A computer-implemented method for updating system-level services within read-only system images, at least a portion of the method being performed by a mobile computing device comprising at least one processor, the method comprising: retrieving, from a remote server, a digitally signed update for at least one system-level service stored within a read-only system image located on the mobile computing device, wherein the system-level service is configured to be loaded during an initialization of the mobile computing device; installing the digitally signed update in a pre-defined location within a writable partition located on the mobile computing device; executing, during the initialization of the mobile computing device, an update service stored within the read-only system image; executing, via the update service, the digitally signed update within the writable partition instead of the system-level service stored within the read-only system image; the method further comprising: detecting, via a fail-safe module, that the mobile computing device failed to initialize after the update service executed the digitally signed update; storing, via the fail-safe module, information about the failed initialization in a log within the writable partition; when the mobile computing device re-initializes, determining, via the fail-safe module, based on the information stored in the log, that the digitally signed update for the system-level service caused the failed initialization; executing, via the fail-safe module, the system-level service stored within the read-only system image instead of the digitally signed update within the writable partition. retrieving, from a remote server, a digitally signed update for at least one system-level service stored within a read-only system image located on the mobile computing device, wherein the system-level service is configured to be loaded during an initialization of the mobile computing device; installing the digitally signed update in a pre-defined location within a writable partition located on the mobile computing device; executing, during the initialization of the mobile computing device, an update service stored within the read-only system image; executing, via the update service, the digitally signed update within the writable partition instead of the system-level service stored within the read-only system image; the method further comprising: detecting, via a fail-safe module, that the mobile computing device failed to initialize after the update service executed the digitally signed update; storing, via the fail-safe module, information about the failed initialization in a log within the writable partition; when the mobile computing device re-initializes, determining, via the fail-safe module, based on the information stored in the log, that the digitally signed update for the system-level service caused the failed initialization; executing, via the fail-safe module, the system-level service stored within the read-only system image instead of the digitally signed update within the writable partition. detecting, via a fail-safe module, that the mobile computing device failed to initialize after the update service executed the digitally signed update; storing, via the fail-safe module, information about the failed initialization in a log within the writable partition; when the mobile computing device re-initializes, determining, via the fail-safe module, based on the information stored in the log, that the digitally signed update for the system-level service caused the failed initialization; executing, via the fail-safe module, the system-level service stored within the read-only system image instead of the digitally signed update within the writable partition.