diff --git a/cmake/blob_path.cmake b/cmake/blob_path.cmake
index 4905974..e702476 100644
--- a/cmake/blob_path.cmake
+++ b/cmake/blob_path.cmake
@@ -7,20 +7,21 @@
 # Note all blobs and data will be made relative.
 # if absoulte is needed declare BLOB_PATH on CLI
 # or export BLOB_PATH=<path>
+# RO_BLOB_PATH=<path> is for data which does not need write access
 
 if(TARGET_OS MATCHES linux)
   
   client_sdk_compile_definitions(
-    -DSERIAL_FILE=\"${BLOB_PATH}/data/manufacturer_sn.bin\"
-    -DMODEL_FILE=\"${BLOB_PATH}/data/manufacturer_mod.bin\"
+    -DSERIAL_FILE=\"${RO_BLOB_PATH}/data/manufacturer_sn.bin\"
+    -DMODEL_FILE=\"${RO_BLOB_PATH}/data/manufacturer_mod.bin\"
     -DPLATFORM_IV=\"${BLOB_PATH}/data/platform_iv.bin\"
     -DPLATFORM_HMAC_KEY=\"${BLOB_PATH}/data/platform_hmac_key.bin\"
     -DPLATFORM_AES_KEY=\"${BLOB_PATH}/data/platform_aes_key.bin\"
-    -DEPID_PRIVKEY=\"${BLOB_PATH}/data/epidprivkey.dat\"
+    -DEPID_PRIVKEY=\"${RO_BLOB_PATH}/data/epidprivkey.dat\"
     -DSDO_CRED=\"${BLOB_PATH}/data/PMDeviceCredentials.bin\"
-    -DMANUFACTURER_IP=\"${BLOB_PATH}/data/manufacturer_ip.bin\"
-    -DMANUFACTURER_DN=\"${BLOB_PATH}/data/manufacturer_dn.bin\"
-    -DMANUFACTURER_PORT=\"${BLOB_PATH}/data/manufacturer_port.bin\"
+    -DMANUFACTURER_IP=\"${RO_BLOB_PATH}/data/manufacturer_ip.bin\"
+    -DMANUFACTURER_DN=\"${RO_BLOB_PATH}/data/manufacturer_dn.bin\"
+    -DMANUFACTURER_PORT=\"${RO_BLOB_PATH}/data/manufacturer_port.bin\"
     )
   if (${DA} MATCHES tpm)
     client_sdk_compile_definitions(
@@ -54,24 +55,24 @@ if(TARGET_OS MATCHES linux)
         -DSDO_CRED_SECURE=\"${BLOB_PATH}/data/Secure.blob\"
         -DSDO_CRED_MFG=\"${BLOB_PATH}/data/Mfg.blob\"
         -DSDO_CRED_NORMAL=\"${BLOB_PATH}/data/Normal.blob\"
-        -DRAW_BLOB=\"${BLOB_PATH}/data/raw.blob\"
+        -DRAW_BLOB=\"${RO_BLOB_PATH}/data/raw.blob\"
         )
     else() 				#Not unit tests
       if (${DA} MATCHES ecdsa256)	#ecdsa 256 selected
 	if (${DA_FILE} MATCHES pem)
 	  client_sdk_compile_definitions(
-	    -DECDSA_PRIVKEY=\"${BLOB_PATH}/data/ecdsa256privkey.pem\")
+	    -DECDSA_PRIVKEY=\"${RO_BLOB_PATH}/data/ecdsa256privkey.pem\")
 	else()
 	  client_sdk_compile_definitions(
-	    -DECDSA_PRIVKEY=\"${BLOB_PATH}/data/ecdsa256privkey.dat\")
+	    -DECDSA_PRIVKEY=\"${RO_BLOB_PATH}/data/ecdsa256privkey.dat\")
 	endif()
       else() 				# ecdsa 384 selected
 	if (${DA_FILE} MATCHES pem)
 	  client_sdk_compile_definitions(
-	    -DECDSA_PRIVKEY=\"${BLOB_PATH}/data/ecdsa384privkey.pem\")
+	    -DECDSA_PRIVKEY=\"${RO_BLOB_PATH}/data/ecdsa384privkey.pem\")
 	else()
 	  client_sdk_compile_definitions(
-	    -DECDSA_PRIVKEY=\"${BLOB_PATH}/data/ecdsa384privkey.dat\")
+	    -DECDSA_PRIVKEY=\"${RO_BLOB_PATH}/data/ecdsa384privkey.dat\")
 	endif()
       endif()
       client_sdk_compile_definitions(
@@ -81,30 +82,30 @@ if(TARGET_OS MATCHES linux)
 	-DSDO_CRED_SECURE=\"${BLOB_PATH}/data/Secure.blob\"
 	-DSDO_CRED_MFG=\"${BLOB_PATH}/data/Mfg.blob\"
 	-DSDO_CRED_NORMAL=\"${BLOB_PATH}/data/Normal.blob\"
-	-DRAW_BLOB=\"${BLOB_PATH}/data/raw.blob\"
+	-DRAW_BLOB=\"${RO_BLOB_PATH}/data/raw.blob\"
 	)
     endif()
     if (NOT(${HTTPPROXY} STREQUAL ""))
       client_sdk_compile_definitions(
-	-DMFG_PROXY=\"${BLOB_PATH}/data/mfg_proxy.dat\"
-	-DRV_PROXY=\"${BLOB_PATH}/data/rv_proxy.dat\"
-	-DOWNER_PROXY=\"${BLOB_PATH}/data/owner_proxy.dat\"
+	-DMFG_PROXY=\"${RO_BLOB_PATH}/data/mfg_proxy.dat\"
+	-DRV_PROXY=\"${RO_BLOB_PATH}/data/rv_proxy.dat\"
+	-DOWNER_PROXY=\"${RO_BLOB_PATH}/data/owner_proxy.dat\"
 	)
     endif()
   endif()
 
