diff --git a/src/machine/image-dbus.c b/src/machine/image-dbus.c
index 78c05ff5023..da71b9115f4 100644
--- a/src/machine/image-dbus.c
+++ b/src/machine/image-dbus.c
@@ -127,17 +127,9 @@ int bus_image_method_rename(
         if (r == 0)
                 return 1; /* Will call us back */
 
-        /* The image is cached with its name, hence it is necessary to remove from the cache before renaming. */
-        assert_se(hashmap_remove_value(m->image_cache, image->name, image));
-
-        r = image_rename(image, new_name);
-        if (r < 0) {
-                image_unref(image);
-                return r;
-        }
-
-        /* Then save the object again in the cache. */
-        assert_se(hashmap_put(m->image_cache, image->name, image) > 0);
+        r = rename_image_and_update_cache(m, image, new_name);
+        if (r < 0)
+                return sd_bus_error_set_errnof(error, r, "Failed to rename image: %m");
 
         return sd_bus_reply_method_return(message, NULL);
 }
@@ -377,60 +369,6 @@ int bus_image_method_get_os_release(
         return bus_reply_pair_array(message, image->os_release);
 }
 
-static int image_flush_cache(sd_event_source *s, void *userdata) {
-        Manager *m = ASSERT_PTR(userdata);
-
-        assert(s);
-
-        hashmap_clear(m->image_cache);
-        return 0;
-}
-
-int manager_acquire_image(Manager *m, const char *name, Image **ret) {
-        int r;
-
-        assert(m);
-        assert(name);
-
-        Image *existing = hashmap_get(m->image_cache, name);
-        if (existing) {
-                if (ret)
-                        *ret = existing;
-                return 0;
-        }
-
-        if (!m->image_cache_defer_event) {
-                r = sd_event_add_defer(m->event, &m->image_cache_defer_event, image_flush_cache, m);
-                if (r < 0)
-                        return r;
-
-                r = sd_event_source_set_priority(m->image_cache_defer_event, SD_EVENT_PRIORITY_IDLE);
-                if (r < 0)
-                        return r;
-        }
-
-        r = sd_event_source_set_enabled(m->image_cache_defer_event, SD_EVENT_ONESHOT);
-        if (r < 0)
-                return r;
-
-        _cleanup_(image_unrefp) Image *image = NULL;
-        r = image_find(IMAGE_MACHINE, name, NULL, &image);
-        if (r < 0)
-                return r;
-
-        image->userdata = m;
-
-        r = hashmap_ensure_put(&m->image_cache, &image_hash_ops, image->name, image);
-        if (r < 0)
-                return r;
-
-        if (ret)
-                *ret = image;
-
-        TAKE_PTR(image);
-        return 0;
-}
-
 static int image_object_find(sd_bus *bus, const char *path, const char *interface, void *userdata, void **found, sd_bus_error *error) {
         _cleanup_free_ char *e = NULL;
         Manager *m = userdata;
diff --git a/src/machine/image-dbus.h b/src/machine/image-dbus.h
index c0d56b2eb47..0a7975bc528 100644
--- a/src/machine/image-dbus.h
+++ b/src/machine/image-dbus.h
@@ -7,7 +7,6 @@
 
 extern const BusObjectImplementation image_object;
 
-int manager_acquire_image(Manager *m, const char *name, Image **ret);
 char* image_bus_path(const char *name);
 
