diff --git a/download-toolchain.sh b/download-toolchain.sh
index c166486..f397d12 100755
--- a/download-toolchain.sh
+++ b/download-toolchain.sh
@@ -14,7 +14,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-# Download the riscv-gnu-toolchain/LLVM source.
+# Download toolchain source.
 
 
 if [[ -z "${ROOTDIR}" ]]; then
@@ -22,7 +22,7 @@
   exit 1
 fi
 if [[ -z "$1" ]]; then
-  echo "Usage: download-toolchain.sh <gcc dir> [<TARGET> | GCC | LLVM | KELVIN]"
+  echo "Usage: download-toolchain.sh <gcc dir> [<TARGET> | GCC | LLVM | KELVIN | CHERIOT]"
   exit 1
 fi
 
@@ -32,83 +32,116 @@
 TOOLCHAIN_SRC="${OUT}/tmp/toolchain"
 LLVM_SRC="${TOOLCHAIN_SRC}/llvm-project"
 
+# Download from the http://github.com/riscv/riscv-gnu-toolchain. For proper
+# support of GDB symbol rendering, it requires a tag points to gcc 10.2.
+# NB: the riscv-binutils has to point to upstream binutil-gdb regardless of
+# what it is in .gitmodules
 TOOLCHAIN_TAG="2021.06.18"
+TOOLCHAIN_GCC_URL="https://github.com/riscv/riscv-gnu-toolchain"
 TOOLCHAINLLVM_BINUTILS_URL="git://sourceware.org/git/binutils-gdb.git"
 
+TOOLCHAIN_CHERIOT_TAG=
+TOOLCHAIN_CHERIOT_URL="https://github.com/CHERIoT-Platform/llvm-project"
+TOOLCHAIN_CHERIOT_SRC="${TOOLCHAIN_SRC}/cheriot-llvm-project"
+
 if [[ ! "${TOOLCHAIN_TARGET}" == "GCC" ]] &&
   [[ ! "${TOOLCHAIN_TARGET}" == "LLVM" ]] &&
-  [[ ! "${TOOLCHAIN_TARGET}" == "KELVIN" ]]; then
+  [[ ! "${TOOLCHAIN_TARGET}" == "KELVIN" ]] &&
+  [[ ! "${TOOLCHAIN_TARGET}" == "CHERIOT" ]]; then
   echo "Unsupported toochain target: ${TOOLCHAIN_TARGET}"
   exit 1
 fi
 
+function git_clone() {
+  local url="$1"
+  local src_dir="$2"
+  local opt_tag="$3"
+
+  if [[ -d "${src_dir}" ]]; then
+    echo "Remove existing ${src_dir}..."
+    rm -rf "${src_dir}"
+  fi
+
+  if [[ -n "${opt_tag}" ]]; then
+    echo "Downloading the toolchain source code from tag ${opt_tag}"
+    git clone "${url}" -b "${opt_tag}" "${src_dir}"
+  else
+    echo "Downloading the toolchain source code"
+    git clone "${url}" "${src_dir}"
+  fi
+}
+
 echo "Download toolchain for target ${TOOLCHAIN_TARGET}"
 
-if [[ -d "${TOOLCHAIN_GCC_SRC}" ]]; then
-  echo "Remove existing ${TOOLCHAIN_GCC_SRC}..."
-  rm -rf "${TOOLCHAIN_GCC_SRC}"
-fi
+case "${TOOLCHAIN_TARGET}" in
+GCC)
+  git_clone "${TOOLCHAIN_GCC_URL}" "${TOOLCHAIN_GCC_SRC}" "${TOOLCHAIN_TAG}"
 
