diff --git a/.gitignore b/.gitignore
index 7f90bd510..46f385e68 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,6 +3,7 @@
 
 # ignore cipd client files
 /.cipd_bin
+/.cipd_bin_cros_python2
 /.cipd_client*
 /.versions
 
diff --git a/OWNERS b/OWNERS
index ace766aee..80abb77c9 100644
--- a/OWNERS
+++ b/OWNERS
@@ -20,6 +20,7 @@ per-file pylint*=vapier@chromium.org
 
 per-file cbuildbot=file://CROS_OWNERS
 per-file cros=file://CROS_OWNERS
+per-file *cros_python2*=file://CROS_OWNERS
 per-file cros_sdk=file://CROS_OWNERS
 per-file repo=file://CROS_OWNERS
 per-file repo_launcher=file://CROS_OWNERS
diff --git a/cipd_manifest_cros_python2.txt b/cipd_manifest_cros_python2.txt
new file mode 100644
index 000000000..a22206fd3
--- /dev/null
+++ b/cipd_manifest_cros_python2.txt
@@ -0,0 +1,32 @@
+# Copyright 2022 The Chromium Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# This file contains version pins of a few infrastructure tools for cros.
+# If a tool is broken, revert a recent CL touching this file.
+# Note that Chromium has its own depot_tools pin, so if in a rush, revert the
+# depot_tools roll as well: https://chromium-review.googlesource.com/q/project:chromium/src+file:DEPS+depot_tools
+# or just wait for the autoroller to auto-roll your revert to Chromium.
+
+# Pin resolved versions in the repo, to reduce trust in the CIPD backend.
+#
+# Most of these tools are generated via builders at
+# https://ci.chromium.org/p/infra/g/infra/console
+#
+# For these, the git revision is the one of
+# https://chromium.googlesource.com/infra/infra.git.
+#
+# For goma client, generated via builders at
+# https://ci.chromium.org/p/infra-internal/g/goma-client/console
+# the git revision is the one of
+# https://chromium.googlesource.com/infra/goma/client.git
+#
+# To regenerate them (after modifying this file):
+#   cipd ensure-file-resolve -ensure-file cipd_manifest_cros_python2.txt
+$ResolvedVersions cipd_manifest_cros_python2.versions
+
+# Fully supported platforms.
+$VerifiedPlatform linux-amd64
+
+# vpython2.7
+infra/tools/luci/vpython2.7/${platform} git_revision:cc21a500756c924a48f46f4755d3857133d8caa0
diff --git a/cipd_manifest_cros_python2.versions b/cipd_manifest_cros_python2.versions
new file mode 100644
index 000000000..1a8001d79
--- /dev/null
+++ b/cipd_manifest_cros_python2.versions
@@ -0,0 +1,6 @@
+# This file is auto-generated by 'cipd ensure-file-resolve'.
+# Do not modify manually. All changes will be overwritten.
+
+infra/tools/luci/vpython2.7/linux-amd64
+	git_revision:cc21a500756c924a48f46f4755d3857133d8caa0
+	h462OEG6RTHkokEKNA5Nhpxd5Z98ZqjJ3xkP5X56LI0C
diff --git a/cros b/cros
index ec1d37b2f..9b6dc4394 100755
--- a/cros
+++ b/cros
@@ -13,6 +13,8 @@ It is intended to used strictly outside of the chroot.
 """
 
 import os
+import pathlib
+import subprocess
 import sys
 
 
@@ -21,6 +23,11 @@ MIN_PYTHON_VER_SOFT = (3, 8)
 # Min version of Python that we *require*.  We abort for older versions.
 MIN_PYTHON_VER_HARD = (3, 6)
 
+DEPOT_TOOLS_DIR = pathlib.Path(__file__).resolve().parent
+
+# Directory where cros-specific CIPD packages are installed.
+CIPD_CACHE_DIR = DEPOT_TOOLS_DIR / '.cipd_bin_cros_python2'
+
 
 def _FindChromite(path):
   """Find the chromite dir in a repo, gclient, or submodule checkout."""
@@ -71,6 +78,16 @@ def _CheckPythonVersion():
         'maintain support.', file=sys.stderr)
 
 
+def _BootstrapVpython27():
+  """Installs the vpython2.7 packages into the cipd cache directory."""
+  subprocess.run([DEPOT_TOOLS_DIR / 'cipd', 'ensure',
+                  '-log-level', 'info',
+                  '-ensure-file',
+                  DEPOT_TOOLS_DIR / 'cipd_manifest_cros_python2.txt',
+                  '-root', CIPD_CACHE_DIR],
+                 check=True)
+
+
 def main():
   _CheckPythonVersion()
 
@@ -80,7 +97,23 @@ def main():
     return _MissingErrorOut(target)
 
   path = os.path.join(chromite_dir, 'bin', target)
-  os.execv(path, [path] + sys.argv[1:])
+
+  # Check to see if this is a script requiring vpython2.7.
+  with open(path, 'rb') as fp:
+    shebang = next(fp).strip()
+  interpreter = shebang.split()[-1]
+  if interpreter in (b'python', b'python2', b'python2.7', b'vpython'):
+    _BootstrapVpython27()
+    vpython = CIPD_CACHE_DIR / 'vpython'
+    args = [vpython]
+    if interpreter != b'vpython':
+      args.extend(['-vpython-spec', DEPOT_TOOLS_DIR / 'cros_python2.vpython'])
+    args.append(path)
+    path = vpython
+  else:
+    args = [path]
+
+  os.execv(path, args + sys.argv[1:])
 
 
 if __name__ == '__main__':
diff --git a/cros_python2.vpython b/cros_python2.vpython
new file mode 100644
index 000000000..43705b072
--- /dev/null
+++ b/cros_python2.vpython
@@ -0,0 +1,58 @@
+# vpython spec used by the cros script to run commands using vpython2.7.
+python_version: "2.7"
+wheel: <
+  name: "infra/python/wheels/httplib2-py2_py3"
+  version: "version:0.10.3"
+>
+wheel: <
+  name: "infra/python/wheels/oauth2client-py2_py3"
+  version: "version:1.5.2"
+>
+wheel: <
+  name: "infra/python/wheels/pyasn1-py2_py3"
+  version: "version:0.2.3"
+>
+wheel: <
+  name: "infra/python/wheels/pyasn1_modules-py2_py3"
+  version: "version:0.0.8"
+>
+wheel: <
+  name: "infra/python/wheels/rsa-py2_py3"
+  version: "version:3.4.2"
+>
+wheel: <
+  name: "infra/python/wheels/six-py2_py3"
+  version: "version:1.15.0"
+>
+wheel: <
+  name: "infra/python/wheels/psutil/${vpython_platform}"
+  version: "version:5.8.0"
+>
+wheel: <
+  name: "infra/python/wheels/backports_functools_lru_cache-py2"
+  version: "version:1.5"
+>
+wheel: <
+  name: "infra/python/wheels/cheroot-py2"
+  version: "version:6.2.4"
+>
+wheel: <
+  name: "infra/python/wheels/cherrypy-py2"
+  version: "version:14.2.0"
+>
+wheel: <
+  name: "infra/python/wheels/more-itertools-py2_py3"
+  version: "version:4.1.0"
+>
+wheel: <
+  name: "infra/python/wheels/portend-py2"
+  version: "version:2.2"
+>
+wheel: <
+  name: "infra/python/wheels/pytz-py2_py3"
+  version: "version:2021.1"
+>
+wheel: <
+  name: "infra/python/wheels/tempora-py2"
+  version: "version:1.11"
+>