 int bus_image_method_remove(sd_bus_message *message, void *userdata, sd_bus_error *error);
diff --git a/src/machine/image-varlink.c b/src/machine/image-varlink.c
new file mode 100644
index 00000000000..3177a938477
--- /dev/null
+++ b/src/machine/image-varlink.c
@@ -0,0 +1,88 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+
+#include "sd-json.h"
+#include "sd-varlink.h"
+
+#include "bus-polkit.h"
+#include "image-varlink.h"
+#include "machine.h"
+#include "string-util.h"
+
+int vl_method_update_image(sd_varlink *link, sd_json_variant *parameters, sd_varlink_method_flags_t flags, void *userdata) {
+        struct params {
+                const char *image_name;
+                const char *new_name;
+                int read_only;
+                uint64_t limit;
+        };
+
+        static const sd_json_dispatch_field dispatch_table[] = {
+                { "name",     SD_JSON_VARIANT_STRING,        sd_json_dispatch_const_string, offsetof(struct params, image_name), SD_JSON_MANDATORY },
+                { "newName",  SD_JSON_VARIANT_STRING,        sd_json_dispatch_const_string, offsetof(struct params, new_name),   0 },
+                { "readOnly", SD_JSON_VARIANT_BOOLEAN,       sd_json_dispatch_tristate,     offsetof(struct params, read_only),  0 },
+                { "limit",    _SD_JSON_VARIANT_TYPE_INVALID, sd_json_dispatch_uint64,       offsetof(struct params, limit),      0 },
+                VARLINK_DISPATCH_POLKIT_FIELD,
+                {}
+        };
+
+        Manager *manager = ASSERT_PTR(userdata);
+        struct params p = {
+                .read_only = -1,
+                .limit = UINT64_MAX,
+        };
+        Image *image;
+        int r, ret = 0;
+
+        assert(link);
+        assert(parameters);
+
+        r = sd_varlink_dispatch(link, parameters, dispatch_table, &p);
+        if (r != 0)
+                return r;
+
+        if (!image_name_is_valid(p.image_name))
+                return sd_varlink_error_invalid_parameter_name(link, "name");
+
+        if (p.new_name && !image_name_is_valid(p.new_name))
+                return sd_varlink_error_invalid_parameter_name(link, "newName");
+
+        r = manager_acquire_image(manager, p.image_name, &image);
+        if (r == -ENOENT)
+                return sd_varlink_error(link, "io.systemd.MachineImage.NoSuchImage", NULL);
+        if (r < 0)
+                return r;
+
+        r = varlink_verify_polkit_async(
+                        link,
+                        manager->bus,
+                        "org.freedesktop.machine1.manage-images",
+                        (const char**) STRV_MAKE("image", image->name,
+                                                 "verb", "update_image"),
+                        &manager->polkit_registry);
+        if (r <= 0)
+                return r;
+
+        if (p.new_name) {
+                r = rename_image_and_update_cache(manager, image, p.new_name);
+                if (r < 0)
+                        return log_debug_errno(r, "Failed to rename image: %m");
+        }
+
+        if (p.read_only >= 0) {
+                r = image_read_only(image, p.read_only);
+                if (r < 0)
+                        RET_GATHER(ret, log_debug_errno(r, "Failed to toggle image read only, ignoring: %m"));
+        }
+
+        if (p.limit != UINT64_MAX) {
+                r = image_set_limit(image, p.limit);
+                if (r < 0)
+                        RET_GATHER(ret, log_debug_errno(r, "Failed to set image limit, ignoring: %m"));
+        }
+
+        /* We intentionally swallowed errors from image_read_only() and image_set_limit(). Here we return first one to the user if any */
