diff --git a/Makefile b/Makefile
deleted file mode 100644
index 4ca45f4..0000000
--- a/Makefile
+++ /dev/null
@@ -1,85 +0,0 @@
-# Makefile for building mcuboot as a Zephyr project.
-
-########################
-# Configuration choices.
-########################
-
-# Set this variable to determine the signature type used.  Currently,
-# it should be set to either RSA, or ECDSA_P256.  This value can be
-# overridden by the make invocation, e.g.:
-#
-#     make CONF_SIGNATURE_TYPE=ECDSA_P256
-#
-CONF_SIGNATURE_TYPE ?= RSA
-
-# Should the bootloader attempt to validate the signature of slot0
-# when just booting.  This adds the signature check time to every
-# boot, but can mitigate against some changes that are able to modify
-# the flash image itself.  Set to "YES" for the validation, or any
-# other value to not.
-#
-CONF_VALIDATE_SLOT0 ?= YES
-
-# If this is set to YES, overwrite slot0 with the upgrade image
-# instead of swapping them.  This prevents the fallback recovery, but
-# uses a much simpler code path.
-#
-CONF_UPGRADE_ONLY ?= NO
-
-##############################
-# End of configuration blocks.
-##############################
-
-ifeq ($(CONF_SIGNATURE_TYPE),RSA)
-# RSA
-CONF_FILE = boot/zephyr/prj.conf
-CFLAGS += -DMCUBOOT_SIGN_RSA -DMCUBOOT_USE_MBED_TLS
-
-else ifeq ($(CONF_SIGNATURE_TYPE),ECDSA_P256)
-# ECDSA P-256
-CONF_FILE = boot/zephyr/prj-p256.conf
-CFLAGS += -DMCUBOOT_SIGN_EC256 -DMCUBOOT_USE_TINYCRYPT
-NEED_TINYCRYPT = y
-export NEED_TINYCRYPT
-
-else
-$(error Invalid CONF_SIGNATURE_TYPE specified)
-endif
-
-# Enable this option to have the bootloader verify the signature of
-# the primary image upon every boot.  Without it, signature
-# verification only happens on upgrade.
-ifeq ($(CONF_VALIDATE_SLOT0),YES)
-CFLAGS += -DMCUBOOT_VALIDATE_SLOT0
-endif
-
-# Enabling this option uses newer flash map APIs. This saves RAM and
-# avoids deprecated API usage.
-#
-# (This can be deleted when flash_area_to_sectors() is removed instead
-# of simply deprecated.)
-CFLAGS += -DMCUBOOT_USE_FLASH_AREA_GET_SECTORS
-
-# Enable this option to not use the swapping code and just overwrite
-# the image on upgrade.
-ifeq ($(CONF_UPGRADE_ONLY),YES)
-CFLAGS += -DMCUBOOT_OVERWRITE_ONLY -DMCUBOOT_OVERWRITE_ONLY_FAST
-endif
-
-# The board should be set to one of the targets supported by
-# mcuboot/Zephyr.  These can be found in ``boot/zephyr/targets``
-BOARD ?= qemu_x86
-
-# Additional board-specific Zephyr configuration
-CONF_FILE += $(wildcard boot/zephyr/$(BOARD).conf)
-
-# The source to the Zephyr-specific code lives here.
-SOURCE_DIR = boot/zephyr
-
-# Needed for mbedtls config-boot.h file.
-CFLAGS += -I$(CURDIR)/boot/zephyr/include
-
-DTC_OVERLAY_FILE := $(CURDIR)/boot/zephyr/dts.overlay
-export DTC_OVERLAY_FILE
-
-include ${ZEPHYR_BASE}/Makefile.inc
diff --git a/README-zephyr.rst b/README-zephyr.rst
index b7744c1..3d86165 100644
--- a/README-zephyr.rst
+++ b/README-zephyr.rst
@@ -6,7 +6,7 @@
 There are some pretty significant differences in how apps are built
 for Zephyr, and these are documented here.
 
-Please see ``boot/bootutil/design.txt`` for documentation on the
+Please see ``docs/design.md`` for documentation on the
 design and operation of the bootloader itself.  This functionality
 should be the same between Mynewt and Zephyr.
 
@@ -31,16 +31,18 @@
 
 The bootloader is an ordinary Zephyr application, at least from
 Zephyr's point of view.  There is a bit of configuration that needs to
-be made before building it.  Most of this is done in the top-level
-``Makefile`` in the source tree.  There are comments there for
+be made before building it.  Most of this can be done as documented in
+the ``CMakeLists.txt`` file in boot/zephyr.  There are comments there for
 guidance.  It is important to select a signature algorithm, and decide
 if slot0 should be validated on every boot.
 