   if (${TARGET_OS} MATCHES mbedos)
     client_sdk_compile_definitions(
-      -DSERIAL_FILE=\"${BLOB_PATH}/data/manufacturer_sn.bin\"
-      -DMODEL_FILE=\"${BLOB_PATH}/data/manufacturer_mod.bin\"
+      -DSERIAL_FILE=\"${RO_BLOB_PATH}/data/manufacturer_sn.bin\"
+      -DMODEL_FILE=\"${RO_BLOB_PATH}/data/manufacturer_mod.bin\"
       -DPLATFORM_IV=\"${BLOB_PATH}/data/platform_iv.bin\"
       -DPLATFORM_HMAC_KEY=\"${BLOB_PATH}/data/platform_hmac_key.bin\"
       -DPLATFORM_AES_KEY=\"${BLOB_PATH}/data/platform_aes_key.bin\"
-      -DEPID_PRIVKEY=\"${BLOB_PATH}/data/epidprivkey.dat\"
+      -DEPID_PRIVKEY=\"${RO_BLOB_PATH}/data/epidprivkey.dat\"
       -DSDO_CRED=\"${BLOB_PATH}/data/PMDeviceCredentials.bin\"
-      -DMANUFACTURER_IP=\"${BLOB_PATH}/data/manufacturer_ip.bin\"
-      -DMANUFACTURER_DN=\"${BLOB_PATH}/data/manufacturer_dn.bin\"
-      -DMANUFACTURER_PORT=\"${BLOB_PATH}/data/manufacturer_port.bin\"
+      -DMANUFACTURER_IP=\"${RO_BLOB_PATH}/data/manufacturer_ip.bin\"
+      -DMANUFACTURER_DN=\"${RO_BLOB_PATH}/data/manufacturer_dn.bin\"
+      -DMANUFACTURER_PORT=\"${RO_BLOB_PATH}/data/manufacturer_port.bin\"
       )
     if (${unit-test} MATCHES true)
       client_sdk_compile_definitions(
@@ -114,7 +115,7 @@ if(TARGET_OS MATCHES linux)
 	-DSDO_CRED_SECURE=\"${BLOB_PATH}/data/Secure.blob\"
 	-DSDO_CRED_MFG=\"${BLOB_PATH}/data/Mfg.blob\"
 	-DSDO_CRED_NORMAL=\"${BLOB_PATH}/data/Normal.blob\"
-	-DRAW_BLOB=\"${BLOB_PATH}/data/raw.blob\"
+	-DRAW_BLOB=\"${RO_BLOB_PATH}/data/raw.blob\"
 	)
       if (${DA_FILE} MATCHES pem)
 	client_sdk_compile_definitions(
@@ -132,32 +133,32 @@ if(TARGET_OS MATCHES linux)
 	-DSDO_CRED_SECURE=\"${BLOB_PATH}/data/Secure.blob\"
 	-DSDO_CRED_MFG=\"${BLOB_PATH}/data/Mfg.blob\"
 	-DSDO_CRED_NORMAL=\"${BLOB_PATH}/data/Normal.blob\"
-	-DRAW_BLOB=\"${BLOB_PATH}/data/raw.blob\")
+	-DRAW_BLOB=\"${RO_BLOB_PATH}/data/raw.blob\")
 
       if (${DA} MATCHES ecdsa256)
 	if (${DA_FILE} MATCHES pem)
 	  client_sdk_compile_definitions(
-	    -DECDSA_PRIVKEY=\"${BLOB_PATH}/data/ecdsa256privkey.pem\")
+	    -DECDSA_PRIVKEY=\"${RO_BLOB_PATH}/data/ecdsa256privkey.pem\")
 	else()
 	  client_sdk_compile_definitions(
-	    -DECDSA_PRIVKEY=\"${BLOB_PATH}/data/ecdsa256privkey.dat\")
+	    -DECDSA_PRIVKEY=\"${RO_BLOB_PATH}/data/ecdsa256privkey.dat\")
 	endif()
       else()
 	if (${DA_FILE} MATCHES pem)
 	  client_sdk_compile_definitions(
-	    -DECDSA_PRIVKEY=\"${BLOB_PATH}/data/ecdsa256privkey.pem\")
+	    -DECDSA_PRIVKEY=\"${RO_BLOB_PATH}/data/ecdsa256privkey.pem\")
 	else()
 	  client_sdk_compile_definitions(
-	    -DECDSA_PRIVKEY=\"${BLOB_PATH}/data/ecdsa384privkey.dat\")
+	    -DECDSA_PRIVKEY=\"${RO_BLOB_PATH}/data/ecdsa384privkey.dat\")
 	endif()
 	