-# Download from the http://github.com/riscv/riscv-gnu-toolchain. For proper
-# support of GDB symbol rendering, it requires a tag points to gcc 10.2.
-echo "Downloading the GNU toolchain source code from tag ${TOOLCHAIN_TAG}"
-git clone https://github.com/riscv/riscv-gnu-toolchain -b "${TOOLCHAIN_TAG}" \
-  "${TOOLCHAIN_GCC_SRC}"
+  # Update submodules.
+  pushd "${TOOLCHAIN_GCC_SRC}" > /dev/null
+    git submodule update --init --jobs=8 riscv-*
+  popd > /dev/null
+  ;;
+LLVM)
+  git_clone "${TOOLCHAIN_GCC_URL}" "${TOOLCHAIN_GCC_SRC}" "${TOOLCHAIN_TAG}"
 
-# Update the submodules. The riscv-binutils has to point to upstream binutil-gdb
-# regardless of what it is in .gitmodules
-pushd "${TOOLCHAIN_GCC_SRC}" > /dev/null
+  # Update submodules.
+  pushd "${TOOLCHAIN_GCC_SRC}" > /dev/null
+    git submodule update --init --jobs=8 riscv-*
 
-# CentOS7 git does not support parellel jobs.
-if [[ "${TOOLCHAIN_TARGET}" == "KELVIN" ]]; then
-  git submodule update --init riscv-*
-else
-  git submodule update --init --jobs=8 riscv-*
-fi
+    cd "riscv-binutils"
+    git remote set-url origin "${TOOLCHAINLLVM_BINUTILS_URL}"
+    git pull -f origin master --jobs=8 --depth=1
+    git checkout FETCH_HEAD
+  popd > /dev/null
 
-if [[ "${TOOLCHAIN_TARGET}" == "LLVM" ]]; then
-  cd "riscv-binutils"
-  git remote set-url origin "${TOOLCHAINLLVM_BINUTILS_URL}"
-  git pull -f origin master --jobs=8 --depth=1
-  git checkout FETCH_HEAD
-fi
-
-# Update riscv-binutils for kelvin to binutils 2.40
-if [[ "${TOOLCHAIN_TARGET}" == "KELVIN" ]]; then
-  cd "riscv-binutils"
-  git remote set-url origin "${TOOLCHAINLLVM_BINUTILS_URL}"
-  git fetch -f origin binutils-2_40 --depth=1
-  git checkout FETCH_HEAD
-fi
-popd > /dev/null
-
-# Download LLVM project if necessary. Always pull from main ToT.
-if [[ "${TOOLCHAIN_TARGET}" == "LLVM" ]]; then
+  # Download LLVM project if necessary. Always pull from main ToT.
   if [[ -d "${LLVM_SRC}" ]]; then
     echo "Removing existing ${LLVM_SRC}..."
     rm -rf "${LLVM_SRC}"
   fi
   mkdir -p "${LLVM_SRC}"
   pushd "${LLVM_SRC}" > /dev/null
-  git init
-  git remote add origin https://github.com/llvm/llvm-project
-  git pull origin main --jobs=8 --depth=1
+    git init
+    git remote add origin https://github.com/llvm/llvm-project
+    git pull origin main --jobs=8 --depth=1
   popd > /dev/null
-fi
+  ;;
+KELVIN)
+  git_clone "${TOOLCHAIN_GCC_URL}" "${TOOLCHAIN_GCC_SRC}" "${TOOLCHAIN_TAG}"
 
