diff --git a/chapsd.conf b/chapsd.conf
index 5b7934f..d2e8143 100644
--- a/chapsd.conf
+++ b/chapsd.conf
@@ -20,5 +20,7 @@
     VERBOSE="--v=1"
     rm /home/chronos/.chaps_debug_1
   fi
+  mkdir -p /var/lib/chaps
+  chown chaps:chronos-access /var/lib/chaps
   exec chapsd ${VERBOSE}
 end script
diff --git a/p11_replay.cc b/p11_replay.cc
index 97afaeb..339ff85 100644
--- a/p11_replay.cc
+++ b/p11_replay.cc
@@ -60,7 +60,6 @@
     LOG(INFO) << "No slots.";
     exit(-1);
   }
-  LOG(INFO) << "Choosing slot " << slot_list[0];
   return slot_list[0];
 }
 
@@ -386,10 +385,28 @@
     CreateCertificate(session, object_data, object_id, certificate);
     X509_free(certificate);
   } else if (type == kPrivateKey) {
+    // Try decoding a PKCS#1 RSAPrivateKey structure.
     RSA* rsa = d2i_RSAPrivateKey(NULL, &data_start, object_data.length());
     if (!rsa) {
-      LOG(ERROR) << "OpenSSL error in RSA private key parsing.";
-      exit(-1);
+      // Rewind the ptr just in case it was modified.
+      data_start = reinterpret_cast<const unsigned char*>(object_data.c_str());
+      // Try decoding a PKCS#8 structure.
+      PKCS8_PRIV_KEY_INFO *p8 = d2i_PKCS8_PRIV_KEY_INFO(NULL,
+                                                        &data_start,
+                                                        object_data.length());
+      if (!p8 || ASN1_TYPE_get(p8->pkey) != V_ASN1_OCTET_STRING) {
+        LOG(ERROR) << "OpenSSL error in PKCS #8 private key parsing.";
+        exit(-1);
+      }
+      // See if we have a RSAPrivateKey in the PKCS#8 structure.
+      data_start = p8->pkey->value.octet_string->data;
+      rsa = d2i_RSAPrivateKey(NULL, &data_start,
+                              p8->pkey->value.octet_string->length);
+      PKCS8_PRIV_KEY_INFO_free(p8);
+      if (!rsa) {
+        LOG(ERROR) << "OpenSSL error in RSA private key parsing.";
+        exit(-1);
+      }
     }
     CreatePrivateKey(session, object_id, "testing_key", rsa);
     RSA_free(rsa);
@@ -465,7 +482,7 @@
 }
 
 void PrintHelp() {
-  printf("Usage: p11_replay [COMMAND]\n");
+  printf("Usage: p11_replay [--slot=<slot>] [COMMAND]\n");
   printf("Commands:\n");
   printf("  --cleanup : Deletes all test keys.\n");
   printf("  --generate [--label=<key_label> --key_size=<size_in_bits>]"
@@ -474,8 +491,8 @@
          "useful for comparing key generation on different TPM models.\n");
   printf("  --import --path=<path to file> --type=<cert, privkey, pubkey>"
          " --id=<token id str>"
-         " : Reads an object into the token.  Accepts DER formatted"
-         " certificates and DER formatted private keys.\n");
+         " : Reads an object into the token.  Accepts DER formatted X.509"
+         " certificates and DER formatted PKCS#1 or PKCS#8 private keys.\n");
   printf("  --inject [--label=<key_label> --key_size=<size_in_bits>]"
          " : Locally generates a key pair suitable for replay tests and injects"
          " it into the token.\n");
@@ -592,6 +609,11 @@
   chromeos::InitLog(chromeos::kLogToSyslog | chromeos::kLogToStderr);
   base::TimeTicks start_ticks = base::TimeTicks::Now();
   CK_SLOT_ID slot = Initialize();
+  int tmp_slot = 0;
+  if (cl->HasSwitch("slot") &&
+      base::StringToInt(cl->GetSwitchValueASCII("slot"), &tmp_slot))
+    slot = tmp_slot;
+  LOG(INFO) << "Using slot " << slot;
   CK_SESSION_HANDLE session = OpenSession(slot);
   PrintTicks(&start_ticks);
   string label = "_default";
diff --git a/slot_manager_impl.cc b/slot_manager_impl.cc
index faa7d07..d6df63b 100644
--- a/slot_manager_impl.cc
+++ b/slot_manager_impl.cc
@@ -14,6 +14,7 @@
 