       endif()
     endif()
     if (NOT(${HTTPPROXY} STREQUAL ""))
 	client_sdk_compile_definitions(
-          -DMFG_PROXY=\"${BLOB_PATH}/data/mfg_proxy.dat\"
-          -DRV_PROXY=\"${BLOB_PATH}/data/rv_proxy.dat\"
-          -DOWNER_PROXY=\"${BLOB_PATH}/data/owner_proxy.dat\"
+          -DMFG_PROXY=\"${RO_BLOB_PATH}/data/mfg_proxy.dat\"
+          -DRV_PROXY=\"${RO_BLOB_PATH}/data/rv_proxy.dat\"
+          -DOWNER_PROXY=\"${RO_BLOB_PATH}/data/owner_proxy.dat\"
 	  )
     endif()
   endif()
@@ -168,11 +169,11 @@ if(TARGET_OS MATCHES linux)
 # Configure if needed at a later point
 # configure_file(${BLOB_PATH}/data/Normal.blob NEWLINE_STYLE DOS)
 
-file(WRITE ${BLOB_PATH}/data/platform_iv.bin "")
-file(WRITE ${BLOB_PATH}/data/platform_hmac_key.bin "")
-file(WRITE ${BLOB_PATH}/data/platform_aes_key.bin "")
-file(WRITE ${BLOB_PATH}/data/Mfg.blob "")
-file(WRITE ${BLOB_PATH}/data/Normal.blob "{\"ST\":1}")
-file(WRITE ${BLOB_PATH}/data/Secure.blob "")
-file(WRITE ${BLOB_PATH}/data/raw.blob "")
+file(WRITE ./data/platform_iv.bin "")
+file(WRITE ./data/platform_hmac_key.bin "")
+file(WRITE ./data/platform_aes_key.bin "")
+file(WRITE ./data/Mfg.blob "")
+file(WRITE ./data/Normal.blob "{\"ST\":1}")
+file(WRITE ./data/Secure.blob "")
+file(WRITE ./data/raw.blob "")
 
diff --git a/cmake/cli_input.cmake b/cmake/cli_input.cmake
index bc195f7..dee08ef 100644
--- a/cmake/cli_input.cmake
+++ b/cmake/cli_input.cmake
@@ -29,6 +29,7 @@ set (MANUFACTURER_TOOLKIT true)
 set (STORAGE true)
 set (BOARD NUCLEO_F767ZI)
 set (BLOB_PATH .)
+set (RO_BLOB_PATH .)
 set (TPM2_TCTI_TYPE tabrmd)
 set (RESALE false)
 set (REUSE true)
@@ -617,6 +618,36 @@ endif()
 set(CACHED_BLOB_PATH ${BLOB_PATH} CACHE STRING "Selected BLOB_PATH")
 message("Selected BLOB_PATH ${BLOB_PATH}")
 
+###########################################
+# FOR RO_BLOB_PATH
+get_property(cached_ro_blob_path_value CACHE RO_BLOB_PATH PROPERTY VALUE)
+
+set(ro_blob_path_cli_arg ${cached_ro_blob_path_value})
+if(ro_blob_path_cli_arg STREQUAL CACHED_RO_BLOB_PATH)
+  unset(ro_blob_path_cli_arg)
+endif()
+
+set(ro_blob_path_app_cmake_lists ${RO_BLOB_PATH})
+if(cached_ro_blob_path_value STREQUAL RO_BLOB_PATH)
+  unset(ro_blob_path_app_cmake_lists)
+endif()
+
+if(CACHED_RO_BLOB_PATH)
+  if ((ro_blob_path_cli_arg) AND (NOT(CACHED_RO_BLOB_PATH STREQUAL ro_blob_path_cli_arg)))
+    message(WARNING "Need to do make pristine before cmake args can change.")
+  endif()
+  set(RO_BLOB_PATH ${CACHED_RO_BLOB_PATH})
+elseif(ro_blob_path_cli_arg)
+  set(RO_BLOB_PATH ${ro_blob_path_cli_arg})
+elseif(DEFINED ENV{RO_BLOB_PATH})
+  set(RO_BLOB_PATH $ENV{RO_BLOB_PATH})
+elseif(ro_blob_path_app_cmake_lists)
+  set(RO_BLOB_PATH ${ro_blob_path_app_cmake_lists})
+endif()
+
+set(CACHED_RO_BLOB_PATH ${RO_BLOB_PATH} CACHE STRING "Selected RO_BLOB_PATH")
+message("Selected RO_BLOB_PATH ${RO_BLOB_PATH}")
+
 ###########################################
 # FOR WIFI_SSID
 get_property(cached_wifi_ssid_value CACHE WIFI_SSID PROPERTY VALUE)
