diff --git a/libfwupdplugin/fu-device-private.h b/libfwupdplugin/fu-device-private.h
index a8e20e577..717cf5c3d 100644
--- a/libfwupdplugin/fu-device-private.h
+++ b/libfwupdplugin/fu-device-private.h
@@ -37,3 +37,6 @@ gchar		*fu_device_get_guids_as_str		(FuDevice	*self);
 GPtrArray	*fu_device_get_possible_plugins		(FuDevice	*self);
 void		 fu_device_add_possible_plugin		(FuDevice	*self,
 							 const gchar	*plugin);
+guint64		 fu_device_get_private_flags		(FuDevice	*self);
+void		 fu_device_set_private_flags		(FuDevice	*self,
+							 guint64	 flag);
diff --git a/libfwupdplugin/fu-device.c b/libfwupdplugin/fu-device.c
index c01780ca1..21d7b3fe4 100644
--- a/libfwupdplugin/fu-device.c
+++ b/libfwupdplugin/fu-device.c
@@ -70,6 +70,8 @@ typedef struct {
 	GPtrArray			*retry_recs;	/* of FuDeviceRetryRecovery */
 	guint				 retry_delay;
 	FuDeviceInternalFlags		 internal_flags;
+	guint64				 private_flags;
+	GPtrArray			*private_flag_items;	/* (nullable) */
 } FuDevicePrivate;
 
 typedef struct {
@@ -313,6 +315,92 @@ fu_device_has_internal_flag (FuDevice *self, FuDeviceInternalFlags flag)
 	return (priv->internal_flags & flag) > 0;
 }
 
+/**
+ * fu_device_add_private_flag:
+ * @self: a #FuDevice
+ * @flag: a device flag
+ *
+ * Adds a private flag that can be used by the plugin for any purpose.
+ *
+ * Since: 1.6.2
+ **/
+void
+fu_device_add_private_flag (FuDevice *self, guint64 flag)
+{
+	FuDevicePrivate *priv = GET_PRIVATE (self);
+	g_return_if_fail (FU_IS_DEVICE (self));
+	priv->private_flags |= flag;
+}
+
+/**
+ * fu_device_remove_private_flag:
+ * @self: a #FuDevice
+ * @flag: a device flag
+ *
+ * Removes a private flag that can be used by the plugin for any purpose.
+ *
+ * Since: 1.6.2
+ **/
+void
+fu_device_remove_private_flag (FuDevice *self, guint64 flag)
+{
+	FuDevicePrivate *priv = GET_PRIVATE (self);
+	g_return_if_fail (FU_IS_DEVICE (self));
+	priv->private_flags &= ~flag;
+}
+
+/**
+ * fu_device_has_private_flag:
+ * @self: a #FuDevice
+ * @flag: a device flag
+ *
+ * Tests for a private flag that can be used by the plugin for any purpose.
+ *
+ * Since: 1.6.2
+ **/
+gboolean
+fu_device_has_private_flag (FuDevice *self, guint64 flag)
+{
+	FuDevicePrivate *priv = GET_PRIVATE (self);
+	g_return_val_if_fail (FU_IS_DEVICE (self), FALSE);
+	return (priv->private_flags & flag) > 0;
+}
+
+/**
+ * fu_device_get_private_flags:
+ * @self: a #FuDevice
+ *
+ * Returns all the private flags that can be used by the plugin for any purpose.
+ *
+ * Returns: flags
+ *
+ * Since: 1.6.2
+ **/
+guint64
+fu_device_get_private_flags (FuDevice *self)
+{
+	FuDevicePrivate *priv = GET_PRIVATE (self);
+	g_return_val_if_fail (FU_IS_DEVICE (self), G_MAXUINT64);
+	return priv->private_flags;
+}
+
+/**
+ * fu_device_set_private_flags:
+ * @self: a #FuDevice
+ * @flag: flags
+ *
+ * Sets private flags that can be used by the plugin for any purpose.
+ *
+ * Since: 1.6.2
+ **/
+void
+fu_device_set_private_flags (FuDevice *self, guint64 flag)
+{
+	FuDevicePrivate *priv = GET_PRIVATE (self);
+	g_return_if_fail (FU_IS_DEVICE (self));
+	priv->private_flags = flag;
+}
+
 /**
  * fu_device_get_possible_plugins:
  * @self: a #FuDevice
@@ -2568,30 +2656,124 @@ fu_device_add_flag (FuDevice *self, FwupdDeviceFlags flag)
 		fu_device_inhibit (self, "needs-activation", "Pending activation");
 }
 
+typedef struct {
+	guint64		 value;
+	gchar		*value_str;
+} FuDevicePrivateFlagItem;
+
+static void
+fu_device_private_flag_item_free (FuDevicePrivateFlagItem *item)
+{
+	g_free (item->value_str);
+	g_free (item);
+}
+
+static FuDevicePrivateFlagItem *
+fu_device_private_flag_item_find_by_str (FuDevice *self, const gchar *value_str)
+{
+	FuDevicePrivate *priv = GET_PRIVATE (self);
+	if (priv->private_flag_items == NULL)
+		return NULL;
+	for (guint i = 0; i < priv->private_flag_items->len; i++) {
+		FuDevicePrivateFlagItem *item = g_ptr_array_index (priv->private_flag_items, i);
+		if (g_strcmp0 (item->value_str, value_str) == 0)
+			return item;
+	}
+	return NULL;
+}
+
+static FuDevicePrivateFlagItem *
+fu_device_private_flag_item_find_by_val (FuDevice *self, guint64 value)
+{
+	FuDevicePrivate *priv = GET_PRIVATE (self);
+	if (priv->private_flag_items == NULL)
+		return NULL;
+	for (guint i = 0; i < priv->private_flag_items->len; i++) {
+		FuDevicePrivateFlagItem *item = g_ptr_array_index (priv->private_flag_items, i);
+		if (item->value == value)
+			return item;
+	}
+	return NULL;
+}
+
+/**
+ * fu_device_register_private_flag:
+ * @self: a #FuDevice
+ * @value: an integer value
+ * @value_str: a string that represents @value
+ *
+ * Registers a private device flag so that it can be set from quirk files.
+ *
+ * Since: 1.6.2
+ **/
+void
+fu_device_register_private_flag (FuDevice *self,
+				 guint64 value,
+				 const gchar *value_str)
+{
+	FuDevicePrivateFlagItem *item;
+	FuDevicePrivate *priv = GET_PRIVATE (self);
+
+	g_return_if_fail (FU_IS_DEVICE (self));
+	g_return_if_fail (value != 0);
+	g_return_if_fail (value_str != NULL);
+
+	/* ensure exists */
+	if (priv->private_flag_items == NULL)
+		priv->private_flag_items = g_ptr_array_new_with_free_func ((GDestroyNotify) fu_device_private_flag_item_free);
+
+	item = g_new0 (FuDevicePrivateFlagItem, 1);
+	item->value = value;
+	item->value_str = g_strdup (value_str);
+	g_ptr_array_add (priv->private_flag_items, item);
+}
+
 static void
 fu_device_set_custom_flag (FuDevice *self, const gchar *hint)
 {
 	FwupdDeviceFlags flag;
+	FuDevicePrivateFlagItem *item;
 	FuDeviceInternalFlags internal_flag;
+	FuDevicePrivate *priv = GET_PRIVATE (self);
 
 	/* is this a negated device flag */
 	if (g_str_has_prefix (hint, "~")) {
 		flag = fwupd_device_flag_from_string (hint + 1);
-		if (flag != FWUPD_DEVICE_FLAG_UNKNOWN)
+		if (flag != FWUPD_DEVICE_FLAG_UNKNOWN) {
 			fu_device_remove_flag (self, flag);
+			return;
+		}
 		internal_flag = fu_device_internal_flag_from_string (hint + 1);
-		if (internal_flag != FU_DEVICE_INTERNAL_FLAG_UNKNOWN)
+		if (internal_flag != FU_DEVICE_INTERNAL_FLAG_UNKNOWN) {
 			fu_device_remove_internal_flag (self, internal_flag);
+			return;
+		}
+		item = fu_device_private_flag_item_find_by_str (self, hint + 1);
+		if (item != NULL) {
+			priv->private_flags &= ~item->value;
+			return;
+		}
+		g_debug ("failed to find registered custom flag %s", hint + 1);
 		return;
 	}
 