-There is a ``build_boot.sh`` script at the top level that can make
-building a bit easier.  It assumes that the mcuboot tree is next to,
-at the same level, as the zephyr source tree.  It takes a single
-argument, which is the target to build. This must be a Zephyr board
-which supports mcuboot.
+To build mcuboot, create a build directory in boot/zephyr, and build
+it as usual:
+
+$ cd boot/zephyr
+$ mkdir build && cd build
+$ cmake -DBOARD=<board> ..
+$ make
 
 In addition to the partitions defined in DTS, some additional
 information about the flash layout is currently required to build
@@ -50,8 +52,10 @@
 mcuboot on a per-SoC family basis.
 
 After building the bootloader, the binaries should reside in
-``outdir/targname/zephyr.[bin|hex]``.  Use the flashing tools you have to
-install this image, usually at the beginning of the flash.
+``build/zephyr/zephyr.{bin,hex,elf}``, where ``build`` is the build
+directory you chose when running ``cmake``. Use the Zephyr build
+system ``flash`` target to flash these binaries, usually by running
+``make flash`` (or ``ninja flash``, etc.) from the build directory.
 
 Building Applications for the bootloader
 ========================================
diff --git a/boot/bootutil/src/Makefile b/boot/bootutil/src/Makefile
deleted file mode 100644
index cd38b0f..0000000
--- a/boot/bootutil/src/Makefile
+++ /dev/null
@@ -1,6 +0,0 @@
-# Makefile for Zephyr build
-
-include $(ZEPHYR_BASE)/ext/lib/crypto/mbedtls/Makefile.include
-
-obj-y += loader.o bootutil_misc.o image_validate.o image_rsa.o image_ec256.o
-obj-y += caps.o
diff --git a/boot/zephyr/CMakeLists.txt b/boot/zephyr/CMakeLists.txt
new file mode 100644
index 0000000..0b9eabb
--- /dev/null
+++ b/boot/zephyr/CMakeLists.txt
@@ -0,0 +1,170 @@
+# CMakeLists.txt for building mcuboot as a Zephyr project
+#
+# Copyright (c) 2017 Open Source Foundries Limited
+#
+# SPDX-License-Identifier: Apache-2.0
+
+cmake_minimum_required(VERSION 3.8.2)
+
+########################
+# Configuration choices.
+########################
+
+# Set CONF_SIGNATURE_TYPE to determine the signature type used.
+# Currently, it should be set to either RSA or ECDSA_P256.
+#
+# To choose RSA (this is the default):
+#
+#     cmake -DCONF_SIGNATURE_TYPE=RSA [...]
+#
+# To use ECDSA_P256:
+#
+#     cmake -DCONF_SIGNATURE_TYPE=ECDSA_P256 [...]
+if (NOT DEFINED CONF_SIGNATURE_TYPE)
+  set(CONF_SIGNATURE_TYPE RSA)
+endif()
+
+# If CONF_VALIDATE_SLOT0 is set, the bootloader attempts to validate
+# the signature of slot0 every boot.  This adds the signature check
+# time to every boot, but can mitigate against some changes that are
+# able to modify the flash image itself.
+#
+# To enable validation (this is the default):
+#
+#     cmake -DCONF_VALIDATE_SLOT0=YES [...]
+#
+# To disable validation:
+#
+#     cmake -DCONF_VALIDATE_SLOT0=NO [...]
+if (NOT DEFINED CONF_VALIDATE_SLOT0)
+  set(CONF_VALIDATE_SLOT0 YES)
+endif()
+
+# If CONF_UPGRADE_ONLY is set, overwrite slot0 with the upgrade image
+# instead of swapping them.  This prevents the fallback recovery, but
+# uses a much simpler code path.
+#
+# To enable "upgrade only" mode:
+#
+#     cmake -DCONF_UPGRADE_ONLY=YES [...]
+#
+# To disable "upgrade only" mode (this is the default):
+#
+#     cmake -DCONF_UPGRADE_ONLY=NO [...]
