diff --git a/recovery.c b/recovery.c
index 2ce1fd7..6c4507f 100644
--- a/recovery.c
+++ b/recovery.c
@@ -24,6 +24,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <sys/reboot.h>
+#include <sys/stat.h>
 #include <sys/types.h>
 #include <time.h>
 #include <unistd.h>
@@ -53,6 +54,7 @@
 static const char *LOG_FILE = "CACHE:recovery/log";
 static const char *SDCARD_ROOT = "SDCARD:";
 static const char *TEMPORARY_LOG_FILE = "/tmp/recovery.log";
+static const char *SIDELOAD_TEMP_DIR = "TMP:sideload";
 
 /*
  * The recovery tool communicates with the main system through /cache files.
@@ -300,6 +302,109 @@
     return format_root_device(root);
 }
 
+static char*
+copy_sideloaded_package(const char* original_root_path) {
+  if (ensure_root_path_mounted(original_root_path) != 0) {
+    LOGE("Can't mount %s\n", original_root_path);
+    return NULL;
+  }
+
+  char original_path[PATH_MAX] = "";
+  if (translate_root_path(original_root_path, original_path,
+                          sizeof(original_path)) == NULL) {
+    LOGE("Bad path %s\n", original_root_path);
+    return NULL;
+  }
+
+  if (ensure_root_path_mounted(SIDELOAD_TEMP_DIR) != 0) {
+    LOGE("Can't mount %s\n", SIDELOAD_TEMP_DIR);
+    return NULL;
+  }
+
+  char copy_path[PATH_MAX] = "";
+  if (translate_root_path(SIDELOAD_TEMP_DIR, copy_path,
+                          sizeof(copy_path)) == NULL) {
+    LOGE("Bad path %s\n", SIDELOAD_TEMP_DIR);
+    return NULL;
+  }
+
+  if (mkdir(copy_path, 0700) != 0) {
+    if (errno != EEXIST) {
+      LOGE("Can't mkdir %s (%s)\n", SIDELOAD_TEMP_DIR, strerror(errno));
+      return NULL;
+    }
+  }
+
+  struct stat st;
+  if (stat(copy_path, &st) != 0) {
+    LOGE("failed to stat %s (%s)\n", copy_path, strerror(errno));
+    return NULL;
+  }
+  if (!S_ISDIR(st.st_mode)) {
+    LOGE("%s isn't a directory\n", copy_path);
+    return NULL;
+  }
+  if ((st.st_mode & 0777) != 0700) {
+    LOGE("%s has perms %o\n", copy_path, st.st_mode);
+    return NULL;
+  }
+  if (st.st_uid != 0) {
+    LOGE("%s owned by %lu; not root\n", copy_path, st.st_uid);
+    return NULL;
+  }
+
+  strcat(copy_path, "/package.zip");
+
+  char* buffer = malloc(BUFSIZ);
+  if (buffer == NULL) {
+    LOGE("Failed to allocate buffer\n");
+    return NULL;
+  }
+
+  size_t read;
+  FILE* fin = fopen(original_path, "rb");
+  if (fin == NULL) {
+    LOGE("Failed to open %s (%s)\n", original_path, strerror(errno));
+    return NULL;
+  }
+  FILE* fout = fopen(copy_path, "wb");
+  if (fout == NULL) {
+    LOGE("Failed to open %s (%s)\n", copy_path, strerror(errno));
+    return NULL;
+  }
+
+  while ((read = fread(buffer, 1, BUFSIZ, fin)) > 0) {
+    if (fwrite(buffer, 1, read, fout) != read) {
+      LOGE("Short write of %s (%s)\n", copy_path, strerror(errno));
+      return NULL;
+    }
+  }
+
+  free(buffer);
+
+  if (fclose(fout) != 0) {
+    LOGE("Failed to close %s (%s)\n", copy_path, strerror(errno));
+    return NULL;
+  }
+
+  if (fclose(fin) != 0) {
+    LOGE("Failed to close %s (%s)\n", original_path, strerror(errno));
+    return NULL;
+  }
+
+  // "adb push" is happy to overwrite read-only files when it's
+  // running as root, but we'll try anyway.
+  if (chmod(copy_path, 0400) != 0) {
+    LOGE("Failed to chmod %s (%s)\n", copy_path, strerror(errno));
+    return NULL;
+  }
+
+  char* copy_root_path = malloc(strlen(SIDELOAD_TEMP_DIR) + 20);
+  strcpy(copy_root_path, SIDELOAD_TEMP_DIR);
+  strcat(copy_root_path, "/package.zip");
+  return copy_root_path;
+}
+
 static char**
 prepend_title(const char** headers) {
     char* title[] = { "Android system recovery <"
@@ -371,6 +476,11 @@
 
