diff -Naurp a/sys-firmware/intel-microcode/intel-microcode-20171117_p20171215.ebuild b/sys-firmware/intel-microcode/intel-microcode-20171117_p20171215.ebuild
--- a/sys-firmware/intel-microcode/intel-microcode-20171117_p20171215.ebuild	2018-01-07 16:25:09.977255835 +0100
+++ b/sys-firmware/intel-microcode/intel-microcode-20171117_p20171215.ebuild	2018-01-07 16:25:09.984255835 +0100
@@ -18,22 +18,87 @@ SRC_URI="mirror://gentoo/microcode-${PV}
 LICENSE="intel-ucode"
 SLOT="0"
 KEYWORDS="-* amd64 x86"
-IUSE="initramfs +split-ucode"
+IUSE="initramfs scan-system +split-ucode"
 REQUIRED_USE="|| ( initramfs split-ucode )"
 
-DEPEND="initramfs? ( sys-apps/iucode_tool )"
+DEPEND="initramfs? ( sys-apps/iucode_tool )
+	scan-system? ( sys-apps/iucode_tool )"
 RDEPEND="!<sys-apps/microcode-ctl-1.17-r2" #268586
 
 S=${WORKDIR}
 
 src_compile() {
-	if use initramfs ; then
-		iucode_tool --write-earlyfw=microcode.cpio intel-ucode/ || die
+	if use initramfs; then
+		if use scan-system; then
+			iucode_tool --scan-system --write-earlyfw=initramfs.cpio intel-ucode/ || die "Failed to generate initramfs cpio archive"
+		else
+			iucode_tool --write-earlyfw=initramfs.cpio intel-ucode/ || die "Failed to generate initramfs cpio archive"
+		fi
 	fi
 }
 
 src_install() {
-	insinto /lib/firmware
-	use initramfs && doins microcode.cpio
-	use split-ucode && doins -r intel-ucode
+	insinto /lib/firmware/intel-ucode
+	if use initramfs; then
+		doins initramfs.cpio
+	fi
+	if use split-ucode; then
+		if use scan-system; then
+			local re_signature="^iucode_tool: system has processor\(s\) with signature (0x[0-9a-f]+)$"
+			local re_bundle="^microcode bundle ([0-9]+): (.*)$"
+			local re_suitable="^([0-9]+)/([0-9]+): sig (0x[0-9a-f]+), pf_mask (0x[0-9a-f]+), ([0-9]{4}-[0-9]{2}-[0-9]{2}), rev (0x[0-9a-f]+), size ([0-9]+)$"
+			local -A bundles=()
+			local -a suitable=()
+			local line index
+
+			# Identify suitable bundles
+			while read -r line; do
+				if [[ $line =~ $re_signature ]]; then
+					elog "Signature of detected processor(s): ${BASH_REMATCH[1]}"
+				elif [[ $line =~ $re_bundle ]]; then
+					bundles+=(["${BASH_REMATCH[1]}"]="${BASH_REMATCH[2]}")
+				elif [[ $line =~ $re_suitable ]]; then
+					index="${BASH_REMATCH[1]}"
+					index="${index#"${index%%[!0]*}"}" # strip leading zero(s) from bundle index
+					if [[ -n "${bundles[$index]+set}" ]]; then
+						elog "Suitable microcode bundle: ${index} (${bundles[$index]})"
+						suitable+=("$index")
+					else
+						ewarn "Ignoring invalid microcode bundle '${index}'"
+					fi
+				fi
+			done < <(iucode_tool --scan-system --list intel-ucode/* 2>&1) # signature is written to stderr
+			elog ""
+
+			# Suitable bundles identified?
+			if (( ${#suitable[@]} == 0 )); then
+				ewarn "Unable to identify suitable microcode bundle(s)"
+				ewarn "Please install without USE flag 'scan-system' instead"
+				die "Failed to identify suitable microcode bundle(s)"
+			fi
+
+			# Install identified bundles
+			insinto /lib/firmware/intel-ucode
+			for index in ${suitable[@]}; do
+				doins "${bundles[$index]}"
+			done
+		else
+			doins intel-ucode/*
+		fi
+	fi
+}
+
+pkg_postinst() {
+	if use initramfs; then
+		elog "CPIO archive was installed to '/lib/firmware/intel-ucode/initramfs.cpio'"
+		elog "This archive needs to be prepended to an existing initramfs image:"
+		elog "# cat /lib/firmware/intel-ucode/initramfs.cpio existing-image > combined-image"
+		elog ""
+	fi
+	if use split-ucode; then
+		elog "Split binary ucode files were installed to '/lib/firmware/intel-ucode'"
+		elog ""
+	fi
+	elog "Please refer to the Gentoo Wiki for more detailed information:"
+	elog "https://wiki.gentoo.org/wiki/Intel_microcode"
 }
diff -Naurp a/sys-firmware/intel-microcode/metadata.xml b/sys-firmware/intel-microcode/metadata.xml
--- a/sys-firmware/intel-microcode/metadata.xml	2018-01-07 16:25:09.980255835 +0100
+++ b/sys-firmware/intel-microcode/metadata.xml	2018-01-07 16:25:09.988255835 +0100
@@ -8,6 +8,7 @@
 <use>
 	<flag name="initramfs">install a small initramfs for use with CONFIG_MICROCODE_EARLY</flag>
 	<flag name="monolithic">install the large text microcode.dat (used by older kernels via microcode_ctl)</flag>
+	<flag name="scan-system">scan system and only install suitable/applicable microcode</flag>
 	<flag name="split-ucode">install the split binary ucode files (used by the kernel directly)</flag>
 </use>
 </pkgmetadata>