+if (NOT DEFINED CONF_UPGRADE_ONLY)
+  set(CONF_UPGRADE_ONLY NO)
+endif()
+
+##############################
+# End of configuration blocks.
+##############################
+
+set(MCUBOOT_EXTRA_CFLAGS)
+
+# Determine CFLAGS / MCUBOOT_CONF_FILE / NEED_TINYCRYPT from the signature type.
+if(CONF_SIGNATURE_TYPE STREQUAL RSA)
+  set(MCUBOOT_CONF_FILE prj.conf) # RSA
+  list(APPEND MCUBOOT_EXTRA_CFLAGS "-DMCUBOOT_SIGN_RSA" "-DMCUBOOT_USE_MBED_TLS")
+  set(NEED_TINYCRYPT NO)
+elseif(CONF_SIGNATURE_TYPE STREQUAL ECDSA_P256)
+  set(MCUBOOT_CONF_FILE prj-p256.conf) # ECDSA P-256
+  list(APPEND MCUBOOT_EXTRA_CFLAGS "-DMCUBOOT_SIGN_EC256" "-DMCUBOOT_USE_TINYCRYPT")
+  set(NEED_TINYCRYPT YES)
+else()
+  message(FATAL_ERROR "Invalid CONF_SIGNATURE_TYPE specified: '${CONF_SIGNATURE_TYPE}'")
+endif()
+
+# Board-specific CONF_FILES should get merged into the build as well.
+#
+# Do this by defining the set_conf_file macro:
+# http://docs.zephyrproject.org/application/application.html#application-configuration
+macro(set_conf_file)
+  if (EXISTS ${APPLICATION_SOURCE_DIR}/boards/${BOARD}.conf)
+    set(CONF_FILE "${MCUBOOT_CONF_FILE} ${APPLICATION_SOURCE_DIR}/boards/${BOARD}.conf")
+  else()
+    set(CONF_FILE "${MCUBOOT_CONF_FILE}")
+  endif()
+endmacro()
+
+# Check if we need to validate slot 0.
+if(CONF_VALIDATE_SLOT0 STREQUAL YES)
+  list(APPEND MCUBOOT_EXTRA_CFLAGS "-DMCUBOOT_VALIDATE_SLOT0")
+endif()
+
+# Enabling this option uses newer flash map APIs. This saves RAM and
+# avoids deprecated API usage.
+#
+# (This can be deleted when flash_area_to_sectors() is removed instead
+# of simply deprecated.)
+list(APPEND MCUBOOT_EXTRA_CFLAGS "-DMCUBOOT_USE_FLASH_AREA_GET_SECTORS")
+
+# Check if we're operating in overwrite-only mode.
+if(CONF_UPGRADE_ONLY STREQUAL YES)
+  list (APPEND MCUBOOT_EXTRA_CFLAGS "-DMCUBOOT_OVERWRITE_ONLY" "-DMCUBOOT_OVERWRITE_ONLY_FAST")
+endif()
+
+# Add values in MCUBOOT_EXTRA_CFLAGS_STR to the Zephyr build's
+# EXTRA_CFLAGS variable.
+string(REPLACE ";" " " MCUBOOT_EXTRA_CFLAGS_STR "${MCUBOOT_EXTRA_CFLAGS}")
+set(EXTRA_CFLAGS "${EXTRA_CFLAGS} ${MCUBOOT_EXTRA_CFLAGS_STR}")
+
+# The board should be set to a supported target.
+if (NOT DEFINED BOARD)
+  set(BOARD qemu_x86)
+endif()
+
+# This is necessary to ensure mcuboot is linked into, and fits inside,
+# the boot partition.
+set(DTC_OVERLAY_FILE dts.overlay)
+
+# Standard Zephyr application boilerplate:
+# http://docs.zephyrproject.org/application/application.html
+include($ENV{ZEPHYR_BASE}/cmake/app/boilerplate.cmake NO_POLICY_SCOPE)
+project(NONE)
+
+# Path to "boot" subdirectory of repository root.
+get_filename_component(BOOT_DIR ${APPLICATION_SOURCE_DIR} DIRECTORY)
+# Path to top-level repository root directory.
+get_filename_component(MCUBOOT_DIR ${BOOT_DIR} DIRECTORY)
+# Path to tinycrypt library source subdirectory of MCUBOOT_DIR.
+set(TINYCRYPT_DIR "${MCUBOOT_DIR}/ext/tinycrypt/lib")
+
+# Zephyr's mbedTLS needs this.
+zephyr_include_directories(include)
+
+# Zephyr application include directories.
+target_include_directories(app PRIVATE $ENV{ZEPHYR_BASE}/ext/lib/crypto/mbedtls/include)
+target_include_directories(app PRIVATE include)
+target_include_directories(app PRIVATE targets)
+if(EXISTS "${APPLICATION_SOURCE_DIR}/targets/${BOARD}.h")