+        if (ret < 0)
+                return ret;
+
+        return sd_varlink_reply(link, NULL);
+}
diff --git a/src/machine/image-varlink.h b/src/machine/image-varlink.h
new file mode 100644
index 00000000000..72028239de1
--- /dev/null
+++ b/src/machine/image-varlink.h
@@ -0,0 +1,6 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+#include "sd-varlink.h"
+
+int vl_method_update_image(sd_varlink *link, sd_json_variant *parameters, sd_varlink_method_flags_t flags, void *userdata);
diff --git a/src/machine/machined-core.c b/src/machine/machined-core.c
index baa9a605ba3..2836b90c6f8 100644
--- a/src/machine/machined-core.c
+++ b/src/machine/machined-core.c
@@ -402,3 +402,83 @@ int machine_get_os_release(Machine *machine, char ***ret_os_release) {
         *ret_os_release = TAKE_PTR(l);
         return 0;
 }
+
+static int image_flush_cache(sd_event_source *s, void *userdata) {
+        Manager *m = ASSERT_PTR(userdata);
+
+        assert(s);
+
+        hashmap_clear(m->image_cache);
+        return 0;
+}
+
+int manager_acquire_image(Manager *m, const char *name, Image **ret) {
+        int r;
+
+        assert(m);
+        assert(name);
+
+        Image *existing = hashmap_get(m->image_cache, name);
+        if (existing) {
+                if (ret)
+                        *ret = existing;
+                return 0;
+        }
+
+        if (!m->image_cache_defer_event) {
+                r = sd_event_add_defer(m->event, &m->image_cache_defer_event, image_flush_cache, m);
+                if (r < 0)
+                        return log_debug_errno(r, "Failed to add defered event: %m");
+
+                r = sd_event_source_set_priority(m->image_cache_defer_event, SD_EVENT_PRIORITY_IDLE);
+                if (r < 0)
+                        return log_debug_errno(r, "Failed to set source priority for event: %m");
+        }
+
+        r = sd_event_source_set_enabled(m->image_cache_defer_event, SD_EVENT_ONESHOT);
+        if (r < 0)
+                return log_debug_errno(r, "Failed to enable source: %m") ;
+
+        _cleanup_(image_unrefp) Image *image = NULL;
+        r = image_find(IMAGE_MACHINE, name, NULL, &image);
+        if (r < 0)
+                return log_debug_errno(r, "Failed to find image: %m");
+
+        image->userdata = m;
+
+        r = hashmap_ensure_put(&m->image_cache, &image_hash_ops, image->name, image);
+        if (r < 0)
+                return r;
+
+        if (ret)
+                *ret = image;
+
+        TAKE_PTR(image);
+        return 0;
+}
+
+int rename_image_and_update_cache(Manager *m, Image *image, const char* new_name) {
+        int r;
+
+        assert(m);
+        assert(image);
+        assert(new_name);
+
+        /* The image is cached with its name, hence it is necessary to remove from the cache before renaming. */
+        assert_se(hashmap_remove_value(m->image_cache, image->name, image));
+
+        r = image_rename(image, new_name);
+        if (r < 0) {
+                image = image_unref(image);
+                return r;
+        }
+
+        /* Then save the object again in the cache. */
+        r = hashmap_put(m->image_cache, image->name, image);
+        if (r < 0) {
+                image = image_unref(image);
+                log_debug_errno(r, "Failed to put renamed image into cache, ignoring: %m");
+        }
+
+        return 0;
+}
diff --git a/src/machine/machined-varlink.c b/src/machine/machined-varlink.c
index 45e71266ed3..b43f5865874 100644
--- a/src/machine/machined-varlink.c
+++ b/src/machine/machined-varlink.c
@@ -3,8 +3,10 @@
 #include "sd-varlink.h"
 