-# Patch Kelvin custom ops
-if [[ "${TOOLCHAIN_TARGET}" == "KELVIN" ]]; then
+  # Update submodules.
+  pushd "${TOOLCHAIN_GCC_SRC}" > /dev/null
+    # CentOS7 git does not support parellel jobs.
+    git submodule update --init riscv-*
+
+    # Update riscv-binutils for kelvin to binutils 2.40
+    cd "riscv-binutils"
+    git remote set-url origin "${TOOLCHAINLLVM_BINUTILS_URL}"
+    git fetch -f origin binutils-2_40 --depth=1
+    git checkout FETCH_HEAD
+  popd > /dev/null
+
+  # Patch Kelvin custom ops
   pushd "${TOOLCHAIN_GCC_SRC}/riscv-binutils" > /dev/null
-  git am "${ROOTDIR}/build/patches/kelvin/0001-Kelvin-riscv-binutils-patch.patch"
-  cp "${ROOTDIR}/build/patches/kelvin/kelvin-opc.h" "include/opcode/kelvin-opc.h"
-  cp "${ROOTDIR}/build/patches/kelvin/kelvin-opc.c" "opcodes/kelvin-opc.c"
+    git am "${ROOTDIR}/build/patches/kelvin/0001-Kelvin-riscv-binutils-patch.patch"
+    cp "${ROOTDIR}/build/patches/kelvin/kelvin-opc.h" "include/opcode/kelvin-opc.h"
+    cp "${ROOTDIR}/build/patches/kelvin/kelvin-opc.c" "opcodes/kelvin-opc.c"
   popd > /dev/null
 
   pushd "${TOOLCHAIN_GCC_SRC}/riscv-gcc" > /dev/null
-  git am "${ROOTDIR}/build/patches/riscv-gcc/0001-Define-__KELVIN__.patch"
+    git am "${ROOTDIR}/build/patches/riscv-gcc/0001-Define-__KELVIN__.patch"
   popd > /dev/null
 
   pushd "${TOOLCHAIN_GCC_SRC}/riscv-newlib" > /dev/null
-  git am "${ROOTDIR}/build/patches/riscv-newlib/0001-Add-memcpy-kelvin.c.patch"
+    git am "${ROOTDIR}/build/patches/riscv-newlib/0001-Add-memcpy-kelvin.c.patch"
   popd > /dev/null
-fi
+  ;;
+CHERIOT)
+  git_clone "${TOOLCHAIN_CHERIOT_URL}" "${TOOLCHAIN_CHERIOT_SRC}" "${TOOLCHAIN_CHERIOT_TAG}"
+  ;;
+*)
+  echo "Unexpected target ${TARGET}!"
+  exit -1
+  ;;
+esac
diff --git a/install-toolchain.sh b/install-toolchain.sh
index e13a48f..49a4fec 100755
--- a/install-toolchain.sh
+++ b/install-toolchain.sh
@@ -39,7 +39,7 @@
 if [[ -z "$1" ]]; then
   cat << EOM
 Usage: install-toolchain.sh target
-Where target is gcc, llvm, or kelvin
+Where target is gcc, llvm, kelvin, or cheriot
 EOM
   exit 1
 fi
@@ -57,6 +57,9 @@
   kelvin)
     TOOLCHAIN_TARBALL="toolchain_kelvin.tar.gz"
     ;;
+  cheriot)
+    TOOLCHAIN_TARBALL="toolchain_cheriot.tar.gz"
+    ;;
 
   *)
     echo "unsupported target: ${TARGET}"
diff --git a/manage-riscv-toolchain.sh b/manage-riscv-toolchain.sh
index 59d4b8b..d7cccf8 100755
--- a/manage-riscv-toolchain.sh
+++ b/manage-riscv-toolchain.sh
@@ -32,7 +32,7 @@
     cat >/dev/stderr <<EOF
 Usage: manage-riscv-toolchain.sh [-c <toolchain>|-l|-u <tarball>|-p <tarball>]
 
-Create, uploads, and promotes RISC-V GGC/LLVM toolchain tarballs from toolchain installs
+Create, uploads, and promotes RISC-V GGC/LLVM/CHERIOT toolchain tarballs from toolchain installs
 on local disk in cache/.
 
