diff --git a/tools/osbuilder/rootfs-builder/rootfs.sh b/tools/osbuilder/rootfs-builder/rootfs.sh
index 538df325ce..127f37dafa 100755
--- a/tools/osbuilder/rootfs-builder/rootfs.sh
+++ b/tools/osbuilder/rootfs-builder/rootfs.sh
@@ -30,6 +30,7 @@ LIBC=${LIBC:-musl}
 SECCOMP=${SECCOMP:-"yes"}
 # The kata agent enables sealed-secret feature.
 SEALED_SECRET=${SEALED_SECRET:-"no"}
+CDH_RESOURCE_PROVIDER=${CDH_RESOURCE_PROVIDER:-"kbs"}
 SELINUX=${SELINUX:-"no"}
 
 lib_file="${script_dir}/../scripts/lib.sh"
@@ -699,6 +700,11 @@ EOF
 		make KBC=${AA_KBC} ttrpc=true
 		make install DESTDIR="${ROOTFS_DIR}/usr/local/bin/"
 		popd
+
+		pushd guest-components/confidential-data-hub
+		make RESOURCE_PROVIDER=${CDH_RESOURCE_PROVIDER}
+		make install DESTDIR="${ROOTFS_DIR}/usr/local/bin/"
+		popd
 	fi
 
 	if [ "${KATA_BUILD_CC}" == "yes" ]; then