 	/* is this a known device flag */
 	flag = fwupd_device_flag_from_string (hint);
-	if (flag != FWUPD_DEVICE_FLAG_UNKNOWN)
+	if (flag != FWUPD_DEVICE_FLAG_UNKNOWN) {
 		fu_device_add_flag (self, flag);
+		return;
+	}
 	internal_flag = fu_device_internal_flag_from_string (hint);
-	if (internal_flag != FU_DEVICE_INTERNAL_FLAG_UNKNOWN)
+	if (internal_flag != FU_DEVICE_INTERNAL_FLAG_UNKNOWN) {
 		fu_device_add_internal_flag (self, internal_flag);
+		return;
+	}
+	item = fu_device_private_flag_item_find_by_str (self, hint);
+	if (item != NULL) {
+		priv->private_flags |= item->value;
+		return;
+	}
+	g_debug ("failed to find registered custom flag %s", hint);
 }
 
 /**
@@ -3009,6 +3191,22 @@ fu_device_add_string (FuDevice *self, guint idt, GString *str)
 			g_string_truncate (tmp2, tmp2->len - 1);
 		fu_common_string_append_kv (str, idt + 1, "InternalFlags", tmp2->str);
 	}
+	if (priv->private_flags > 0) {
+		g_autoptr(GPtrArray) tmpv = g_ptr_array_new ();
+		g_autofree gchar *tmps = NULL;
+		for (guint64 i = 0; i < 64; i++) {
+			FuDevicePrivateFlagItem *item;
+			guint64 value = 1ull << i;
+			if ((priv->private_flags & value) == 0)
+				continue;
+			item = fu_device_private_flag_item_find_by_val (self, value);
+			if (item == NULL)
+				continue;
+			g_ptr_array_add (tmpv, item->value_str);
+		}
+		tmps = fu_common_strjoin_array (",", tmpv);
+		fu_common_string_append_kv (str, idt + 1, "PrivateFlags", tmps);
+	}
 
 	/* subclassed */
 	if (klass->to_string != NULL)
@@ -4166,6 +4364,8 @@ fu_device_finalize (GObject *object)
 		g_hash_table_unref (priv->inhibits);
 	if (priv->parent_physical_ids != NULL)
 		g_ptr_array_unref (priv->parent_physical_ids);
+	if (priv->private_flag_items != NULL)
+		g_ptr_array_unref (priv->private_flag_items);
 	g_ptr_array_unref (priv->parent_guids);
 	g_ptr_array_unref (priv->possible_plugins);
 	g_ptr_array_unref (priv->retry_recs);
diff --git a/libfwupdplugin/fu-device.h b/libfwupdplugin/fu-device.h
index 6e491cdb6..186b286fa 100644
--- a/libfwupdplugin/fu-device.h
+++ b/libfwupdplugin/fu-device.h
@@ -339,7 +339,8 @@ void		 fu_device_remove_flag			(FuDevice	*self,
 							 FwupdDeviceFlags flag);
 const gchar	*fu_device_get_custom_flags		(FuDevice	*self);
 gboolean	 fu_device_has_custom_flag		(FuDevice	*self,
-							 const gchar	*hint);
+							 const gchar	*hint)
+							 G_DEPRECATED_FOR(fu_device_has_private_flag);
 void		 fu_device_set_custom_flags		(FuDevice	*self,
 							 const gchar	*custom_flags);
 void		 fu_device_set_name			(FuDevice	*self,
@@ -476,3 +477,12 @@ GHashTable	*fu_device_report_metadata_pre		(FuDevice	*self);
 GHashTable	*fu_device_report_metadata_post		(FuDevice	*self);
 void		 fu_device_add_security_attrs		(FuDevice	*self,
 							 FuSecurityAttrs *attrs);
+void		 fu_device_register_private_flag	(FuDevice	*self,
+							 guint64	 value,
+							 const gchar	*value_str);
+void		 fu_device_add_private_flag		(FuDevice	*self,
+							 guint64	 flag);
+void		 fu_device_remove_private_flag		(FuDevice	*self,
+							 guint64	 flag);
+gboolean	 fu_device_has_private_flag		(FuDevice	*self,
+							 guint64	 flag);
diff --git a/libfwupdplugin/fu-self-test.c b/libfwupdplugin/fu-self-test.c
index 9cf58e24b..91b2f6ff2 100644
--- a/libfwupdplugin/fu-self-test.c
+++ b/libfwupdplugin/fu-self-test.c
@@ -1390,6 +1390,39 @@ fu_device_inhibit_func (void)
 	g_assert_false (fu_device_has_flag (device, FWUPD_DEVICE_FLAG_UPDATABLE_HIDDEN));
 }
 
+#define TEST_FLAG_FOO	(1 << 0)
+#define TEST_FLAG_BAR	(1 << 1)
+#define TEST_FLAG_BAZ	(1 << 2)
+
+static void
+fu_device_private_flags_func (void)
+{
+	g_autofree gchar *tmp = NULL;
+	g_autoptr(FuDevice) device = fu_device_new ();
+
+	fu_device_register_private_flag (device, TEST_FLAG_FOO, "foo");
+	fu_device_register_private_flag (device, TEST_FLAG_BAR, "bar");
+
+	fu_device_set_custom_flags (device, "foo");
+	g_assert_cmpint (fu_device_get_private_flags (device), ==, TEST_FLAG_FOO);
+	fu_device_set_custom_flags (device, "bar");
+	g_assert_cmpint (fu_device_get_private_flags (device), ==, TEST_FLAG_FOO | TEST_FLAG_BAR);
+	fu_device_set_custom_flags (device, "~bar");
+	g_assert_cmpint (fu_device_get_private_flags (device), ==, TEST_FLAG_FOO);
+	fu_device_set_custom_flags (device, "baz");
+	g_assert_cmpint (fu_device_get_private_flags (device), ==, TEST_FLAG_FOO);
+	fu_device_add_private_flag (device, TEST_FLAG_BAZ);
+	g_assert_cmpint (fu_device_get_private_flags (device), ==, TEST_FLAG_FOO | TEST_FLAG_BAZ);
+
+	tmp = fu_device_to_string (device);
+	g_assert_cmpstr (tmp, ==,
+		"FuDevice:\n"
+		"Unknown Device\n"
+		"  Flags:                none\n"
+		"  CustomFlags:          baz\n" /* compat */
+		"  PrivateFlags:         foo\n");
+}
+
 static void
 fu_device_flags_func (void)
 {
@@ -2942,6 +2975,7 @@ main (int argc, char **argv)
 	g_test_add_func ("/fwupd/device{instance-ids}", fu_device_instance_ids_func);
 	g_test_add_func ("/fwupd/device{composite-id}", fu_device_composite_id_func);
 	g_test_add_func ("/fwupd/device{flags}", fu_device_flags_func);
+	g_test_add_func ("/fwupd/device{custom-flags}", fu_device_private_flags_func);
 	g_test_add_func ("/fwupd/device{inhibit}", fu_device_inhibit_func);
 	g_test_add_func ("/fwupd/device{parent}", fu_device_parent_func);
 	g_test_add_func ("/fwupd/device{children}", fu_device_children_func);
diff --git a/libfwupdplugin/fwupdplugin.map b/libfwupdplugin/fwupdplugin.map
index 6104e0c96..ee8289d8c 100644
--- a/libfwupdplugin/fwupdplugin.map
+++ b/libfwupdplugin/fwupdplugin.map
@@ -820,7 +820,13 @@ LIBFWUPDPLUGIN_1.6.2 {
   global:
     fu_common_check_kernel_version;
     fu_device_add_parent_physical_id;
+    fu_device_add_private_flag;
     fu_device_get_parent_physical_ids;
+    fu_device_get_private_flags;
     fu_device_has_parent_physical_id;
+    fu_device_has_private_flag;
+    fu_device_register_private_flag;
+    fu_device_remove_private_flag;
+    fu_device_set_private_flags;
   local: *;
 } LIBFWUPDPLUGIN_1.6.1;
diff --git a/plugins/ccgx/fu-ccgx-dmc-device.c b/plugins/ccgx/fu-ccgx-dmc-device.c
index 2a6cb60d7..ce7802d86 100644
--- a/plugins/ccgx/fu-ccgx-dmc-device.c
+++ b/plugins/ccgx/fu-ccgx-dmc-device.c
@@ -26,6 +26,14 @@ struct _FuCcgxDmcDevice {
 	DmcUpdateModel		update_model;
 };
 
