diff --git a/src/confd/bin/Makefile.am b/src/confd/bin/Makefile.am
index 134fd6b2..6db87262 100644
--- a/src/confd/bin/Makefile.am
+++ b/src/confd/bin/Makefile.am
@@ -1,2 +1,2 @@
 pkglibexec_SCRIPTS  = bootstrap error load \
-		      gen-hostkeys gen-admin-auth gen-hostname gen-interfaces gen-motd
+		      gen-hostkeys gen-admin-auth gen-hostname gen-interfaces gen-motd gen-hardware
diff --git a/src/confd/bin/bootstrap b/src/confd/bin/bootstrap
index bc2d1f03..8f0e83f9 100755
--- a/src/confd/bin/bootstrap
+++ b/src/confd/bin/bootstrap
@@ -98,6 +98,7 @@ factory()
     # Create an overlay for /etc/hostname to change the default in an br2-external
     gen-hostname                                            >"$FACTORY_D/20-hostname.json"
     gen-motd                                                >"$FACTORY_D/20-motd.json"
+    gen-hardware                                            >"$FACTORY_D/20-hardware.json"
     # shellcheck disable=SC2086
     gen-interfaces $GEN_IFACE_OPTS                          >"$FACTORY_D/20-interfaces.json"
 
diff --git a/src/confd/bin/gen-hardware b/src/confd/bin/gen-hardware
new file mode 100755
index 00000000..f0bede4e
--- /dev/null
+++ b/src/confd/bin/gen-hardware
@@ -0,0 +1,26 @@
+#!/bin/sh
+set -e
+
+usb_ports=$(cat /run/system.json | jq -r '.["usb-ports"] | map(.name) | unique | join(" ")')
+
+gen_port()
+{
+	local port="$1"
+	cat <<EOF
+    	{
+		"class": "infix-hardware:usb",
+		"name": "$port",
+		"state": {
+    			"admin-state": "unlocked"
+  			}
+    	}
+EOF
+}
+cat <<EOF
+{
+  "ietf-hardware:hardware": {
+    "component": [
+    $(for port in $usb_ports; do gen_port "$port"; done)
+    ]}
+}
+EOF