This disclosure relates to building and finalizing an operating system (OS) image package in a way that allows for flexibility and customization of OS images while preventing certain runtime modifications after deployment of the OS image package on one or more target devices (e.g., embedded devices). For example, the systems described herein can build an OS image package based on information from an OS manifest that provides a declarative summary of a target OS. The systems described herein can further finalize the OS image package by performing one or more actions on the OS image package that prevent an end-user from performing various runtime modifications to the target OS after deployment of the OS image package. This finalization process provides an improved pipeline for implementing OS updates while providing safeguards against a variety of security risks associated with deploying OS image packages on a large scale.