+
+/**
+ * FU_CCGX_DMC_DEVICE_FLAG_HAS_MANUAL_REPLUG:
+ *
+ * Needs a manual replug from the end-user.
+ */
+#define FU_CCGX_DMC_DEVICE_FLAG_HAS_MANUAL_REPLUG		(1 << 0)
+
 G_DEFINE_TYPE (FuCcgxDmcDevice, fu_ccgx_dmc_device, FU_TYPE_USB_DEVICE)
 
 static gboolean
@@ -541,10 +549,9 @@ static gboolean
 fu_ccgx_dmc_device_attach (FuDevice *device, GError **error)
 {
 	FuCcgxDmcDevice *self = FU_CCGX_DMC_DEVICE (device);
-	gboolean manual_replug = FALSE;
+	gboolean manual_replug;
 
-	if (fu_device_has_custom_flag (device, "has-manual-replug"))
-		manual_replug = TRUE;
+	manual_replug = fu_device_has_private_flag (device, FU_CCGX_DMC_DEVICE_FLAG_HAS_MANUAL_REPLUG);
 
 	if (fu_device_get_update_state (self) != FWUPD_UPDATE_STATE_SUCCESS)
 		return TRUE;
@@ -657,6 +664,9 @@ fu_ccgx_dmc_device_init (FuCcgxDmcDevice *self)
 	fu_device_add_flag (FU_DEVICE (self), FWUPD_DEVICE_FLAG_DUAL_IMAGE);
 	fu_device_add_flag (FU_DEVICE (self), FWUPD_DEVICE_FLAG_SELF_RECOVERY);
 	fu_device_add_internal_flag (FU_DEVICE (self), FU_DEVICE_INTERNAL_FLAG_REPLUG_MATCH_GUID);
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_CCGX_DMC_DEVICE_FLAG_HAS_MANUAL_REPLUG,
+					 "has-manual-replug");
 }
 
 static void
diff --git a/plugins/colorhug/fu-colorhug-device.c b/plugins/colorhug/fu-colorhug-device.c
index 31b8704f0..be756ee7a 100644
--- a/plugins/colorhug/fu-colorhug-device.c
+++ b/plugins/colorhug/fu-colorhug-device.c
@@ -20,7 +20,7 @@
  *
  * Since: 1.0.3
  */
-#define FU_COLORHUG_DEVICE_FLAG_HALFSIZE	"halfsize"
+#define FU_COLORHUG_DEVICE_FLAG_HALFSIZE	(1 << 0)
 
 struct _FuColorhugDevice {
 	FuUsbDevice		 parent_instance;
@@ -321,7 +321,7 @@ fu_colorhug_device_probe (FuDevice *device, GError **error)
 		return FALSE;
 
 	/* compact memory layout */
-	if (fu_device_has_custom_flag (device, FU_COLORHUG_DEVICE_FLAG_HALFSIZE))
+	if (fu_device_has_private_flag (device, FU_COLORHUG_DEVICE_FLAG_HALFSIZE))
 		self->start_addr = CH_EEPROM_ADDR_RUNCODE_ALS;
 
 	/* add hardcoded bits */
@@ -534,6 +534,9 @@ fu_colorhug_device_init (FuColorhugDevice *self)
 				    FU_DEVICE_REMOVE_DELAY_RE_ENUMERATE);
 	fu_device_add_flag (FU_DEVICE (self), FWUPD_DEVICE_FLAG_ADD_COUNTERPART_GUIDS);
 	fu_device_add_internal_flag (FU_DEVICE (self), FU_DEVICE_INTERNAL_FLAG_REPLUG_MATCH_GUID);
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_COLORHUG_DEVICE_FLAG_HALFSIZE,
+					 "halfsize");
 }
 
 static void
diff --git a/plugins/cros-ec/fu-cros-ec-usb-device.c b/plugins/cros-ec/fu-cros-ec-usb-device.c
index 1cb18f5dd..34a7f4536 100644
--- a/plugins/cros-ec/fu-cros-ec-usb-device.c
+++ b/plugins/cros-ec/fu-cros-ec-usb-device.c
@@ -70,6 +70,11 @@ typedef struct {
 	gsize payload_size;
 } FuCrosEcUsbBlockInfo;
 
+#define FU_CROS_EC_USB_DEVICE_FLAG_RO_WRITTEN		(1 << 0)
+#define FU_CROS_EC_USB_DEVICE_FLAG_RW_WRITTEN		(1 << 1)
+#define FU_CROS_EC_USB_DEVICE_FLAG_REBOOTING_TO_RO	(1 << 2)
+#define FU_CROS_EC_USB_DEVICE_FLAG_SPECIAL		(1 << 3)
+
 static gboolean
 fu_cros_ec_usb_device_get_configuration (FuCrosEcUsbDevice *self,
 					 GError **error)
@@ -707,10 +712,7 @@ fu_cros_ec_usb_device_reset_to_ro (FuDevice *device, GError **error)
 	gsize response_size = 1;
 	g_autoptr(GError) error_local = NULL;
 
-	if (fu_device_has_custom_flag (device, "ro-written"))
-		fu_device_set_custom_flags (device, "ro-written,rebooting-to-ro");
-	else
-		fu_device_set_custom_flags (device, "rebooting-to-ro");
+	fu_device_add_private_flag (device, FU_CROS_EC_USB_DEVICE_FLAG_REBOOTING_TO_RO);
 	if (!fu_cros_ec_usb_device_send_subcommand  (device, subcommand, command_body,
 				     command_body_size, &response,
 				     &response_size, FALSE, &error_local)) {
@@ -760,7 +762,9 @@ fu_cros_ec_usb_device_write_firmware (FuDevice *device,
 	FuCrosEcFirmware *cros_ec_firmware = FU_CROS_EC_FIRMWARE (firmware);
 	gint num_txed_sections = 0;
 
-	if (fu_device_has_custom_flag (device, "rebooting-to-ro")) {
+	fu_device_remove_private_flag (device, FU_CROS_EC_USB_DEVICE_FLAG_SPECIAL);
+
+	if (fu_device_has_private_flag (device, FU_CROS_EC_USB_DEVICE_FLAG_REBOOTING_TO_RO)) {
 		gsize response_size = 1;
 		guint8 response;
 		guint16 subcommand = UPDATE_EXTRA_CMD_STAY_IN_RO;
@@ -768,6 +772,7 @@ fu_cros_ec_usb_device_write_firmware (FuDevice *device,
 		gsize command_body_size = 0;
 		START_RESP start_resp;
 
+		fu_device_remove_private_flag (device, FU_CROS_EC_USB_DEVICE_FLAG_REBOOTING_TO_RO);
 		if (!fu_cros_ec_usb_device_send_subcommand  (device, subcommand, command_body,
 							     command_body_size, &response,
 							     &response_size, FALSE, error)) {
@@ -789,15 +794,22 @@ fu_cros_ec_usb_device_write_firmware (FuDevice *device,
 		}
 	}
 
-	if (fu_device_has_custom_flag (device, "rw-written") && self->in_bootloader) {
+	if (fu_device_has_private_flag (device, FU_CROS_EC_USB_DEVICE_FLAG_RW_WRITTEN) && self->in_bootloader) {
 		/*
-		 * we had previously written to the rw region but somehow
-		 * ended back up here while still in bootloader; this is
-		 * a transitory state due to the fact that we have to boot
-		 * through RO to get to RW. Set another write required to
-		 * allow the RO region to auto-jump to RW
+		 * We had previously written to the rw region (while we were
+		 * booted from ro region), but somehow landed in ro again after
+		 * a reboot. Since we wrote rw already, we wanted to jump
+		 * to the new rw so we could evaluate ro.
+		 *
+		 * This is a transitory state due to the fact that we have to
+		 * boot through RO to get to RW. Set another write required to
+		 * allow the RO region to auto-jump to RW.
+		 *
+		 * Special flow: write phase skips actual write -> attach skips
+		 * send of reset command, just sets wait for replug, and
+		 * device restart status.
 		 */
-		fu_device_set_custom_flags (device, "special,rw-written");
+		fu_device_add_private_flag (device, FU_CROS_EC_USB_DEVICE_FLAG_SPECIAL);
 		fu_device_add_flag (device, FWUPD_DEVICE_FLAG_ANOTHER_WRITE_REQUIRED);
 		return TRUE;
 	}
@@ -855,20 +867,14 @@ fu_cros_ec_usb_device_write_firmware (FuDevice *device,
 		return FALSE;
 	}
 