 static int
 sdcard_directory(const char* root_path) {
+    // Mount the sdcard when the package selection menu is enabled so
+    // you can "adb push" packages to the sdcard and immediately
+    // install them.
+    ensure_root_path_mounted(SDCARD_ROOT);
+
     const char* MENU_HEADERS[] = { "Choose a package to install:",
                                    root_path,
                                    "",
@@ -437,7 +547,7 @@
     z_size += d_size;
     zips[z_size] = NULL;
 
-    int result;
+    int result = INSTALL_CORRUPT;
     int chosen_item = 0;
     do {
         chosen_item = get_menu_selection(headers, zips, 1, chosen_item);
@@ -463,8 +573,12 @@
             strlcat(new_path, item, PATH_MAX);
 
             ui_print("\n-- Install %s ...\n", new_path);
-            set_sdcard_update_bootloader_message();
-            result = install_package(new_path);
+            char* copy = copy_sideloaded_package(new_path);
+            if (copy != NULL) {
+                set_sdcard_update_bootloader_message();
+                result = install_package(copy);
+                free(copy);
+            }
             break;
         }
     } while (true);
@@ -671,9 +785,6 @@
 
     if (status != INSTALL_SUCCESS) ui_set_background(BACKGROUND_ICON_ERROR);
     if (status != INSTALL_SUCCESS || ui_text_visible()) {
-        // Mount the sdcard when the menu is enabled so you can "adb
-        // push" packages to the sdcard and immediately install them.
-        ensure_root_path_mounted(SDCARD_ROOT);
         prompt_and_wait();
     }
 
diff --git a/roots.c b/roots.c
index edb202e..762bdf3 100644
--- a/roots.c
+++ b/roots.c
@@ -47,6 +47,7 @@
 static const char g_mtd_device[] = "@\0g_mtd_device";
 static const char g_raw[] = "@\0g_raw";
 static const char g_package_file[] = "@\0g_package_file";
+static const char g_ramdisk[] = "@\0g_ramdisk";
 
 static RootInfo g_roots[] = {
     { "BOOT:", g_mtd_device, NULL, "boot", NULL, g_raw },
@@ -56,7 +57,7 @@
     { "SDCARD:", "/dev/block/mmcblk0p1", "/dev/block/mmcblk0", NULL, "/sdcard", "vfat" },
     { "SYSTEM:", g_mtd_device, NULL, "system", "/system", "yaffs2" },
     { "MBM:", g_mtd_device, NULL, "mbm", NULL, g_raw },
-    { "TMP:", NULL, NULL, NULL, "/tmp", NULL },
+    { "TMP:", NULL, NULL, NULL, "/tmp", g_ramdisk },
 
 #ifdef USE_EXT4
     { "CACHE:", "/dev/block/platform/sdhci-tegra.3/by-name/cache", NULL, NULL,
@@ -194,7 +195,9 @@
     if (info->mount_point == NULL) {
         return -1;
     }
-//xxx if TMP: (or similar) just say "yes"
+    if (info->filesystem == g_ramdisk) {
+      return 0;
+    }
 
     /* See if this root is already mounted.
      */