 #include "bus-polkit.h"
+#include "discover-image.h"
 #include "format-util.h"
 #include "hostname-util.h"
+#include "image-varlink.h"
 #include "json-util.h"
 #include "machine-varlink.h"
 #include "machined-varlink.h"
@@ -508,6 +510,119 @@ static int vl_method_terminate(sd_varlink *link, sd_json_variant *parameters, sd
         return lookup_machine_and_call_method(link, parameters, flags, userdata, vl_method_terminate_internal);
 }
 
+static int list_image_one_and_maybe_read_metadata(sd_varlink *link, Image *image, bool more, bool read_metadata) {
+        int r;
+
+        assert(link);
+        assert(image);
+
+        if (read_metadata && !image->metadata_valid) {
+                r = image_read_metadata(image, &image_policy_container);
+                if (r < 0)
+                        return log_debug_errno(r, "Failed to read image metadata: %m");
+        }
+
+        _cleanup_(sd_json_variant_unrefp) sd_json_variant *v = NULL;
+
+        r = sd_json_buildo(
+                        &v,
+                        SD_JSON_BUILD_PAIR_STRING("name", image->name),
+                        JSON_BUILD_PAIR_STRING_NON_EMPTY("path", image->path),
+                        SD_JSON_BUILD_PAIR_STRING("type", image_type_to_string(image->type)),
+                        SD_JSON_BUILD_PAIR_STRING("class", image_class_to_string(image->class)),
+                        SD_JSON_BUILD_PAIR_BOOLEAN("readOnly", image->read_only),
+                        JSON_BUILD_PAIR_UNSIGNED_NON_ZERO("creationTimestamp", image->crtime),
+                        JSON_BUILD_PAIR_UNSIGNED_NON_ZERO("modificationTimestamp", image->mtime),
+                        JSON_BUILD_PAIR_UNSIGNED_NOT_EQUAL("usage", image->usage, UINT64_MAX),
+                        JSON_BUILD_PAIR_UNSIGNED_NOT_EQUAL("usageExclusive", image->usage_exclusive, UINT64_MAX),
+                        JSON_BUILD_PAIR_UNSIGNED_NOT_EQUAL("limit", image->limit, UINT64_MAX),
+                        JSON_BUILD_PAIR_UNSIGNED_NOT_EQUAL("limitExclusive", image->limit_exclusive, UINT64_MAX));
+        if (r < 0)
+                return r;
+
+        if (image->metadata_valid) {
+                r = sd_json_variant_merge_objectbo(
+                                &v,
+                                JSON_BUILD_PAIR_STRING_NON_EMPTY("hostname", image->hostname),
+                                SD_JSON_BUILD_PAIR_CONDITION(!sd_id128_is_null(image->machine_id), "machineId", SD_JSON_BUILD_ID128(image->machine_id)),
+                                SD_JSON_BUILD_PAIR_CONDITION(!strv_isempty(image->machine_info), "machineInfo", JSON_BUILD_STRV_ENV_PAIR(image->machine_info)),
+                                SD_JSON_BUILD_PAIR_CONDITION(!strv_isempty(image->os_release), "OSRelease", JSON_BUILD_STRV_ENV_PAIR(image->os_release)));
+                if (r < 0)
+                        return r;
+        }
+
+        if (more)
+                return sd_varlink_notify(link, v);
+
+        return sd_varlink_reply(link, v);
+}
+
+static int vl_method_list_images(sd_varlink *link, sd_json_variant *parameters, sd_varlink_method_flags_t flags, void *userdata) {
+        struct params {
+                const char *image_name;
+                bool acquire_metadata;
+        };
+
+        static const sd_json_dispatch_field dispatch_table[] = {
+                { "name",            SD_JSON_VARIANT_STRING,    sd_json_dispatch_const_string, offsetof(struct params, image_name),        0 },
+                { "acquireMetadata", SD_JSON_VARIANT_BOOLEAN,   sd_json_dispatch_stdbool,      offsetof(struct params, acquire_metadata),  0 },
+                VARLINK_DISPATCH_POLKIT_FIELD,
+                {}
+        };
+
+        _cleanup_hashmap_free_ Hashmap *images = NULL;
+        struct params p = {};
+        Image *image;
+        int r;
+
+        assert(link);
+        assert(parameters);
+
+        r = sd_varlink_dispatch(link, parameters, dispatch_table, &p);
+        if (r != 0)
+                return r;
+
+        if (p.image_name) {
+                if (!image_name_is_valid(p.image_name))
+                        return sd_varlink_error_invalid_parameter_name(link, "name");
+
+                r = image_find(IMAGE_MACHINE, p.image_name, /* root = */ NULL, &image);
+                if (r == -ENOENT)
+                        return sd_varlink_error(link, "io.systemd.MachineImage.NoSuchImage", NULL);
+                if (r < 0)
+                        return log_debug_errno(r, "Failed to find image: %m");
+
+                return list_image_one_and_maybe_read_metadata(link, image, /* more = */ false, p.acquire_metadata);
+        }
+
+        if (!FLAGS_SET(flags, SD_VARLINK_METHOD_MORE))
+                return sd_varlink_error(link, SD_VARLINK_ERROR_EXPECTED_MORE, NULL);
+
+        images = hashmap_new(&image_hash_ops);
+        if (!images)
+                return -ENOMEM;
+
+        r = image_discover(IMAGE_MACHINE, /* root = */ NULL, images);
+        if (r < 0)
+                return log_debug_errno(r, "Failed to discover images: %m");
+
+        Image *previous = NULL;
+        HASHMAP_FOREACH(image, images) {
+                if (previous) {
+                        r = list_image_one_and_maybe_read_metadata(link, previous, /* more = */ true, p.acquire_metadata);
+                        if (r < 0)
+                                return r;
+                }
+
+                previous = image;
+        }
+
+        if (previous)
+                return list_image_one_and_maybe_read_metadata(link, previous, /* more = */ false, p.acquire_metadata);
+
+        return sd_varlink_error(link, "io.systemd.MachineImage.NoSuchImage", NULL);
+}
+
 static int manager_varlink_init_userdb(Manager *m) {
         _cleanup_(sd_varlink_server_unrefp) sd_varlink_server *s = NULL;
         int r;
@@ -566,15 +681,17 @@ static int manager_varlink_init_machine(Manager *m) {
 