-	if (self->in_bootloader) {
-		if (fu_device_has_custom_flag (device, "ro-written"))
-			fu_device_set_custom_flags (device, "ro-written,rw-written");
-		else
-			fu_device_set_custom_flags (device, "rw-written");
-	} else if (fu_device_has_custom_flag (device, "rw-written")) {
-		fu_device_set_custom_flags (device, "ro-written,rw-written");
-	} else {
-		fu_device_set_custom_flags (device, "ro-written");
-	}
+	if (self->in_bootloader)
+		fu_device_add_private_flag (device, FU_CROS_EC_USB_DEVICE_FLAG_RW_WRITTEN);
+	else
+		fu_device_add_private_flag (device, FU_CROS_EC_USB_DEVICE_FLAG_RO_WRITTEN);
 
 	/* logical XOR */
-	if (fu_device_has_custom_flag (device, "rw-written") !=
-	    fu_device_has_custom_flag (device, "ro-written"))
+	if (fu_device_has_private_flag (device, FU_CROS_EC_USB_DEVICE_FLAG_RW_WRITTEN) !=
+	    fu_device_has_private_flag (device, FU_CROS_EC_USB_DEVICE_FLAG_RO_WRITTEN))
 		fu_device_add_flag (device, FWUPD_DEVICE_FLAG_ANOTHER_WRITE_REQUIRED);
 
 	/* success */
@@ -921,16 +927,25 @@ fu_cros_ec_usb_device_attach (FuDevice *device, GError **error)
 {
 	FuCrosEcUsbDevice *self = FU_CROS_EC_USB_DEVICE (device);
 
-	if (self->in_bootloader && fu_device_has_custom_flag (device, "special")) {
-		fu_device_set_remove_delay (device, CROS_EC_REMOVE_DELAY_RE_ENUMERATE);
+	fu_device_set_remove_delay (device, CROS_EC_REMOVE_DELAY_RE_ENUMERATE);
+	if (self->in_bootloader &&
+	    fu_device_has_private_flag (device, FU_CROS_EC_USB_DEVICE_FLAG_SPECIAL)) {
+
+		/*
+		 * attach after the SPECIAL flag was set. The EC will auto-jump
+		 * from ro -> rw, so we do not need to send an explicit
+		 * reset_to_ro. We just need to set for another wait for replug
+		 * as a detach + reenumeration is expected as we jump from
+		 * ro -> rw.
+		 */
+		fu_device_remove_private_flag (device, FU_CROS_EC_USB_DEVICE_FLAG_SPECIAL);
 		fu_device_set_status (device, FWUPD_STATUS_DEVICE_RESTART);
 		fu_device_add_flag (device, FWUPD_DEVICE_FLAG_WAIT_FOR_REPLUG);
 		return TRUE;
 	}
 
-	fu_device_set_remove_delay (device, CROS_EC_REMOVE_DELAY_RE_ENUMERATE);
-	if (fu_device_has_custom_flag (device, "ro-written") &&
-	    !fu_device_has_custom_flag (device, "rw-written")) {
+	if (fu_device_has_private_flag (device, FU_CROS_EC_USB_DEVICE_FLAG_RO_WRITTEN) &&
+	    !fu_device_has_private_flag (device, FU_CROS_EC_USB_DEVICE_FLAG_RW_WRITTEN)) {
 		if (!fu_cros_ec_usb_device_reset_to_ro (device, error)) {
 			return FALSE;
 		}
@@ -949,8 +964,8 @@ fu_cros_ec_usb_device_detach (FuDevice *device, GError **error)
 {
 	FuCrosEcUsbDevice *self = FU_CROS_EC_USB_DEVICE (device);
 
-	if (fu_device_has_custom_flag (device, "rw-written") &&
-	    !fu_device_has_custom_flag (device, "ro-written"))
+	if (fu_device_has_private_flag (device, FU_CROS_EC_USB_DEVICE_FLAG_RW_WRITTEN) &&
+	    !fu_device_has_private_flag (device, FU_CROS_EC_USB_DEVICE_FLAG_RO_WRITTEN))
 		return TRUE;
 
 	if (self->in_bootloader) {
@@ -959,7 +974,7 @@ fu_cros_ec_usb_device_detach (FuDevice *device, GError **error)
 		return TRUE;
 	} else if (self->targ.common.flash_protection != 0x0) {
 		/* in RW, and RO region is write protected, so jump to RO */
-		fu_device_set_custom_flags (device, "ro-written");
+		fu_device_add_private_flag (device, FU_CROS_EC_USB_DEVICE_FLAG_RO_WRITTEN);
 		fu_device_set_remove_delay (device, CROS_EC_REMOVE_DELAY_RE_ENUMERATE);
 		if (!fu_cros_ec_usb_device_reset_to_ro (device, error))
 			return FALSE;
@@ -973,13 +988,25 @@ fu_cros_ec_usb_device_detach (FuDevice *device, GError **error)
 }
 
 static void
-fu_cros_ec_usb_device_init (FuCrosEcUsbDevice *device)
+fu_cros_ec_usb_device_init (FuCrosEcUsbDevice *self)
 {
-	fu_device_add_protocol (FU_DEVICE (device), "com.google.usb.crosec");
-	fu_device_add_flag (FU_DEVICE (device), FWUPD_DEVICE_FLAG_UPDATABLE);
-	fu_device_add_internal_flag (FU_DEVICE (device), FU_DEVICE_INTERNAL_FLAG_REPLUG_MATCH_GUID);
-	fu_device_set_version_format (FU_DEVICE (device), FWUPD_VERSION_FORMAT_TRIPLET);
-	fu_device_add_flag (FU_DEVICE (device), FWUPD_DEVICE_FLAG_DUAL_IMAGE);
+	fu_device_add_protocol (FU_DEVICE (self), "com.google.usb.crosec");
+	fu_device_add_flag (FU_DEVICE (self), FWUPD_DEVICE_FLAG_UPDATABLE);
+	fu_device_add_internal_flag (FU_DEVICE (self), FU_DEVICE_INTERNAL_FLAG_REPLUG_MATCH_GUID);
+	fu_device_set_version_format (FU_DEVICE (self), FWUPD_VERSION_FORMAT_TRIPLET);
+	fu_device_add_flag (FU_DEVICE (self), FWUPD_DEVICE_FLAG_DUAL_IMAGE);
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_CROS_EC_USB_DEVICE_FLAG_RO_WRITTEN,
+					 "ro-written");
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_CROS_EC_USB_DEVICE_FLAG_RW_WRITTEN,
+					 "rw-written");
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_CROS_EC_USB_DEVICE_FLAG_REBOOTING_TO_RO,
+					 "rebooting-to-ro");
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_CROS_EC_USB_DEVICE_FLAG_SPECIAL,
+					 "special");
 }
 
 static void
diff --git a/plugins/dell-dock/fu-dell-dock-hub.c b/plugins/dell-dock/fu-dell-dock-hub.c
index a1ad6d752..e59b45b48 100644
--- a/plugins/dell-dock/fu-dell-dock-hub.c
+++ b/plugins/dell-dock/fu-dell-dock-hub.c
@@ -173,6 +173,9 @@ static void
 fu_dell_dock_hub_init (FuDellDockHub *self)
 {
 	fu_device_retry_set_delay (FU_DEVICE (self), 1000);
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_DELL_DOCK_HUB_FLAG_HAS_BRIDGE,
+					 "has-bridge");
 }
 
 static void
diff --git a/plugins/dell-dock/fu-dell-dock-hub.h b/plugins/dell-dock/fu-dell-dock-hub.h
index b95e8fb1a..877ce633c 100644
--- a/plugins/dell-dock/fu-dell-dock-hub.h
+++ b/plugins/dell-dock/fu-dell-dock-hub.h
@@ -22,4 +22,11 @@
 #define FU_TYPE_DELL_DOCK_HUB (fu_dell_dock_hub_get_type ())
 G_DECLARE_FINAL_TYPE (FuDellDockHub, fu_dell_dock_hub, FU, DELL_DOCK_HUB, FuHidDevice)
 
+/**
+ * FU_DELL_DOCK_HUB_FLAG_HAS_BRIDGE:
+ *
+ * A bridge is present, possibly with extended devices.
+ */
+#define FU_DELL_DOCK_HUB_FLAG_HAS_BRIDGE	(1 << 0)
+
 FuDellDockHub 	*fu_dell_dock_hub_new		(FuUsbDevice *device);
diff --git a/plugins/dell-dock/fu-plugin-dell-dock.c b/plugins/dell-dock/fu-plugin-dell-dock.c
index fff7d7613..f79fd655d 100644
--- a/plugins/dell-dock/fu-plugin-dell-dock.c
+++ b/plugins/dell-dock/fu-plugin-dell-dock.c
@@ -144,7 +144,7 @@ fu_plugin_backend_device_added (FuPlugin *plugin,
 		return FALSE;
 	fu_plugin_device_add (plugin, FU_DEVICE (hub));
 
