diff --git a/overlay.d/05rhcos/usr/lib/systemd/system-generators/bootloader-migrate-generator b/overlay.d/05rhcos/usr/lib/systemd/system-generators/bootloader-migrate-generator
new file mode 100755
index 00000000..a5c0cf89
--- /dev/null
+++ b/overlay.d/05rhcos/usr/lib/systemd/system-generators/bootloader-migrate-generator
@@ -0,0 +1,55 @@
+#!/bin/bash
+set -euo pipefail
+
+. /usr/lib/coreos/generator-lib.sh
+
+# This unit runs `bootupctl adopt-and-update --with-static-config` to
+# migrate RHCOS systems (e.g., OpenShift RHCOS 4.1/4.2 nodes) to use a
+# static GRUB config.
+
+# It is intended to run only once, and only if `sysroot.bootloader` is
+# unset, which is only the case on 4.1/4.2 aleph system. Systems running
+# 4.3+ already use the static config by default, and s390x uses `zipl`.
+# To avoid running unnecessarily on unaffected systems, this unit is
+# generated dynamically via a systemd generator.
+
+# We need to keep this at minimum for 9.6, but possibly also 9.8 if
+# bootimage skew enforcement hasn't landed yet to prevent incompatible
+# nodes during scale-up. See https://github.com/openshift/enhancements/pull/1761
+
+UNIT_DIR="${1:-/tmp}"
+
+if ostree config --repo=/sysroot/ostree/repo get sysroot.bootloader &>/dev/null; then
+    # sysroot.bootloader is set, exit early
+    echo "Skipping bootloader-migrate-generator: sysroot.bootloader is set"
+    exit 0
+fi
+
+write_service() {
+    local service="bootloader-migrate.service"
+
+    cat > "${UNIT_DIR}/${service}" <<EOF
+# generated by bootloader-migrate-generator
+[Unit]
+# e.g. OpenShift RHCOS 4.1/4.2 nodes
+Description=Static GRUB config migration
+Documentation=https://issues.redhat.com/browse/OCPBUGS-52485
+RequiresMountsFor=/sysroot /boot
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/bootupctl adopt-and-update --with-static-config
+RemainAfterExit=yes
+# Keep this stuff in sync with SYSTEMD_ARGS_BOOTUPD in general
+PrivateNetwork=yes
+ProtectHome=yes
+KillMode=mixed
+MountFlags=slave
+EOF
+
+    local wants_dir="${UNIT_DIR}/multi-user.target.wants"
+    mkdir -p "${wants_dir}"
+    ln -sf "../${service}" "${wants_dir}/${service}"
+}
+
+write_service