) })     // signal loop to end
 	})
 
 	// show and check version, reduce api load during development
diff --git a/packaging/gokrazy/config.tmpl.json b/packaging/gokrazy/config.tmpl.json
new file mode 100644
index 000000000..50f50f93e
--- /dev/null
+++ b/packaging/gokrazy/config.tmpl.json
@@ -0,0 +1,44 @@
+{
+    "Hostname": "evcc",
+    "Update": {
+        "HTTPPort": "8080",
+        "HTTPPassword": "HjJv6aBX51G4wT8EueCc"
+    },
+    "Packages": [
+        "github.com/gokrazy/breakglass",
+        "tailscale.com/cmd/tailscaled",
+        "tailscale.com/cmd/tailscale",
+        "github.com/gokrazy/mkfs",
+        "github.com/gokrazy/fbstatus",
+        "github.com/gokrazy/serial-busybox",
+        "github.com/gokrazy/wifi"
+    ],
+    "PackageConfig": {
+        "github.com/evcc-io/evcc": {
+            "GoBuildFlags": null,
+            "Environment": [
+                "EVCC_NETWORK_PORT=80",
+                "EVCC_DATABASE_DSN=/perm/evcc.db"
+            ],
+            "ExtraFileContents": {
+                "/etc/evcc.yaml": " "
+            }
+        },
+        "github.com/gokrazy/breakglass": {
+            "CommandLineFlags": [
+                "-authorized_keys=/etc/breakglass.authorized_keys",
+                "-forward=private-network"
+            ],
+            "ExtraFileContents": {
+                "/etc/breakglass.authorized_keys": " "
+            }
+        },
+        "tailscale.com/cmd/tailscale": {
+            "CommandLineFlags": [
+                "up",
+                "--ssh=true"
+            ]
+        }
+    },
+    "SerialConsole": "ttyAMA0,115200"
+}
\ No newline at end of file
diff --git a/packaging/gokrazy/run.sh b/packaging/gokrazy/run.sh
deleted file mode 100755
index 7b992ed17..000000000
--- a/packaging/gokrazy/run.sh
+++ /dev/null
@@ -1,102 +0,0 @@
-#!/usr/bin/env bash
-
-imagefile="${IMAGE_FILE:=drive.img}"
-arch="${MACHINE:=amd64}"
-os=""
-
-if [ "$(uname)" == "Darwin" ]; then
-	os="darwin"
-elif [ "$(expr substr $(uname -s) 1 5)" == "Linux" ]; then
-	os="linux"
-fi
-
-case $arch in
-	# arm64 emulator with kernel auto loading
-	arm64)
-		args=(
-			-name gokrazy-arm64
-			-m 3G
-			-smp 2
-			-M virt,highmem=off
-			-cpu cortex-a72
-			-nographic
-			-drive file=${imagefile},format=raw
-			-bios ./packaging/gokrazy/QEMU_EFI.fd
-		)
-
-		if [[ "$os" == "darwin" ]]; then
-			args+=(-nic vmnet-shared)
-		else
-			args+=(-netdev user,id=net0,hostfwd=tcp::8080-:80,hostfwd=tcp::2222-:22)
-			args+=(-device e1000,netdev=net0)
-		fi
-		qemu-system-aarch64 "${args[@]}"
-		;;
-
-	# raspi3b emulator with manual kernel loading
-	# requires kernel (./vmlinuz) and dtb file extraction from the drive.img,
-	# to be used as an arg (with -dtb, -kernel and -append)
-	# to instruct the vm on how to load the kernel
-	raspi3b)
-		if [[ "$os" == "darwin" ]]; then
-			args+=(-nic vmnet-shared)
-		fi
-
-		# Only works with qemu === v5.2.0
-		# because for lower versions networking is missing.
-		# It was introduced in qemu v5.2.0 via usb networking (-device usb-net), but it is very very slow at the point that gokrazy network updates fail.
-		# For qemu versions >= v6.0.0, the /gokrazy/init process crashes early at gokrazy.Boot(). To be investigated.
-		qemu_version="$(qemu-system-aarch64 --version | sed -nr 's/^.*version\s([.0-9]*).*$/\1/p')"
-		if [[ "$qemu_version" != "5.2.0" ]]; then
-			echo "error: incompatible qemu-system-aarch64 version: $qemu_version. gokrazy on raspi3b can only run on 5.2.0"
-			exit 1
-		fi
-
-		# Extract the kernel (vmlinuz) and the dtb file from the drive.img first
-		./extract_kernel.sh
-		args=(
-			-name gokrazy-arm64-raspi3b
-			-m 1024
-			-no-reboot
-			-M raspi3b
-			-append "console=tty1 console=ttyAMA0,115200 dwc_otg.fiq_fsm_enable=0 root=/dev/mmcblk0p2 init=/gokrazy/init rootwait panic=10 oops=panic"
-			-dtb ./bcm2710-rpi-3-b-plus.dtb
-			-nographic
-			-serial mon:stdio
-			-drive file=${imagefile},format=raw
-			-kernel vmlinuz
-			-netdev user,id=net0,hostfwd=tcp::8080-:80,hostfwd=tcp::2222-:22
-			-device usb-net,netdev=net0
-		)
-
-		qemu-system-aarch64 "${args[@]}"
-		;;
-
-	# amd64 emulator with kernel auto loading
-	amd64)
-		args=(
-			-name gokrazy-amd64
-			-m 3G
-			-smp $(nproc)
-			-usb
-			-nographic
-			-serial mon:stdio
-			-boot order=d
-			-drive file=${imagefile},format=raw
-		)
-
-		if [[ "$os" == "darwin" ]]; then
-			args+=(-nic vmnet-shared)
-		else
-			args+=(-netdev user,id=net0,hostfwd=tcp::8080-:80,hostfwd=tcp::2222-:22)
-			args+=(-device e1000,netdev=net0)
-		fi
-
-		qemu-system-x86_64 "${args[@]}"
-		;;
-
-	*)
-		echo -n "unsupported arch ${arch}"
-		exit
-		;;
-esac