A computer-implemented method comprising: obtaining a signed firmware image, the signed firmware image comprising a first code module (311, 313, 317) signed by a first code owner, a second code module signed by a second code owner, and an access control list, wherein the access control list, comprising public keys of the first and second code owners, authorizes the first code owner to update the first code module and the second code owner to update the second code module; obtaining an updated first code module, the updated first code module comprising updated code for the first code module; verifying that the updated first code module is signed by the first code owner; updating the signed firmware image with the updated first code module in response to verifying that the updated first code module is signed by the first code owner; obtaining an access control token, wherein the access control token comprises a public key for a third code owner and authorization for the third code owner to update a third code module of the signed firmware image; verifying that the access control token is signed by an authorized code owner from the access control list after verifying that a public key of the access control token matches one of the public keys of the access control list of the firmware image, wherein the access control token contains the public key of the authorized code owner; verifying that the authorized code owner is authorized to update the third code module, wherein the access control list of the firmware image authorizes the second code owner to update the third code module; updating the access control list, in response to verifying that the authorized code owner is authorized to update the third code module, to include the public key for the third code owner and the authorization for the third code owner to update the third code module; receiving an updated third code module from the third code owner; verifying that the updated third code module is signed by the third code owner; and updating the signed firmware image with the updated third code module in response to verifying that the third code owner is authorized to update the third code module and that the updated third code module is signed by the third code owner. obtaining a signed firmware image, the signed firmware image comprising a first code module (311, 313, 317) signed by a first code owner, a second code module signed by a second code owner, and an access control list, wherein the access control list, comprising public keys of the first and second code owners, authorizes the first code owner to update the first code module and the second code owner to update the second code module; obtaining an updated first code module, the updated first code module comprising updated code for the first code module; verifying that the updated first code module is signed by the first code owner; updating the signed firmware image with the updated first code module in response to verifying that the updated first code module is signed by the first code owner; obtaining an access control token, wherein the access control token comprises a public key for a third code owner and authorization for the third code owner to update a third code module of the signed firmware image; verifying that the access control token is signed by an authorized code owner from the access control list after verifying that a public key of the access control token matches one of the public keys of the access control list of the firmware image, wherein the access control token contains the public key of the authorized code owner; verifying that the authorized code owner is authorized to update the third code module, wherein the access control list of the firmware image authorizes the second code owner to update the third code module; updating the access control list, in response to verifying that the authorized code owner is authorized to update the third code module, to include the public key for the third code owner and the authorization for the third code owner to update the third code module; receiving an updated third code module from the third code owner; verifying that the updated third code module is signed by the third code owner; and updating the signed firmware image with the updated third code module in response to verifying that the third code owner is authorized to update the third code module and that the updated third code module is signed by the third code owner.