+  target_compile_definitions(app PRIVATE "-DMCUBOOT_TARGET_CONFIG='\"${BOARD}.h\"'")
+endif()
+
+# Zephyr port-specific sources.
+target_sources(app PRIVATE main.c)
+target_sources(app PRIVATE flash_map.c)
+target_sources(app PRIVATE hal_flash.c)
+target_sources(app PRIVATE os.c)
+target_sources(app PRIVATE keys.c)
+if(NOT DEFINED CONFIG_FLASH_PAGE_LAYOUT)
+  target_sources(app PRIVATE flash_map_legacy.c)
+endif()
+
+# Generic bootutil sources and includes.
+target_include_directories(app PRIVATE "${BOOT_DIR}/bootutil/include")
+target_sources(app PRIVATE "${BOOT_DIR}/bootutil/src/loader.c")
+target_sources(app PRIVATE "${BOOT_DIR}/bootutil/src/bootutil_misc.c")
+target_sources(app PRIVATE "${BOOT_DIR}/bootutil/src/image_validate.c")
+target_sources(app PRIVATE "${BOOT_DIR}/bootutil/src/image_rsa.c")
+target_sources(app PRIVATE "${BOOT_DIR}/bootutil/src/image_ec256.c")
+target_sources(app PRIVATE "${BOOT_DIR}/bootutil/src/caps.c")
+
+# Tinycrypt sources and includes, if needed.
+if (NEED_TINYCRYPT)
+  target_include_directories(app PRIVATE "${TINYCRYPT_DIR}/include")
+
+  target_sources(app PRIVATE "${TINYCRYPT_DIR}/source/ecc.c")
+  target_sources(app PRIVATE "${TINYCRYPT_DIR}/source/ecc_dsa.c")
+  target_sources(app PRIVATE "${TINYCRYPT_DIR}/source/sha256.c")
+  target_sources(app PRIVATE "${TINYCRYPT_DIR}/source/utils.c")
+endif()
diff --git a/boot/zephyr/Makefile b/boot/zephyr/Makefile
deleted file mode 100644
index 3f9b0a0..0000000
--- a/boot/zephyr/Makefile
+++ /dev/null
@@ -1,20 +0,0 @@
-ifneq ($(wildcard $(PROJECT)/boot/zephyr/targets/$(BOARD).h),)
-subdir-ccflags-y += -DMCUBOOT_TARGET_CONFIG='"$(BOARD).h"'
-endif
-subdir-ccflags-y += -I$(PROJECT)/boot/bootutil/include
-subdir-ccflags-y += -I$(PROJECT)/boot/zephyr/include
-subdir-ccflags-y += -I$(PROJECT)/boot/zephyr/targets
-
-obj-y += main.o
-obj-y += flash_map.o hal_flash.o os.o
-# Legacy fallbacks used when the flash driver doesn't provide page
-# layout support.
-ifneq ($(CONFIG_FLASH_PAGE_LAYOUT),y)
-obj-y += flash_map_legacy.o
-endif
-obj-y += keys.o
-
-obj-y += ../bootutil/src/
-
-obj-$(NEED_TINYCRYPT) += ../../ext/tinycrypt/lib/source/
-include $(PROJECT)/ext/tinycrypt/lib/source/Makefile.inc
diff --git a/ext/tinycrypt/lib/source/Makefile b/ext/tinycrypt/lib/source/Makefile
deleted file mode 100644
index b61b05c..0000000
--- a/ext/tinycrypt/lib/source/Makefile
+++ /dev/null
@@ -1,4 +0,0 @@
-# Zephyr makefile.
-# subdir-ccflags-y += -I$(PROJECT)/ext/tinycrypt/lib/include
-
-obj-y += ecc.o ecc_dsa.o sha256.o utils.o
diff --git a/ext/tinycrypt/lib/source/Makefile.inc b/ext/tinycrypt/lib/source/Makefile.inc
deleted file mode 100644
index ebb101a..0000000
--- a/ext/tinycrypt/lib/source/Makefile.inc
+++ /dev/null
@@ -1,3 +0,0 @@
-# vim: ft=make
-
-subdir-ccflags-$(NEED_TINYCRYPT) += -I$(PROJECT)/ext/tinycrypt/lib/include
diff --git a/samples/zephyr/Makefile b/samples/zephyr/Makefile
index ecfd4b4..8d55e30 100644
--- a/samples/zephyr/Makefile
+++ b/samples/zephyr/Makefile
@@ -2,6 +2,7 @@
 # Sample multi-part application Makefile
 #
 # Copyright (c) 2017 Linaro Limited
+# Copyright (c) 2017 Open Source Foundries Limited
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -47,12 +48,12 @@
 # then revert back to the first app, since we did not mark this image
 # as good.
 