         r = sd_varlink_server_add_interface(s, &vl_interface_io_systemd_Machine);
         if (r < 0)
-                return log_error_errno(r, "Failed to add UserDatabase interface to varlink server: %m");
+                return log_error_errno(r, "Failed to add Machine interface to varlink server: %m");
 
         r = sd_varlink_server_bind_method_many(
                         s,
-                        "io.systemd.Machine.Register",   vl_method_register,
-                        "io.systemd.Machine.List",       vl_method_list,
-                        "io.systemd.Machine.Unregister", vl_method_unregister,
-                        "io.systemd.Machine.Terminate",  vl_method_terminate,
-                        "io.systemd.Machine.Kill",       vl_method_kill);
+                        "io.systemd.Machine.Register",    vl_method_register,
+                        "io.systemd.Machine.List",        vl_method_list,
+                        "io.systemd.Machine.Unregister",  vl_method_unregister,
+                        "io.systemd.Machine.Terminate",   vl_method_terminate,
+                        "io.systemd.Machine.Kill",        vl_method_kill,
+                        "io.systemd.MachineImage.List",   vl_method_list_images,
+                        "io.systemd.MachineImage.Update", vl_method_update_image);
         if (r < 0)
                 return log_error_errno(r, "Failed to register varlink methods: %m");
 
@@ -582,7 +699,11 @@ static int manager_varlink_init_machine(Manager *m) {
 
         r = sd_varlink_server_listen_address(s, "/run/systemd/machine/io.systemd.Machine", 0666);
         if (r < 0)
-                return log_error_errno(r, "Failed to bind to varlink socket: %m");
+                return log_error_errno(r, "Failed to bind to io.systemd.Machine varlink socket: %m");
+
+        r = sd_varlink_server_listen_address(s, "/run/systemd/machine/io.systemd.MachineImage", 0666);
+        if (r < 0)
+                return log_error_errno(r, "Failed to bind to io.systemd.MachineImage varlink socket: %m");
 
         r = sd_varlink_server_attach_event(s, m->event, SD_EVENT_PRIORITY_NORMAL);
         if (r < 0)
diff --git a/src/machine/machined.h b/src/machine/machined.h
index 721bf680122..3d1f5026997 100644
--- a/src/machine/machined.h
+++ b/src/machine/machined.h
@@ -68,3 +68,5 @@ void manager_enqueue_gc(Manager *m);
 
 int machine_get_addresses(Machine* machine, struct local_address **ret_addresses);
 int machine_get_os_release(Machine *machine, char ***ret_os_release);
+int manager_acquire_image(Manager *m, const char *name, Image **ret);
+int rename_image_and_update_cache(Manager *m, Image *image, const char* new_name);
diff --git a/src/machine/meson.build b/src/machine/meson.build
index 3150b33de57..f3358d4b988 100644
--- a/src/machine/meson.build
+++ b/src/machine/meson.build
@@ -2,6 +2,7 @@
 
 libmachine_core_sources = files(
         'image-dbus.c',
+        'image-varlink.c',
         'machine-dbus.c',
         'machine-varlink.c',
         'machine.c',
diff --git a/src/shared/discover-image.h b/src/shared/discover-image.h
index e14ef9dcb55..b20b586ae04 100644
--- a/src/shared/discover-image.h
+++ b/src/shared/discover-image.h
@@ -60,9 +60,9 @@ Image *image_ref(Image *i);
 
 DEFINE_TRIVIAL_CLEANUP_FUNC(Image*, image_unref);
 
