diff --git a/script/toolchain-download b/script/toolchain-download
new file mode 100755
index 000000000..b5438037b
--- /dev/null
+++ b/script/toolchain-download
@@ -0,0 +1,54 @@
+#!/bin/bash
+
+# script/toolchain-download: Download and extract the GNU Arm Embedded toolchain
+#			     for building the TREZOR firmware.
+
+set -e
+
+cd "$(dirname "$0")/../vendor"
+
+readonly URL="https://launchpad.net/gcc-arm-embedded/5.0/5-2016-q2-update/+download/gcc-arm-none-eabi-5_4-2016q2-20160622-linux.tar.bz2"
+readonly SHA256SUM="9910b6b5df12efe564dbb3856bf1599d4c16178a6f28bd8a23c9e5c3edc219e4"
+
+readonly FILENAME="$(basename "$URL")"
+readonly DIRECTORY="gcc-arm-none-eabi-5_4-2016q2"
+
+if [ "$(uname)" != "Linux" ]; then
+    printf "Unsupported platform\n" >&2
+    exit 1
+fi
+
+validate_download() {
+    printf "$SHA256SUM $FILENAME" | sha256sum -c
+}
+
+download_file() {
+    curl -LC- "$URL" -o "$FILENAME"
+}
+
+extract_download() {
+    local temporary_dir="$(mktemp -d ./toolchain.XXXXXXXXXX)"
+    trap "rm -rf $temporary_dir" EXIT
+
+    tar -xf "$FILENAME" -C "$temporary_dir"
+    mv "$temporary_dir/$DIRECTORY" .
+    rm -f "$FILENAME"
+}
+
+if [ ! -d "$DIRECTORY" ]; then
+    if ! validate_download; then
+	download_file
+	validate_download
+    fi
+
+    extract_download
+fi
+
+# init toolchain as repository so Git will skip it
+git init -q "$DIRECTORY"
+
+# update toolchain symlink
+ln -snf "$DIRECTORY" toolchain
+
+# sanity-check extracted toolchain
+toolchain/bin/arm-none-eabi-gcc --version >/dev/null
diff --git a/script/toolchain-run b/script/toolchain-run
new file mode 100755
index 000000000..09e2a63d8
--- /dev/null
+++ b/script/toolchain-run
@@ -0,0 +1,18 @@
+#!/bin/bash
+
+# script/toolchain-run: Run command with downloaded GNU Arm Embedded toolchain.
+#
+
+set -e
+
+readonly TOOLCHAIN_RELATIVE_DIR="vendor/toolchain"
+readonly TOOLCHAIN_DIR="$(readlink -f "$(dirname "$0")/../$TOOLCHAIN_RELATIVE_DIR")"
+
+if [ ! -d "$TOOLCHAIN_DIR" ]; then
+    printf "Could not find toolchain in %s.\n" "$TOOLCHAIN_RELATIVE_DIR" >&2
+    printf "Run script/toolchain-download to download it.\n" >&2
+    exit 1
+fi
+
+export PATH="$TOOLCHAIN_DIR/bin:$PATH"
+exec "$@"
diff --git a/vendor/.gitignore b/vendor/.gitignore
new file mode 100644
index 000000000..47acdc548
--- /dev/null
+++ b/vendor/.gitignore
@@ -0,0 +1,4 @@
+# toolchain-download
+gcc-arm-none-eabi-*
+toolchain
+toolchain.*/