-BOARD ?=
-
-# We can override the Zephyr configuration for the bootloader by
+# We can add on to the CMake configuration for the bootloader by
 # setting this.
 BOOTLOADER_CONFIG ?=
 
+BOARD ?= frdm_k64f
+
 .PHONY: check boot hello1 clean_boot clean_hello1 \
 	hello2 clean_hello2 flash_boot flash_hello1 flash_hello2
 
@@ -76,15 +77,21 @@
 ASSEMBLE = ../../scripts/assemble.py
 PYOCD_FLASHTOOL = pyocd-flashtool
 
+SOURCE_DIRECTORY := $(CURDIR)
+BUILD_DIRECTORY := $(CURDIR)/build/$(BOARD)
+BUILD_DIR_BOOT := $(BUILD_DIRECTORY)/mcuboot
+BUILD_DIR_HELLO1 := $(BUILD_DIRECTORY)/hello1
+BUILD_DIR_HELLO2 := $(BUILD_DIRECTORY)/hello2
+
 help:
 	@echo "make <target> BOARD=<board>"
 	@echo "<target>: all, boot, hello1, full.bin"
-	@echo "<board>: frdm_k64f, 96b_carbon, etc."
+	@echo "<board>: frdm_k64f only for now"
 
 all: boot hello1 hello2
 
 full.bin: boot hello1 hello2
-	$(ASSEMBLE) -b ../../outdir/$(BOARD) \
+	$(ASSEMBLE) -b $(BUILD_DIR_BOOT) \
 	    -p signed-hello1.bin \
 	    -s signed-hello2.bin \
 	    -o full.bin
@@ -96,26 +103,38 @@
 
 boot: check
 	@rm -f mcuboot.bin
-	$(MAKE) -C ../.. BOARD=$(BOARD) -j$(nproc) $(BOOTLOADER_CONFIG)
-	cp ../../outdir/$(BOARD)/zephyr.bin mcuboot.bin
+	(mkdir -p $(BUILD_DIR_BOOT) && \
+		cd $(BUILD_DIR_BOOT) && \
+		cmake $(BOOTLOADER_CONFIG) \
+			-G"Unix Makefiles" \
+			-DBOARD=$(BOARD) \
+			$(SOURCE_DIRECTORY)/../../boot/zephyr && \
+		make -j$(nproc))
+	cp $(BUILD_DIR_BOOT)/zephyr/zephyr.bin mcuboot.bin
 
 clean_boot: check
-	rm -rf ../../outdir/$(BOARD)
+	rm -rf $(BUILD_DIR_BOOT)
 
 # Build and sign "hello1".
 hello1: check
-	$(MAKE) -C hello-world FROM_WHO="hello1" O=outdir/hello1/$(BOARD) BOARD=$(BOARD) -j$(nproc)
+	(mkdir -p $(BUILD_DIR_HELLO1) && \
+		cd $(BUILD_DIR_HELLO1) && \
+		cmake -DFROM_WHO=hello1 \
+			-G"Unix Makefiles" \
+			-DBOARD=$(BOARD) \
+			$(SOURCE_DIRECTORY)/hello-world && \
+		make -j$(nproc))
 	$(IMGTOOL) sign \
 		--key $(SIGNING_KEY) \
 		--header-size $(BOOT_HEADER_LEN) \
 		--align $(FLASH_ALIGNMENT) \
 		--version 1.2 \
 		--included-header \
-		hello-world/outdir/hello1/$(BOARD)/zephyr.bin \
+		$(BUILD_DIR_HELLO1)/zephyr/zephyr.bin \
 		signed-hello1.bin
 
 clean_hello1: check
-	rm -rf hello-world/outdir/hello1/$(BOARD)
+	rm -rf $(BUILD_DIR_HELLO1)
 
 # Build and sign "hello2".
 # This is the same signing command as above, except that it adds the
@@ -123,7 +142,13 @@
 # this image is intended to be an upgrade.  It should be flashed into
 # slot1 instead of slot0.
 hello2: check
-	$(MAKE) -C hello-world FROM_WHO="hello2" O=outdir/hello2/$(BOARD) BOARD=$(BOARD) -j$(nproc)
+	(mkdir -p $(BUILD_DIR_HELLO2) && \
+		cd $(BUILD_DIR_HELLO2) && \
+		cmake -DFROM_WHO=hello2 \
+			-G"Unix Makefiles" \
+			-DBOARD=$(BOARD) \
+			$(SOURCE_DIRECTORY)/hello-world && \
+		make -j$(nproc))
 	$(IMGTOOL) sign \
 		--key $(SIGNING_KEY) \
 		--header-size $(BOOT_HEADER_LEN) \
@@ -131,11 +156,11 @@
 		--version 1.2 \
 		--included-header \
 		--pad 0x60000 \
-		hello-world/outdir/hello2/$(BOARD)/zephyr.bin \
+		$(BUILD_DIR_HELLO2)/zephyr/zephyr.bin \
 		signed-hello2.bin
 
 clean_hello2: check
-	rm -rf hello-world/outdir/hello2/$(BOARD)
+	rm -rf $(BUILD_DIR_HELLO2)
 
 # These flash_* targets use pyocd to flash the images.  The addresses
 # are hardcoded at this time.
@@ -161,28 +186,21 @@
 # flash_hello1: hello1 runs
 # flash_hello2: hello2 runs
 # reset: hello1 runs
-test-good-rsa:
+test-good-rsa: clean
 	$(MAKE) \
-	    BOOTLOADER_CONFIG="CONF_SIGNATURE_TYPE=RSA" \
-	    clean
-	$(MAKE) \
-	    BOOTLOADER_CONFIG="CONF_SIGNATURE_TYPE=RSA" \
-	    all
+		BOOTLOADER_CONFIG="-DCONF_SIGNATURE_TYPE=RSA" \
+		all
 