-int image_find(ImageClass class, const char *root, const char *name, Image **ret);
+int image_find(ImageClass class, const char *name, const char *root, Image **ret);
 int image_from_path(const char *path, Image **ret);
-int image_find_harder(ImageClass class, const char *root, const char *name_or_path, Image **ret);
+int image_find_harder(ImageClass class, const char *name_or_path, const char *root, Image **ret);
 int image_discover(ImageClass class, const char *root, Hashmap *map);
 
 int image_remove(Image *i);
diff --git a/src/shared/varlink-io.systemd.MachineImage.c b/src/shared/varlink-io.systemd.MachineImage.c
new file mode 100644
index 00000000000..514c5720c6b
--- /dev/null
+++ b/src/shared/varlink-io.systemd.MachineImage.c
@@ -0,0 +1,68 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+
+#include "sd-varlink-idl.h"
+
+#include "varlink-io.systemd.MachineImage.h"
+
+static SD_VARLINK_DEFINE_METHOD_FULL(
+                List,
+                SD_VARLINK_SUPPORTS_MORE,
+                SD_VARLINK_FIELD_COMMENT("If non-null the name of a image to report details on."),
+                SD_VARLINK_DEFINE_INPUT(name, SD_VARLINK_STRING, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("If true the output will include image metadata fields such as 'machineInfo' and 'OSRelease'."),
+                SD_VARLINK_DEFINE_INPUT(acquireMetadata, SD_VARLINK_BOOL, SD_VARLINK_NULLABLE),
+                VARLINK_DEFINE_POLKIT_INPUT,
+                SD_VARLINK_FIELD_COMMENT("Name of the image"),
+                SD_VARLINK_DEFINE_OUTPUT(name, SD_VARLINK_STRING, 0),
+                SD_VARLINK_FIELD_COMMENT("The file system path where image is stored"),
+                SD_VARLINK_DEFINE_OUTPUT(path, SD_VARLINK_STRING, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("The type of this image"),
+                SD_VARLINK_DEFINE_OUTPUT(type, SD_VARLINK_STRING, 0),
+                SD_VARLINK_FIELD_COMMENT("The class of this image"),
+                SD_VARLINK_DEFINE_OUTPUT(class, SD_VARLINK_STRING, 0),
+                SD_VARLINK_FIELD_COMMENT("Whether the image is read-only"),
+                SD_VARLINK_DEFINE_OUTPUT(readOnly, SD_VARLINK_BOOL, 0),
+                SD_VARLINK_FIELD_COMMENT("The image creation timestamp"),
+                SD_VARLINK_DEFINE_OUTPUT(creationTimestamp, SD_VARLINK_INT, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("The image creation timestamp"),
+                SD_VARLINK_DEFINE_OUTPUT(modificationTimestamp, SD_VARLINK_INT, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("The image creation timestamp"),
+                SD_VARLINK_DEFINE_OUTPUT(usage, SD_VARLINK_INT, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("The image disk usage (exclusive)"),
+                SD_VARLINK_DEFINE_OUTPUT(usageExclusive, SD_VARLINK_INT, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("The image disk usage (exclusive)"),
+                SD_VARLINK_DEFINE_OUTPUT(limit, SD_VARLINK_INT, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("The image disk usage limit (exclusive)"),
+                SD_VARLINK_DEFINE_OUTPUT(limitExclusive, SD_VARLINK_INT, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("The hostname of the image"),
+                SD_VARLINK_DEFINE_OUTPUT(hostname, SD_VARLINK_STRING, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("The machine ID of the image"),
+                SD_VARLINK_DEFINE_OUTPUT(machineId, SD_VARLINK_STRING, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("Machine info information of an image. It contains an array of key value pairs read from the machine-info(5) file in the image."),
+                SD_VARLINK_DEFINE_OUTPUT(machineInfo, SD_VARLINK_STRING, SD_VARLINK_NULLABLE|SD_VARLINK_ARRAY),
+                SD_VARLINK_FIELD_COMMENT("OS release information of an image. It contains an array of key value pairs read from the os-release(5) file in the image."),
+                SD_VARLINK_DEFINE_OUTPUT(OSRelease, SD_VARLINK_STRING, SD_VARLINK_NULLABLE|SD_VARLINK_ARRAY));