 Options:
@@ -52,20 +52,44 @@
     exit 1
 }
 
-function generate-tarball-name {
-    local toolchain=$1
-    local datestamp=$(date +%Y-%m-%d)
+function check-toolchain {
+    local toolchain="$1"
     if [[ ${toolchain} == "toolchain" ]]; then
-      echo "toolchain_${datestamp}.tar.gz"
+      true
     elif [[ ${toolchain} == "toolchain_iree_rv32imf" ]]; then
-      echo "toolchain_iree_rv32_${datestamp}.tar.gz"
+      true
     elif [[ ${toolchain} == "toolchain_kelvin" ]]; then
-      echo "toolchain_kelvin_${datestamp}.tar.gz"
+      true
+    elif [[ ${toolchain} == "toolchain_cheriot" ]]; then
+      true
     else
       die "Unsupported toolchain ${toolchain}"
     fi
 }
 
+function get-promoted-tarball {
+    local tarball=$1
+    if [[ ${tarball} == "toolchain_iree_rv32"* ]]; then
+        echo "toolchain_iree_rv32.tar.gz"
+    elif [[ ${tarball} == "toolchain_kelvin"* ]]; then
+        echo "toolchain_kelvin.tar.gz"
+    elif [[ ${tarball} == "toolchain_cheriot"* ]]; then
+        echo "toolchain_cheriot.tar.gz"
+    elif [[ ${tarball} == "toolchain"* ]]; then
+        echo "toolchain.tar.gz"
+    else
+      die "Malformed toolchain tarball ${tarball}"
+    fi
+}
+
+function generate-tarball-name {
+    local toolchain=$1
+    check-toolchain "${toolchain}"
+
+    local datestamp=$(date +%Y-%m-%d)
+    echo "${toolchain}_${datestamp}.tar.gz"
+}
+
 function create-tarball {
     local toolchain=$1; shift
     if [[ ! -d "${CACHE}/${toolchain}" ]]; then
@@ -120,32 +144,23 @@
 
 function promote-tarball {
     local promote_tarball="$1"
-    local tarball_name=""
+    local tarball_name="$(get-promoted-tarball ${promote_tarball})"
+
     echo "Removing old latest toolchain..."
-    if [[ ${promote_tarball} == "toolchain_iree_rv32"* ]]; then
-        tarball_name="toolchain_iree_rv32"
-    elif [[ ${promote_tarball} == "toolchain_kelvin"* ]]; then
-        tarball_name="toolchain_kelvin"
-    elif [[ ${promote_tarball} == "toolchain"* ]]; then
-        tarball_name="toolchain"
-    fi
+    try gsutil rm "${PUBLIC_ARTIFACTS_PATH}/${tarball_name}"
+    try gsutil rm "${PUBLIC_ARTIFACTS_PATH}/${tarball_name}.sha256sum"
 
-    try gsutil rm \
-        "${PUBLIC_ARTIFACTS_PATH}/${tarball_name}.tar.gz"
-    try gsutil rm \
-        "${PUBLIC_ARTIFACTS_PATH}/${tarball_name}.tar.gz.sha256sum"
-
-    echo "Promoting tarball ${promote_tarball} to ${tarball_name}.tar.gz"
+    echo "Promoting tarball ${promote_tarball} to ${tarball_name}"
     try gsutil cp \
         "${PUBLIC_ARTIFACTS_PATH}/toolchain_backups/${promote_tarball}" \
-        "${PUBLIC_ARTIFACTS_PATH}/${tarball_name}.tar.gz"
+        "${PUBLIC_ARTIFACTS_PATH}/${tarball_name}"
     try gsutil cp \
         "${PUBLIC_ARTIFACTS_PATH}/toolchain_backups/${promote_tarball}.sha256sum" \
-        "${PUBLIC_ARTIFACTS_PATH}/${tarball_name}.tar.gz.sha256sum"
+        "${PUBLIC_ARTIFACTS_PATH}/${tarball_name}.sha256sum"
 }
 
 function main {
-    local usage="Usage: manage-rust-toolchain.sh [-l|-c <toolchain> |-u <date> |-p <tarball>]"
+    local usage="Usage: manage-riscv-toolchain.sh [-l|-c <toolchain> |-u <date> |-p <tarball>]"
     local args=$(getopt -o h,l,c:,u:,p: --long help,list,create:,upload:,promote: \
                  -n manage-rust-toolchain.sh -- "$@")
     eval set -- "$args"