 # Test a good image, with a good upgrade, using ECDSA signatures.
 # flash_boot: Unable to find bootable image
 # flash_hello1: hello1 runs
 # flash_hello2: hello2 runs
 # reset: hello1 runs
-test-good-ecdsa:
+test-good-ecdsa: clean
 	$(MAKE) \
-	    BOOTLOADER_CONFIG="CONF_SIGNATURE_TYPE=ECDSA_P256" \
-	    SIGNING_KEY=../../root-ec-p256.pem \
-	    clean
-	$(MAKE) \
-	    BOOTLOADER_CONFIG="CONF_SIGNATURE_TYPE=ECDSA_P256" \
-	    SIGNING_KEY=../../root-ec-p256.pem \
-	    all
+		BOOTLOADER_CONFIG="-DCONF_SIGNATURE_TYPE=ECDSA_P256" \
+		SIGNING_KEY=../../root-ec-p256.pem \
+		all
 
 # Test (with RSA) that overwrite-only works.  This should boot,
 # upgrade correctly, but not revert once the upgrade has been done.
@@ -190,13 +208,10 @@
 # flash_hello1: hello1 runs
 # flash_hello2: hello2 runs
 # reset: hello2 runs
-test-overwrite:
+test-overwrite: clean
 	$(MAKE) \
-	    BOOTLOADER_CONFIG="CONF_UPGRADE_ONLY=YES" \
-	    clean
-	$(MAKE) \
-	    BOOTLOADER_CONFIG="CONF_UPGRADE_ONLY=YES" \
-	    all
+		BOOTLOADER_CONFIG="-DCONF_UPGRADE_ONLY=YES" \
+		all
 
 # Test that when configured for RSA, a wrong signature in the upgrade
 # image will fail to upgrade.
@@ -204,17 +219,14 @@
 # flash_hello1: hello1 runs
 # flash_hello2: hello1 runs
 # reset: hello1 runs
-test-bad-rsa-upgrade:
+test-bad-rsa-upgrade: clean
 	$(MAKE) \
-	    BOOTLOADER_CONFIG="CONF_SIGNATURE_TYPE=RSA" \
-	    clean
+		BOOTLOADER_CONFIG="-DCONF_SIGNATURE_TYPE=RSA" \
+		boot hello1
 	$(MAKE) \
-	    BOOTLOADER_CONFIG="CONF_SIGNATURE_TYPE=RSA" \
-	    boot hello1
-	$(MAKE) \
-	    BOOTLOADER_CONFIG="CONF_SIGNATURE_TYPE=RSA" \
-	    SIGNING_KEY=../../root-ec-p256.pem \
-	    hello2
+		BOOTLOADER_CONFIG="-DCONF_SIGNATURE_TYPE=RSA" \
+		SIGNING_KEY=../../root-ec-p256.pem \
+		hello2
 
 # Test that when configured for ECDSA, a wrong signature in the upgrade
 # image will fail to upgrade.
@@ -222,18 +234,15 @@
 # flash_hello1: hello1 runs
 # flash_hello2: hello1 runs
 # reset: hello1 runs
-test-bad-ecdsa-upgrade:
+test-bad-ecdsa-upgrade: clean
 	$(MAKE) \
-	    BOOTLOADER_CONFIG="CONF_SIGNATURE_TYPE=ECDSA_P256" \
-	    clean
+		BOOTLOADER_CONFIG="-DCONF_SIGNATURE_TYPE=ECDSA_P256" \
+		SIGNING_KEY=../../root-ec-p256.pem \
+		boot hello1
 	$(MAKE) \
-	    BOOTLOADER_CONFIG="CONF_SIGNATURE_TYPE=ECDSA_P256" \
-	    SIGNING_KEY=../../root-ec-p256.pem \
-	    boot hello1
-	$(MAKE) \
-	    BOOTLOADER_CONFIG="CONF_SIGNATURE_TYPE=ECDSA_P256" \
-	    SIGNING_KEY=../../root-rsa-2048.pem \
-	    hello2
+		BOOTLOADER_CONFIG="-DCONF_SIGNATURE_TYPE=ECDSA_P256" \
+		SIGNING_KEY=../../root-rsa-2048.pem \
+		hello2
 
 # Test that when configured to not validate slot0, we still boot, but
 # don't upgrade.
@@ -241,49 +250,40 @@
 # flash_hello1: hello1 runs
 # flash_hello2: hello1 runs
 # reset: hello1 runs
-test-no-bootcheck:
+test-no-bootcheck: clean
 	$(MAKE) \
-	    BOOTLOADER_CONFIG="CONF_VALIDATE_SLOT0=NO" \
-	    clean
-	$(MAKE) \
-	    BOOTLOADER_CONFIG="CONF_VALIDATE_SLOT0=NO" \
-	    SIGNING_KEY=../../root-ec-p256.pem \
-	    all
+		BOOTLOADER_CONFIG="-DCONF_VALIDATE_SLOT0=NO" \
+		SIGNING_KEY=../../root-ec-p256.pem \
+		all
 