+
+static SD_VARLINK_DEFINE_METHOD(
+                Update,
+                SD_VARLINK_FIELD_COMMENT("The name of a image to update."),
+                SD_VARLINK_DEFINE_INPUT(name, SD_VARLINK_STRING, 0),
+                SD_VARLINK_FIELD_COMMENT("If non-null the new name of the image"),
+                SD_VARLINK_DEFINE_INPUT(newName, SD_VARLINK_STRING, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("If non-null value of the read-only flag of the image"),
+                SD_VARLINK_DEFINE_INPUT(readOnly, SD_VARLINK_BOOL, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("If non-null value of image quota limit"),
+                SD_VARLINK_DEFINE_INPUT(limit, SD_VARLINK_INT, SD_VARLINK_NULLABLE),
+                VARLINK_DEFINE_POLKIT_INPUT);
+
+static SD_VARLINK_DEFINE_ERROR(NoSuchImage);
+
+SD_VARLINK_DEFINE_INTERFACE(
+                io_systemd_MachineImage,
+                "io.systemd.MachineImage",
+                SD_VARLINK_SYMBOL_COMMENT("List images"),
+                &vl_method_List,
+                SD_VARLINK_SYMBOL_COMMENT("Update image allowing to rename or toggle read-only flag"),
+                &vl_method_Update,
+                SD_VARLINK_SYMBOL_COMMENT("No matching image exists"),
+                &vl_error_NoSuchImage);
diff --git a/src/shared/varlink-io.systemd.MachineImage.h b/src/shared/varlink-io.systemd.MachineImage.h
new file mode 100644
index 00000000000..91e21f6f99a
--- /dev/null
+++ b/src/shared/varlink-io.systemd.MachineImage.h
@@ -0,0 +1,6 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+#include "sd-varlink-idl.h"
+
+extern const sd_varlink_interface vl_interface_io_systemd_MachineImage;
diff --git a/test/units/TEST-13-NSPAWN.machined.sh b/test/units/TEST-13-NSPAWN.machined.sh
index 1ae393dd1fb..f117c305b2f 100755
--- a/test/units/TEST-13-NSPAWN.machined.sh
+++ b/test/units/TEST-13-NSPAWN.machined.sh
@@ -288,3 +288,18 @@ timeout 30 bash -c "until varlinkctl call /run/systemd/machine/io.systemd.Machin
 varlinkctl call /run/systemd/machine/io.systemd.Machine io.systemd.Machine.List '{"name":"registered-container"}' | jq '.sshAddress' | grep -q 'localhost'
 varlinkctl call /run/systemd/machine/io.systemd.Machine io.systemd.Machine.List '{"name":"registered-container"}' | jq '.sshPrivateKeyPath' | grep -q 'non-existent'
 varlinkctl call /run/systemd/machine/io.systemd.Machine io.systemd.Machine.Unregister '{"name": "registered-container"}'
+
+# test io.systemd.MachineImage.List
+varlinkctl --more call /run/systemd/machine/io.systemd.MachineImage io.systemd.MachineImage.List '{}' | grep 'long-running'
+varlinkctl --more call /run/systemd/machine/io.systemd.MachineImage io.systemd.MachineImage.List '{}' | grep '.host'
+varlinkctl call /run/systemd/machine/io.systemd.MachineImage io.systemd.MachineImage.List '{"name":"long-running"}'
+varlinkctl call /run/systemd/machine/io.systemd.MachineImage io.systemd.MachineImage.List '{"name":"long-running", "acquireMetadata": true}' | grep 'OSRelease'
+
+# test io.systemd.MachineImage.Update
+varlinkctl call /run/systemd/machine/io.systemd.MachineImage io.systemd.MachineImage.Update '{"name":"long-running", "newName": "long-running-renamed", "readOnly": true}'
+varlinkctl call /run/systemd/machine/io.systemd.MachineImage io.systemd.MachineImage.List '{"name":"long-running-renamed"}'
+varlinkctl call /run/systemd/machine/io.systemd.MachineImage io.systemd.MachineImage.List '{"name":"long-running-renamed"}' | jq '.readOnly' | grep 'true'
+
+varlinkctl call /run/systemd/machine/io.systemd.MachineImage io.systemd.MachineImage.Update '{"name":"long-running-renamed", "newName": "long-running", "readOnly": false}'
+varlinkctl call /run/systemd/machine/io.systemd.MachineImage io.systemd.MachineImage.List '{"name":"long-running"}'
+varlinkctl call /run/systemd/machine/io.systemd.MachineImage io.systemd.MachineImage.List '{"name":"long-running"}' | jq '.readOnly' | grep 'false'