-	if (fu_device_has_custom_flag (FU_DEVICE (hub), "has-bridge")) {
+	if (fu_device_has_private_flag (FU_DEVICE (hub), FU_DELL_DOCK_HUB_FLAG_HAS_BRIDGE)) {
 		g_autoptr(GError) error_local = NULL;
 
 		/* only add the device with parent to cache */
diff --git a/plugins/dfu-csr/fu-dfu-csr-device.c b/plugins/dfu-csr/fu-dfu-csr-device.c
index 98edb0fe1..1759b13bf 100644
--- a/plugins/dfu-csr/fu-dfu-csr-device.c
+++ b/plugins/dfu-csr/fu-dfu-csr-device.c
@@ -13,25 +13,18 @@
 #include "fu-dfu-common.h"
 
 /**
- * FU_DFU_CSR_DEVICE_QUIRK_FLAG_REQUIRE_DELAY:
+ * FU_DFU_CSR_DEVICE_FLAG_REQUIRE_DELAY:
  *
  * Respect the write timeout value when performing actions. This is sometimes
  * set to a huge amount of time, and so is not used by default.
  *
  * Since: 1.0.3
  */
-#define FU_DFU_CSR_DEVICE_FLAG_REQUIRE_DELAY	"require-delay"
-
-typedef enum {
-	FU_DFU_CSR_DEVICE_QUIRK_NONE		= 0,
-	FU_DFU_CSR_DEVICE_QUIRK_REQUIRE_DELAY	= (1 << 0),
-	FU_DFU_CSR_DEVICE_QUIRK_LAST
-} FuDfuCsrDeviceQuirks;
+#define FU_DFU_CSR_DEVICE_FLAG_REQUIRE_DELAY		(1 << 0)
 
 struct _FuDfuCsrDevice
 {
 	FuHidDevice		 parent_instance;
-	FuDfuCsrDeviceQuirks	 quirks;
 	FuDfuState		 dfu_state;
 	guint32			 dnload_timeout;
 };
@@ -302,7 +295,8 @@ fu_dfu_csr_device_download_chunk (FuDfuCsrDevice *self, guint16 idx, GBytes *chu
 	}
 
 	/* wait for hardware */
-	if (self->quirks & FU_DFU_CSR_DEVICE_QUIRK_REQUIRE_DELAY) {
+	if (fu_device_has_private_flag (FU_DEVICE (self),
+					FU_DFU_CSR_DEVICE_FLAG_REQUIRE_DELAY)) {
 		g_debug ("sleeping for %ums", self->dnload_timeout);
 		g_usleep (self->dnload_timeout * 1000);
 	}
@@ -400,16 +394,10 @@ fu_dfu_csr_device_download (FuDevice *device,
 static gboolean
 fu_dfu_csr_device_probe (FuDevice *device, GError **error)
 {
-	FuDfuCsrDevice *self = FU_DFU_CSR_DEVICE (device);
-
 	/* FuUsbDevice->probe */
 	if (!FU_DEVICE_CLASS (fu_dfu_csr_device_parent_class)->probe (device, error))
 		return FALSE;
 
-	/* proxy the quirk delay */
-	if (fu_device_has_custom_flag (device, FU_DFU_CSR_DEVICE_FLAG_REQUIRE_DELAY))
-		self->quirks = FU_DFU_CSR_DEVICE_QUIRK_REQUIRE_DELAY;
-
 	/* hardcoded */
 	fu_device_add_flag (device, FWUPD_DEVICE_FLAG_UPDATABLE);
 
@@ -438,6 +426,9 @@ fu_dfu_csr_device_init (FuDfuCsrDevice *self)
 {
 	fu_device_add_protocol (FU_DEVICE (self), "com.qualcomm.dfu");
 	fu_device_add_internal_flag (FU_DEVICE (self), FU_DEVICE_INTERNAL_FLAG_REPLUG_MATCH_GUID);
+	fu_device_register_private_flag (FU_DEVICE (self),
+					FU_DFU_CSR_DEVICE_FLAG_REQUIRE_DELAY,
+					"require-delay");
 }
 
 static void
diff --git a/plugins/dfu/fu-dfu-common.h b/plugins/dfu/fu-dfu-common.h
index 9e0e9f0fe..d2a92116c 100644
--- a/plugins/dfu/fu-dfu-common.h
+++ b/plugins/dfu/fu-dfu-common.h
@@ -106,6 +106,115 @@ typedef enum {
 	FU_DFU_STATE_LAST
 } FuDfuState;
 
+/**
+ * FU_DFU_DEVICE_FLAG_ATTACH_EXTRA_RESET:
+ *
+ * Device needs resetting twice for attach.
+ */
+#define FU_DFU_DEVICE_FLAG_ATTACH_EXTRA_RESET			(1 << 0)
+/**
+ * FU_DFU_DEVICE_FLAG_ATTACH_UPLOAD_DOWNLOAD:
+ *
+ * An upload or download is required for attach.
+ */
+#define FU_DFU_DEVICE_FLAG_ATTACH_UPLOAD_DOWNLOAD		(1 << 1)
+/**
+ * FU_DFU_DEVICE_FLAG_FORCE_DFU_MODE:
+ *
+ * Force DFU mode.
+ */
+#define FU_DFU_DEVICE_FLAG_FORCE_DFU_MODE			(1 << 2)
+/**
+ * FU_DFU_DEVICE_FLAG_IGNORE_POLLTIMEOUT:
+ *
+ * Ignore the device download timeout.
+ */
+#define FU_DFU_DEVICE_FLAG_IGNORE_POLLTIMEOUT			(1 << 3)
+/**
+ * FU_DFU_DEVICE_FLAG_IGNORE_RUNTIME:
+ *
+ * Device has broken DFU runtime support.
+ */
+#define FU_DFU_DEVICE_FLAG_IGNORE_RUNTIME			(1 << 4)
+/**
+ * FU_DFU_DEVICE_FLAG_IGNORE_UPLOAD:
+ *
+ * Uploading from the device is broken.
+ */
+#define FU_DFU_DEVICE_FLAG_IGNORE_UPLOAD			(1 << 5)
+/**
+ * FU_DFU_DEVICE_FLAG_NO_DFU_RUNTIME:
+ *
+ * No DFU runtime interface is provided.
+ */
+#define FU_DFU_DEVICE_FLAG_NO_DFU_RUNTIME			(1 << 6)
+/**
+ * FU_DFU_DEVICE_FLAG_NO_GET_STATUS_UPLOAD:
+ *
+ * Do not do GetStatus when uploading.
+ */
+#define FU_DFU_DEVICE_FLAG_NO_GET_STATUS_UPLOAD			(1 << 7)
+/**
+ * FU_DFU_DEVICE_FLAG_NO_PID_CHANGE:
+ *
+ * Accept the same VID:PID when changing modes.
+ */
+#define FU_DFU_DEVICE_FLAG_NO_PID_CHANGE			(1 << 8)
+/**
+ * FU_DFU_DEVICE_FLAG_USE_ANY_INTERFACE:
+ *
+ * Use any interface for DFU.
+ */
+#define FU_DFU_DEVICE_FLAG_USE_ANY_INTERFACE			(1 << 9)
+/**
+ * FU_DFU_DEVICE_FLAG_USE_ATMEL_AVR:
+ *
+ * Device uses the ATMEL bootloader.
+ */
+#define FU_DFU_DEVICE_FLAG_USE_ATMEL_AVR			(1 << 10)
+/**
+ * FU_DFU_DEVICE_FLAG_USE_PROTOCOL_ZERO:
+ *
+ * Fix up the protocol number.
+ */
+#define FU_DFU_DEVICE_FLAG_USE_PROTOCOL_ZERO			(1 << 11)
+/**
+ * FU_DFU_DEVICE_FLAG_LEGACY_PROTOCOL:
+ *
+ * Use a legacy protocol version.
+ */
+#define FU_DFU_DEVICE_FLAG_LEGACY_PROTOCOL			(1 << 12)
+/**
+ * FU_DFU_DEVICE_FLAG_DETACH_FOR_ATTACH:
+ *
+ * Requires a FU_DFU_REQUEST_DETACH to attach.
+ */
+#define FU_DFU_DEVICE_FLAG_DETACH_FOR_ATTACH			(1 << 13)
+/**
+ * FU_DFU_DEVICE_FLAG_ABSENT_SECTOR_SIZE:
+ *
+ * In absence of sector size, assume byte.
+ */
+#define FU_DFU_DEVICE_FLAG_ABSENT_SECTOR_SIZE			(1 << 14)
+/**
+ * FU_DFU_DEVICE_FLAG_MANIFEST_POLL:
+ *
+ * Requires polling via GetStatus in dfuManifest state.
+ */
+#define FU_DFU_DEVICE_FLAG_MANIFEST_POLL			(1 << 15)
+/**
+ * FU_DFU_DEVICE_FLAG_NO_BUS_RESET_ATTACH:
+ *
+ * Do not require a bus reset to attach to normal.
+ */
+#define FU_DFU_DEVICE_FLAG_NO_BUS_RESET_ATTACH			(1 << 16)
+/**
+ * FU_DFU_DEVICE_FLAG_GD32:
+ *
+ * Uses the slightly weird GD32 variant of DFU.
+ */
+#define FU_DFU_DEVICE_FLAG_GD32					(1 << 17)
+
 const gchar	*fu_dfu_state_to_string			(FuDfuState	 state);
 const gchar	*fu_dfu_status_to_string		(FuDfuStatus	 status);
 
