diff --git a/updater/install.cpp b/updater/install.cpp
index 005f9f9..74feb56 100644
--- a/updater/install.cpp
+++ b/updater/install.cpp
@@ -35,8 +35,10 @@
 #include <inttypes.h>
 
 #include <memory>
+#include <string>
 #include <vector>
 
+#include <android-base/file.h>
 #include <android-base/parseint.h>
 #include <android-base/strings.h>
 #include <android-base/stringprintf.h>
@@ -966,7 +968,6 @@
     return StringValue(strdup(value));
 }
 
-
 // file_getprop(file, key)
 //
 //   interprets 'file' as a getprop-style file (key=value pairs, one
@@ -1428,6 +1429,31 @@
     return v;
 }
 
+// write_value(value, filename)
+//   Writes 'value' to 'filename'.
+//   Example: write_value("960000", "/sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq")
+Value* WriteValueFn(const char* name, State* state, int argc, Expr* argv[]) {
+    if (argc != 2) {
+        return ErrorAbort(state, kArgsParsingFailure, "%s() expects 2 args, got %d", name, argc);
+    }
+
+    char* value;
+    char* filename;
+    if (ReadArgs(state, argv, 2, &value, &filename) < 0) {
+        return ErrorAbort(state, kArgsParsingFailure, "%s(): Failed to parse the argument(s)",
+                          name);
+    }
+
+    bool ret = android::base::WriteStringToFile(value, filename);
+    if (!ret) {
+        printf("%s: Failed to write to \"%s\": %s\n", name, filename, strerror(errno));
+    }
+
+    free(value);
+    free(filename);
+    return StringValue(strdup(ret ? "t" : ""));
+}
+
 // Immediately reboot the device.  Recovery is not finished normally,
 // so if you reboot into recovery it will re-start applying the
 // current package (because nothing has cleared the copy of the
@@ -1627,6 +1653,7 @@
     RegisterFunction("read_file", ReadFileFn);
     RegisterFunction("sha1_check", Sha1CheckFn);
     RegisterFunction("rename", RenameFn);
+    RegisterFunction("write_value", WriteValueFn);
 
     RegisterFunction("wipe_cache", WipeCacheFn);