 # Test a good image, with a wrong-signature upgrade, using RSA signatures.
 # flash_boot: Unable to find bootable image
 # flash_hello1: hello1 runs
 # flash_hello2: hello1 runs
 # reset: hello1 runs
-test-wrong-rsa:
+test-wrong-rsa: clean
 	$(MAKE) \
-	    BOOTLOADER_CONFIG="CONF_SIGNATURE_TYPE=RSA" \
-	    clean
+		BOOTLOADER_CONFIG="-DCONF_SIGNATURE_TYPE=RSA" \
+		boot hello1
 	$(MAKE) \
-	    BOOTLOADER_CONFIG="CONF_SIGNATURE_TYPE=RSA" \
-	    boot hello1
-	$(MAKE) \
-	    BOOTLOADER_CONFIG="CONF_SIGNATURE_TYPE=RSA" \
-	    SIGNING_KEY=bad-keys/bad-rsa-2048.pem \
-	    hello2
+		BOOTLOADER_CONFIG="-DCONF_SIGNATURE_TYPE=RSA" \
+		SIGNING_KEY=bad-keys/bad-rsa-2048.pem \
+		hello2
 
 # Test a good image, with a wrong-signature upgrade, using ECDSA signatures.
 # flash_boot: Unable to find bootable image
 # flash_hello1: hello1 runs
 # flash_hello2: hello1 runs
 # reset: hello1 runs
-test-wrong-ecdsa:
+test-wrong-ecdsa: clean
 	$(MAKE) \
-	    BOOTLOADER_CONFIG="CONF_SIGNATURE_TYPE=ECDSA_P256" \
-	    clean
+		BOOTLOADER_CONFIG="-DCONF_SIGNATURE_TYPE=ECDSA_P256" \
+		SIGNING_KEY=../../root-ec-p256.pem \
+		boot hello1
 	$(MAKE) \
-	    BOOTLOADER_CONFIG="CONF_SIGNATURE_TYPE=ECDSA_P256" \
-	    SIGNING_KEY=../../root-ec-p256.pem \
-	    boot hello1
-	$(MAKE) \
-	    BOOTLOADER_CONFIG="CONF_SIGNATURE_TYPE=ECDSA_P256" \
-	    SIGNING_KEY=bad-keys/bad-ec-p256.pem \
-	    hello2
+		BOOTLOADER_CONFIG="-DCONF_SIGNATURE_TYPE=ECDSA_P256" \
+		SIGNING_KEY=bad-keys/bad-ec-p256.pem \
+		hello2
 
 check:
 	@if [ -z "$$ZEPHYR_BASE" ]; then echo "Zephyr environment not set up"; false; fi
diff --git a/samples/zephyr/build-boot.sh b/samples/zephyr/build-boot.sh
index 20e61a0..81691e7 100755
--- a/samples/zephyr/build-boot.sh
+++ b/samples/zephyr/build-boot.sh
@@ -19,4 +19,4 @@
     die "Please set BOARD to a valid board before running this script."
 fi
 
-make -C ../.. BOARD=${BOARD} -j$(nproc) || die "Build mcuboot"
+make BOARD=${BOARD} -j$(nproc) boot || die "Build mcuboot"
diff --git a/samples/zephyr/build-hello.sh b/samples/zephyr/build-hello.sh
index d8a3af4..6920f32 100755
--- a/samples/zephyr/build-hello.sh
+++ b/samples/zephyr/build-hello.sh
@@ -19,4 +19,4 @@
     die "Please set BOARD to a valid board before running this script."
 fi
 