diff --git a/plugins/dfu/fu-dfu-device.c b/plugins/dfu/fu-dfu-device.c
index 64a5f39ae..32a1316ba 100644
--- a/plugins/dfu/fu-dfu-device.c
+++ b/plugins/dfu/fu-dfu-device.c
@@ -19,38 +19,6 @@
  * See also: [class@FuDfuTarget], [class@FuDfuseFirmware]
  */
 
-/**
- * FU_QUIRKS_DFU_FLAGS:
- * @key: the USB device ID, e.g. `USB\VID_0763&PID_2806`
- * @value: a string, separated using `|`, e.g. `ignore-polltimeout|no-pid-change`
- *
- * Assigns optional quirks to use for a DFU device which does not follow the
- * DFU 1.0 or 1.1 specification. The list of supported quirks is thus:
- *
- * * `none`:			No device quirks
- * * `attach-upload-download`:	An upload or download is required for attach
- * * `force-dfu-mode`:		Force DFU mode
- * * `ignore-polltimeout`:	Ignore the device download timeout
- * * `ignore-runtime`:		Device has broken DFU runtime support
- * * `ignore-upload`:		Uploading from the device is broken
- * * `no-dfu-runtime`:		No DFU runtime interface is provided
- * * `no-get-status-upload`:	Do not do GetStatus when uploading
- * * `no-pid-change`:		Accept the same VID:PID when changing modes
- * * `use-any-interface`:	Use any interface for DFU
- * * `use-atmel-avr`:		Device uses the ATMEL bootloader
- * * `use-protocol-zero`:	Fix up the protocol number
- * * `legacy-protocol`:		Use a legacy protocol version
- * * `detach-for-attach`:	Requires a FU_DFU_REQUEST_DETACH to attach
- * * `absent-sector-size`:	In absence of sector size, assume byte
- * * `manifest-poll`:		Requires polling via GetStatus in dfuManifest state
- * * `no-bus-reset-attach`:	Do not require a bus reset to attach to normal
- *
- * Default value: `none`
- *
- * Since: 1.0.1
- */
-#define	FU_QUIRKS_DFU_FLAGS			"Flags"
-
 /**
  * FU_QUIRKS_DFU_FORCE_VERSION:
  * @key: the USB device ID, e.g. `USB\VID_0763&PID_2806`
@@ -259,7 +227,7 @@ static void
 fu_dfu_device_guess_state_from_iface (FuDfuDevice *self, GUsbInterface *iface)
 {
 	/* some devices use the wrong interface */
-	if (fu_device_has_custom_flag (FU_DEVICE (self), "force-dfu-mode")) {
+	if (fu_device_has_private_flag (FU_DEVICE (self), FU_DFU_DEVICE_FLAG_FORCE_DFU_MODE)) {
 		g_debug ("quirking device into DFU mode");
 		fu_dfu_device_set_state (self, FU_DFU_STATE_DFU_IDLE);
 		return;
@@ -300,7 +268,7 @@ fu_dfu_device_add_targets (FuDfuDevice *self, GError **error)
 		GUsbInterface *iface = g_ptr_array_index (ifaces, i);
 
 		/* some devices don't use the right class and subclass */
-		if (!fu_device_has_custom_flag (FU_DEVICE (self), "use-any-interface")) {
+		if (fu_device_has_private_flag (FU_DEVICE (self), FU_DFU_DEVICE_FLAG_USE_ANY_INTERFACE)) {
 			if (g_usb_interface_get_class (iface) != G_USB_DEVICE_CLASS_APPLICATION_SPECIFIC)
 				continue;
 			if (g_usb_interface_get_subclass (iface) != 0x01)
@@ -386,7 +354,7 @@ fu_dfu_device_add_targets (FuDfuDevice *self, GError **error)
 
 	/* save for reset */
 	if (priv->state == FU_DFU_STATE_APP_IDLE ||
-	    fu_device_has_custom_flag (FU_DEVICE (self), "no-pid-change")) {
+	    fu_device_has_private_flag (FU_DEVICE (self), FU_DFU_DEVICE_FLAG_NO_PID_CHANGE)) {
 		priv->runtime_vid = g_usb_device_get_vid (usb_device);
 		priv->runtime_pid = g_usb_device_get_pid (usb_device);
 		priv->runtime_release = g_usb_device_get_release (usb_device);
@@ -394,7 +362,7 @@ fu_dfu_device_add_targets (FuDfuDevice *self, GError **error)
 
 	/* the device has no DFU runtime, so cheat */
 	if (priv->targets->len == 0 &&
-	    fu_device_has_custom_flag (FU_DEVICE (self), "no-dfu-runtime")) {
+	    fu_device_has_private_flag (FU_DEVICE (self), FU_DFU_DEVICE_FLAG_NO_DFU_RUNTIME)) {
 		g_debug ("no DFU runtime, so faking device");
 		fu_dfu_device_set_state (self, FU_DFU_STATE_APP_IDLE);
 		priv->iface_number = 0xff;
@@ -416,7 +384,7 @@ fu_dfu_device_add_targets (FuDfuDevice *self, GError **error)
 	}
 
 	/* the device upload is broken */
-	if (fu_device_has_custom_flag (FU_DEVICE (self), "ignore-upload"))
+	if (fu_device_has_private_flag (FU_DEVICE (self), FU_DFU_DEVICE_FLAG_IGNORE_UPLOAD))
 		priv->attributes &= ~FU_DFU_DEVICE_ATTR_CAN_UPLOAD;
 
 	return TRUE;
@@ -863,7 +831,7 @@ fu_dfu_device_refresh (FuDfuDevice *self, GError **error)
 
 	/* the device has no DFU runtime, so cheat */
 	if (priv->state == FU_DFU_STATE_APP_IDLE &&
-	    fu_device_has_custom_flag (FU_DEVICE (self), "no-dfu-runtime"))
+	    fu_device_has_private_flag (FU_DEVICE (self), FU_DFU_DEVICE_FLAG_NO_DFU_RUNTIME))
 		return TRUE;
 
 	/* ensure interface is claimed */
@@ -906,7 +874,7 @@ fu_dfu_device_refresh (FuDfuDevice *self, GError **error)
 	}
 
 	/* some devices use the wrong state value */
-	if (fu_device_has_custom_flag (FU_DEVICE (self), "force-dfu-mode") &&
+	if (fu_device_has_private_flag (FU_DEVICE (self), FU_DFU_DEVICE_FLAG_FORCE_DFU_MODE) &&
 	    fu_dfu_device_get_state (self) != FU_DFU_STATE_DFU_IDLE) {
 		g_debug ("quirking device into DFU mode");
 		fu_dfu_device_set_state (self, FU_DFU_STATE_DFU_IDLE);
@@ -916,7 +884,7 @@ fu_dfu_device_refresh (FuDfuDevice *self, GError **error)
 
 	/* status or state changed */
 	fu_dfu_device_set_status (self, buf[0]);
-	if (fu_device_has_custom_flag (FU_DEVICE (self), "ignore-polltimeout")) {
+	if (fu_device_has_private_flag (FU_DEVICE (self), FU_DFU_DEVICE_FLAG_IGNORE_POLLTIMEOUT)) {
 		priv->dnload_timeout = DFU_DEVICE_DNLOAD_TIMEOUT_DEFAULT;
 	} else {
 		priv->dnload_timeout = buf[1] +
@@ -1011,7 +979,7 @@ fu_dfu_device_detach (FuDevice *device, GError **error)
 