 #include <base/basictypes.h>
 #include <base/file_path.h>
+#include <base/file_util.h>
 #include <base/logging.h>
 #include <base/memory/scoped_ptr.h>
 #include <chromeos/secure_blob.h>
@@ -46,6 +47,10 @@
 const CK_ULONG kMaxPinLen = 127;
 const CK_ULONG kMinPinLen = 6;
 const char kSlotDescription[] = "TPM Slot";
+const FilePath::CharType kSystemTokenPath[] =
+    FILE_PATH_LITERAL("/var/lib/chaps");
+const char kSystemTokenAuthData[] = "000000";
+const char kSystemTokenLabel[] = "System TPM Token";
 const char kTokenLabel[] = "User-Specific TPM Token";
 const char kTokenModel[] = "";
 const char kTokenSerialNumber[] = "Not Available";
@@ -289,15 +294,29 @@
     LOG(WARNING) << "TPM failed to generate random data.";
   }
 
-  // Add default isolate
+  // Add default isolate.
   AddIsolate(IsolateCredentialManager::GetDefaultIsolateCredential());
 
-  // Default semantics are to always start with two slots.  One 'system' slot
+  // By default we'll start with two slots.  This allows for one 'system' slot
   // which always has a token available, and one 'user' slot which will have no
   // token until a login event is received.
-  // TODO(dkrahn): Make this 2 once we're ready to enable the system token.
-  // crosbug.com/27759.
-  AddSlots(1);
+  AddSlots(2);
+
+  if (file_util::DirectoryExists(FilePath(kSystemTokenPath))) {
+    // Setup the system token.
+    int system_slot_id = 0;
+    if (!LoadToken(IsolateCredentialManager::GetDefaultIsolateCredential(),
+                   FilePath(kSystemTokenPath),
+                   SecureBlob(kSystemTokenAuthData),
+                   kSystemTokenLabel,
+                   &system_slot_id)) {
+      LOG(ERROR) << "Failed to load the system token.";
+      return false;
+    }
+  } else {
+    LOG(WARNING) << "System token not loaded because " << kSystemTokenPath
+                 << " does not exist.";
+  }
   return true;
 }
 
diff --git a/slot_manager_test.cc b/slot_manager_test.cc
index 2da601b..0d066da 100644
--- a/slot_manager_test.cc
+++ b/slot_manager_test.cc
@@ -209,7 +209,7 @@
 }
 
 TEST_F(TestSlotManager, DefaultSlotSetup) {
-  EXPECT_EQ(1, slot_manager_->GetSlotCount());
+  EXPECT_EQ(2, slot_manager_->GetSlotCount());
   EXPECT_FALSE(slot_manager_->IsTokenAccessible(ic_, 0));
 }
 
@@ -304,7 +304,6 @@
                                        kTokenLabel,
                                        &slot_id2));
   EXPECT_EQ(slot_id, slot_id2);
-  EXPECT_EQ(2, slot_manager_->GetSlotCount());
   EXPECT_TRUE(slot_manager_->LoadToken(ic_,
                                        FilePath("another_path"),
                                        MakeBlob(kAuthData),
@@ -317,7 +316,6 @@
   slot_manager_->ChangeTokenAuthData(FilePath("yet_another_path"),
                                        MakeBlob(kAuthData),
                                        MakeBlob(kNewAuthData));
-  EXPECT_LT(slot_manager_->GetSlotCount(), 5);
   // Logout with an unknown path.
   slot_manager_->UnloadToken(ic_, FilePath("still_yet_another_path"));
   slot_manager_->UnloadToken(ic_, FilePath("some_path"));
@@ -446,7 +444,6 @@
                                        MakeBlob(kAuthData),
                                        kTokenLabel,
                                        &slot_id));
-  EXPECT_EQ(1, slot_manager_->GetSlotCount());
 
   EXPECT_TRUE(slot_manager_->OpenIsolate(&new_isolate_1, &new_isolate_created));
   EXPECT_TRUE(new_isolate_created);
@@ -455,7 +452,6 @@
                                        MakeBlob(kAuthData),
                                        kTokenLabel,
                                        &slot_id));
-  EXPECT_EQ(2, slot_manager_->GetSlotCount());
 
   // Ensure tokens are only accessible with the valid isolate cred.
   EXPECT_TRUE(slot_manager_->IsTokenAccessible(new_isolate_0, 0));