-make -C hello1 BOARD=${BOARD} -j$(nproc) || die "Build hello1"
+make BOARD=${BOARD} -j$(nproc) hello1 || die "Build hello1"
diff --git a/samples/zephyr/hello-world/CMakeLists.txt b/samples/zephyr/hello-world/CMakeLists.txt
new file mode 100644
index 0000000..d4ef940
--- /dev/null
+++ b/samples/zephyr/hello-world/CMakeLists.txt
@@ -0,0 +1,52 @@
+# Top-level CMakeLists.txt for the skeleton application.
+#
+# Copyright (c) 2017 Open Source Foundries Limited
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# This provides a basic application structure suitable for loading by
+# mcuboot, which is easy to customize on a per-board basis. It can be
+# used as a starting point for new applications.
+
+# The board should be set to a supported target. The default is
+# frdm_k64f.
+if (NOT DEFINED BOARD)
+  set(BOARD frdm_k64f)
+endif()
+
+# The default top-level application configuration is prj.conf.
+# You can place additional board-specific files in boards/${BOARD}.conf,
+# and they will be merged into the configuration along with prj.conf.
+macro(set_conf_file)
+  if(EXISTS ${APPLICATION_SOURCE_DIR}/boards/${BOARD}.conf)
+    set(CONF_FILE "prj.conf ${APPLICATION_SOURCE_DIR}/boards/${BOARD}.conf")
+  else()
+    set(CONF_FILE "prj.conf")
+  endif()
+endmacro()
+
+# Zephyr uses Device Tree (DT) to describe some board hardware
+# configuration.
+#
+# For this simple example, all we need to tell DT is where on the chip
+# flash to link this application image so mcuboot can find it. We do
+# this with a device tree overlay file.
+#
+# See the Zephyr documentation for more information on DT:
+# https://www.zephyrproject.org/doc/dts/device_tree.html
+set(DTC_OVERLAY_FILE "${CMAKE_CURRENT_SOURCE_DIR}/dts.overlay")
+
+# Standard Zephyr application boilerplate.
+include($ENV{ZEPHYR_BASE}/cmake/app/boilerplate.cmake NO_POLICY_SCOPE)
+project(NONE)
+
+assert_exists(DTC_OVERLAY_FILE)
+
+# This string ends up getting printed in the device console
+if (NOT DEFINED FROM_WHO)
+  set(FROM_WHO Zephyr)
+endif()
+
+target_compile_definitions(app PRIVATE "-DMCUBOOT_HELLO_WORLD_FROM=\"${FROM_WHO}\"")
+
+target_sources(app PRIVATE src/main.c)
diff --git a/samples/zephyr/hello-world/Makefile b/samples/zephyr/hello-world/Makefile
deleted file mode 100644
index 15176e0..0000000
--- a/samples/zephyr/hello-world/Makefile
+++ /dev/null
@@ -1,46 +0,0 @@
-# Top-level Makefile for the skeleton application.
-#
-# This provides a basic application structure suitable for loading by
-# mcuboot, which is easy to customize on a per-board basis. It can be
-# used as a starting point for new applications.
-
-# The default board is FRDM-K64F. This can be overridden at
-# the command line for other boards supported by Zephyr.
-BOARD ?= frdm_k64f
-# The top-level application configuration is prj.conf. This can also
-# be overridden at the command line if you add another one.
-CONF_FILE ?= prj.conf
-
-# This will merge any board-specific extras from boards/$(BOARD).conf
-# into the configuration.
-CONF_FILE += $(wildcard boards/$(BOARD).conf)
-# These additional "local" files, if present, will be merged in as
-# well, but they are ignored by Git.
-CONF_FILE += $(wildcard local.conf) $(wildcard boards/$(BOARD)-local.conf)
-
-# Zephyr uses Device Tree (DT) to describe some board hardware
-# configuration.
-#
-# For this simple example, all we need to tell DT is where on the chip
-# flash to link this application image so mcuboot can find it. We do
-# this with a device tree overlay file.
-#
-# See the Zephyr documentation for more information on DT:
-# https://www.zephyrproject.org/doc/dts/device_tree.html
-DTC_OVERLAY_FILE := $(CURDIR)/dts.overlay
-export DTC_OVERLAY_FILE
-# If you want to do your DT overlay on a per-board basis (say, if you
-# need to support multiple different boards, each of which needs
-# slightly different DT overlays), then comment the above lines and
-# uncomment the following ones. You can then add board-specific
-# overlay files named boards/$(BOARD).overlay.
-#
-# DTC_OVERLAY_DIR := $(CURDIR)/boards
-# export DTC_OVERLAY_DIR
-
-# This string ends up getting printed in the device console
-FROM_WHO ?= "Zephyr"
-CFLAGS += -DMCUBOOT_HELLO_WORLD_FROM=\"$(FROM_WHO)\"
-
-# The Zephyr Makefiles do the rest.
-include $(ZEPHYR_BASE)/Makefile.inc
diff --git a/samples/zephyr/hello-world/boards/README.rst b/samples/zephyr/hello-world/boards/README.rst
index 1715f42..efa236d 100644
--- a/samples/zephyr/hello-world/boards/README.rst
+++ b/samples/zephyr/hello-world/boards/README.rst
@@ -1,2 +1,2 @@
 You can place per-board configuration and device tree overlays
-here. See the comments in the Makefile for more information.
+here. See the comments in the CMakeLists.txt for more information.
diff --git a/samples/zephyr/hello-world/prj.conf b/samples/zephyr/hello-world/prj.conf
index 193c611..f9137cd 100644
--- a/samples/zephyr/hello-world/prj.conf
+++ b/samples/zephyr/hello-world/prj.conf
@@ -2,6 +2,10 @@
 CONFIG_BOOT_BANNER=y
 CONFIG_BUILD_TIMESTAMP=y
 
+# Enable console and printk()
+CONFIG_PRINTK=y
+CONFIG_STDOUT_CONSOLE=y
+
 # TEXT_SECTION_OFFSET is used to leave space in the binary for the
 # mcuboot header.
 #