 	/* the device has no DFU runtime, so cheat */
 	if (priv->state == FU_DFU_STATE_APP_IDLE &&
-	    fu_device_has_custom_flag (FU_DEVICE (self), "no-dfu-runtime"))
+	    fu_device_has_private_flag (FU_DEVICE (self), FU_DFU_DEVICE_FLAG_NO_DFU_RUNTIME))
 		return TRUE;
 
 	/* ensure interface is claimed */
@@ -1068,7 +1036,7 @@ fu_dfu_device_abort (FuDfuDevice *self, GError **error)
 
 	/* the device has no DFU runtime, so cheat */
 	if (priv->state == FU_DFU_STATE_APP_IDLE &&
-	    fu_device_has_custom_flag (FU_DEVICE (self), "no-dfu-runtime")) {
+	    fu_device_has_private_flag (FU_DEVICE (self), FU_DFU_DEVICE_FLAG_NO_DFU_RUNTIME)) {
 		g_set_error_literal (error,
 				     FWUPD_ERROR,
 				     FWUPD_ERROR_NOT_SUPPORTED,
@@ -1135,7 +1103,7 @@ fu_dfu_device_clear_status (FuDfuDevice *self, GError **error)
 
 	/* the device has no DFU runtime, so cheat */
 	if (priv->state == FU_DFU_STATE_APP_IDLE &&
-	    fu_device_has_custom_flag (FU_DEVICE (self), "no-dfu-runtime")) {
+	    fu_device_has_private_flag (FU_DEVICE (self), FU_DFU_DEVICE_FLAG_NO_DFU_RUNTIME)) {
 		g_set_error_literal (error,
 				     FWUPD_ERROR,
 				     FWUPD_ERROR_NOT_SUPPORTED,
@@ -1209,14 +1177,14 @@ fu_dfu_device_open (FuDevice *device, GError **error)
 
 	/* the device has no DFU runtime, so cheat */
 	if (priv->state == FU_DFU_STATE_APP_IDLE &&
-	    fu_device_has_custom_flag (device, "no-dfu-runtime")) {
+	    fu_device_has_private_flag (FU_DEVICE (self), FU_DFU_DEVICE_FLAG_NO_DFU_RUNTIME)) {
 		fu_dfu_device_set_state (self, FU_DFU_STATE_APP_IDLE);
 		priv->status = FU_DFU_STATUS_OK;
 	}
 
 	/* GD32VF103 encodes the serial number in UTF-8 (rather than UTF-16)
 	 * and also uses the first two bytes as the model identifier */
-	if (fu_device_has_custom_flag (FU_DEVICE (device), "gd32")) {
+	if (fu_device_has_private_flag (FU_DEVICE (self), FU_DFU_DEVICE_FLAG_GD32)) {
 #if G_USB_CHECK_VERSION(0,3,6)
 		GUsbDevice *usb_device = fu_usb_device_get_dev (FU_USB_DEVICE (device));
 		const guint8 *buf;
@@ -1335,7 +1303,7 @@ fu_dfu_device_probe (FuDevice *device, GError **error)
 
 	/* hardware from Jabra literally reboots if you try to retry a failed
 	 * write -- there's no way to avoid blocking the daemon like this... */
-	if (fu_device_has_internal_flag (device, FU_DEVICE_INTERNAL_FLAG_ATTACH_EXTRA_RESET))
+	if (fu_device_has_private_flag (FU_DEVICE (self), FU_DFU_DEVICE_FLAG_ATTACH_EXTRA_RESET))
 		fu_device_sleep_with_progress (device, 10); /* seconds */
 
 	/* success */
@@ -1404,7 +1372,7 @@ fu_dfu_device_attach (FuDevice *device, GError **error)
 	fu_device_set_status (device, FWUPD_STATUS_DEVICE_RESTART);
 
 	/* handle weirdness */
-	if (fu_device_has_custom_flag (device, "detach-for-attach")) {
+	if (fu_device_has_private_flag (FU_DEVICE (self), FU_DFU_DEVICE_FLAG_DETACH_FOR_ATTACH)) {
 		if (!fu_dfu_device_request_detach (self, error))
 			return FALSE;
 		fu_device_set_status (device, FWUPD_STATUS_IDLE);
@@ -1414,7 +1382,7 @@ fu_dfu_device_attach (FuDevice *device, GError **error)
 
 	/* handle m-stack DFU bootloaders */
 	if (!priv->done_upload_or_download &&
-	    fu_device_has_custom_flag (device, "attach-upload-download")) {
+	    fu_device_has_private_flag (FU_DEVICE (self), FU_DFU_DEVICE_FLAG_ATTACH_UPLOAD_DOWNLOAD)) {
 		g_autoptr(GBytes) chunk = NULL;
 		g_autoptr(FuDfuTarget) target_zero = NULL;
 		g_debug ("doing dummy upload to work around m-stack quirk");
@@ -1432,7 +1400,7 @@ fu_dfu_device_attach (FuDevice *device, GError **error)
 		return FALSE;
 
 	/* normal DFU mode just needs a bus reset */
-	if (fu_device_has_custom_flag (device, "no-bus-reset-attach") &&
+	if (fu_device_has_private_flag (FU_DEVICE (self), FU_DFU_DEVICE_FLAG_NO_BUS_RESET_ATTACH) &&
 	    fu_dfu_device_has_attribute (self, FU_DFU_DEVICE_ATTR_WILL_DETACH))
 		g_debug ("Bus reset is not required. Device will reboot to normal");
 	else if (!fu_dfu_target_attach (target, error))
@@ -1942,4 +1910,59 @@ fu_dfu_device_init (FuDfuDevice *self)
 	fu_device_add_flag (FU_DEVICE (self), FWUPD_DEVICE_FLAG_ADD_COUNTERPART_GUIDS);
 	fu_device_add_internal_flag (FU_DEVICE (self), FU_DEVICE_INTERNAL_FLAG_REPLUG_MATCH_GUID);
 	fu_device_set_remove_delay (FU_DEVICE (self), FU_DEVICE_REMOVE_DELAY_RE_ENUMERATE);
+
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_DFU_DEVICE_FLAG_ATTACH_EXTRA_RESET,
+					 "attach-extra-reset");
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_DFU_DEVICE_FLAG_ATTACH_UPLOAD_DOWNLOAD,
+					 "attach-upload-download");
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_DFU_DEVICE_FLAG_FORCE_DFU_MODE,
+					 "force-dfu-mode");
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_DFU_DEVICE_FLAG_IGNORE_POLLTIMEOUT,
+					 "ignore-polltimeout");
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_DFU_DEVICE_FLAG_IGNORE_RUNTIME,
+					 "ignore-runtime");
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_DFU_DEVICE_FLAG_IGNORE_UPLOAD,
+					 "ignore-upload");
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_DFU_DEVICE_FLAG_NO_DFU_RUNTIME,
+					 "no-dfu-runtime");
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_DFU_DEVICE_FLAG_NO_GET_STATUS_UPLOAD,
+					 "no-get-status-upload");
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_DFU_DEVICE_FLAG_NO_PID_CHANGE,
+					 "no-pid-change");
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_DFU_DEVICE_FLAG_USE_ANY_INTERFACE,
+					 "use-any-interface");
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_DFU_DEVICE_FLAG_USE_ATMEL_AVR,
+					 "use-atmel-avr");
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_DFU_DEVICE_FLAG_USE_PROTOCOL_ZERO,
+					 "use-protocol-zero");
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_DFU_DEVICE_FLAG_LEGACY_PROTOCOL,
+					 "legacy-protocol");
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_DFU_DEVICE_FLAG_DETACH_FOR_ATTACH,
+					 "detach-for-attach");
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_DFU_DEVICE_FLAG_ABSENT_SECTOR_SIZE,
+					 "absent-sector-size");
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_DFU_DEVICE_FLAG_MANIFEST_POLL,
+					 "manifest-poll");
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_DFU_DEVICE_FLAG_NO_BUS_RESET_ATTACH,
+					 "no-bus-reset-attach");
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_DFU_DEVICE_FLAG_GD32,
+					 "gd32");
 }
diff --git a/plugins/dfu/fu-dfu-target-avr.c b/plugins/dfu/fu-dfu-target-avr.c
index 7f76b6961..71857ca60 100644
--- a/plugins/dfu/fu-dfu-target-avr.c
+++ b/plugins/dfu/fu-dfu-target-avr.c
@@ -160,8 +160,8 @@ fu_dfu_target_avr_select_memory_unit (FuDfuTarget *target,
 	guint8 buf[4];
 
