In general, techniques are described by which provide a technique for securely updating sub-systems of a device. A device includes multiple sub-systems including a first sub-system and a second sub-system. Each sub-system includes one or more processors. One or more processors of the first sub-system may be configured to perform the techniques herein. The one or more processors of the first sub-system are configured to download, from one or more nodes of a network, a sub-system update for the second sub-system in response to detecting an update to a ledger of a blockchain associated with the second sub-system. The one or more processors of the first sub-system are further configured to distribute the sub-system update for the second sub-system to the second sub-system.