 	/* check legacy protocol quirk */
-	if (fu_device_has_custom_flag (FU_DEVICE (fu_dfu_target_get_device (target)),
-				       "legacy-protocol")) {
+	if (fu_device_has_private_flag (FU_DEVICE (fu_dfu_target_get_device (target)),
+					FU_DFU_DEVICE_FLAG_LEGACY_PROTOCOL)) {
 		g_debug ("ignoring select memory unit as legacy protocol");
 		return TRUE;
 	}
@@ -420,8 +420,8 @@ fu_dfu_target_avr_setup (FuDfuTarget *target, GError **error)
 		return TRUE;
 
 	/* different methods for AVR vs. AVR32 */
-	if (fu_device_has_custom_flag (FU_DEVICE (fu_dfu_target_get_device (target)),
-				       "legacy-protocol")) {
+	if (fu_device_has_private_flag (FU_DEVICE (fu_dfu_target_get_device (target)),
+					FU_DFU_DEVICE_FLAG_LEGACY_PROTOCOL)) {
 		chunk_sig = fu_dfu_target_avr_get_chip_signature (target, error);
 		if (chunk_sig == NULL)
 			return FALSE;
@@ -541,8 +541,8 @@ fu_dfu_target_avr_download_element (FuDfuTarget *target,
 	}
 
 	/* the original AVR protocol uses a half-size control block */
-	if (fu_device_has_custom_flag (FU_DEVICE (fu_dfu_target_get_device (target)),
-				       "legacy-protocol")) {
+	if (fu_device_has_private_flag (FU_DEVICE (fu_dfu_target_get_device (target)),
+					FU_DFU_DEVICE_FLAG_LEGACY_PROTOCOL)) {
 		header_sz = ATMEL_AVR_CONTROL_BLOCK_SIZE;
 	}
 
@@ -565,8 +565,8 @@ fu_dfu_target_avr_download_element (FuDfuTarget *target,
 
 		/* select page if required */
 		if (fu_chunk_get_page (chk2) != page_last) {
-			if (fu_device_has_custom_flag (FU_DEVICE (fu_dfu_target_get_device (target)),
-						       "legacy-protocol")) {
+			if (fu_device_has_private_flag (FU_DEVICE (fu_dfu_target_get_device (target)),
+							FU_DFU_DEVICE_FLAG_LEGACY_PROTOCOL)) {
 				if (!fu_dfu_target_avr_select_memory_page (target,
 									fu_chunk_get_page (chk2),
 									error))
@@ -663,8 +663,8 @@ fu_dfu_target_avr_upload_element (FuDfuTarget *target,
 
 		/* select page if required */
 		if (fu_chunk_get_page (chk) != page_last) {
-			if (fu_device_has_custom_flag (FU_DEVICE (fu_dfu_target_get_device (target)),
-						       "legacy-protocol")) {
+			if (fu_device_has_private_flag (FU_DEVICE (fu_dfu_target_get_device (target)),
+							FU_DFU_DEVICE_FLAG_LEGACY_PROTOCOL)) {
 				if (!fu_dfu_target_avr_select_memory_page (target,
 									   fu_chunk_get_page (chk),
 									   error))
diff --git a/plugins/dfu/fu-dfu-target.c b/plugins/dfu/fu-dfu-target.c
index 7c9a278c4..b5b886c88 100644
--- a/plugins/dfu/fu-dfu-target.c
+++ b/plugins/dfu/fu-dfu-target.c
@@ -203,8 +203,8 @@ fu_dfu_target_parse_sector (FuDfuTarget *self,
 	}
 
 	/* handle weirdness */
-	if (fu_device_has_custom_flag (FU_DEVICE (fu_dfu_target_get_device (self)),
-				       "absent-sector-size")) {
+	if (fu_device_has_private_flag (FU_DEVICE (priv->device),
+					FU_DFU_DEVICE_FLAG_ABSENT_SECTOR_SIZE)) {
 		if (tmp[1] == '\0') {
 			tmp[1] = tmp[0];
 			tmp[0] = 'B';
@@ -654,7 +654,7 @@ fu_dfu_target_setup (FuDfuTarget *self, GError **error)
 {
 	FuDfuTargetClass *klass = FU_DFU_TARGET_GET_CLASS (self);
 	FuDfuTargetPrivate *priv = GET_PRIVATE (self);
-	FuDevice *device = FU_DEVICE (fu_dfu_target_get_device (self));
+	FuDevice *device = FU_DEVICE (priv->device);
 
 	g_return_val_if_fail (FU_IS_DFU_TARGET (self), FALSE);
 	g_return_val_if_fail (error == NULL || *error == NULL, FALSE);
@@ -671,7 +671,8 @@ fu_dfu_target_setup (FuDfuTarget *self, GError **error)
 
 	/* GD32VF103 devices features and peripheral list */
 	if (priv->alt_setting == 0x0 &&
-	    fu_device_has_custom_flag (device, "gd32")) {
+	    fu_device_has_private_flag (FU_DEVICE (priv->device),
+					FU_DFU_DEVICE_FLAG_GD32)) {
 		/*             RB R8 R6 R4  VB V8
 		 * Flash (KB) 128 64 32 16 128 64
 		 *             TB T8 T6 T4  CB C8 C6 C4
@@ -1368,7 +1369,8 @@ fu_dfu_target_download (FuDfuTarget *self,
 			return FALSE;
 	}
 
-	if (fu_device_has_custom_flag (FU_DEVICE (fu_dfu_target_get_device (self)), "manifest-poll") &&
+	if (fu_device_has_private_flag (FU_DEVICE (priv->device),
+					FU_DFU_DEVICE_FLAG_MANIFEST_POLL) &&
 	    fu_dfu_device_has_attribute (priv->device, FU_DFU_DEVICE_ATTR_MANIFEST_TOL))
 		if (!fu_dfu_target_manifest_wait (self, error))
 			return FALSE;
diff --git a/plugins/intel-spi/fu-intel-spi-device.c b/plugins/intel-spi/fu-intel-spi-device.c
index eec842483..5d4c542c6 100644
--- a/plugins/intel-spi/fu-intel-spi-device.c
+++ b/plugins/intel-spi/fu-intel-spi-device.c
@@ -51,6 +51,19 @@ struct _FuIntelSpiDevice {
 
 #define PCI_BASE_ADDRESS_0			0x0010
 
+/**
+ * FU_INTEL_SPI_DEVICE_FLAG_ICH:
+ *
+ * Device is an I/O Controller Hub.
+ */
+#define FU_INTEL_SPI_DEVICE_FLAG_ICH			(1 << 0)
+/**
+ * FU_INTEL_SPI_DEVICE_FLAG_PCH:
+ *
+ * Device is a Platform Controller Hub.
+ */
+#define FU_INTEL_SPI_DEVICE_FLAG_PCH			(1 << 1)
+
 G_DEFINE_TYPE (FuIntelSpiDevice, fu_intel_spi_device, FU_TYPE_DEVICE)
 
 static void
@@ -291,7 +304,7 @@ fu_intel_spi_device_setup (FuDevice *device, GError **error)
 	guint64 total_size = 0;
 	guint8 comp1_density;
 	guint8 comp2_density;
-	guint16 reg_pr0 = fu_device_has_custom_flag (device, "ICH") ? ICH9_REG_PR0 : PCH100_REG_FPR0;
+	guint16 reg_pr0 = fu_device_has_private_flag (device, FU_INTEL_SPI_DEVICE_FLAG_ICH) ? ICH9_REG_PR0 : PCH100_REG_FPR0;
 
 	/* dump everything */
 	if (g_getenv ("FWUPD_INTEL_SPI_VERBOSE") != NULL) {
@@ -501,6 +514,12 @@ fu_intel_spi_device_init (FuIntelSpiDevice *self)
 	fu_device_add_flag (FU_DEVICE (self), FWUPD_DEVICE_FLAG_CAN_VERIFY_IMAGE);
 	fu_device_add_icon (FU_DEVICE (self), "computer");
 	fu_device_set_physical_id (FU_DEVICE (self), "intel_spi");
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_INTEL_SPI_DEVICE_FLAG_ICH,
+					 "ICH");
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_INTEL_SPI_DEVICE_FLAG_PCH,
+					 "PCH");
 }
 
 static void
diff --git a/plugins/nvme/fu-nvme-device.c b/plugins/nvme/fu-nvme-device.c
index 0fd186cf6..3ac32d3d1 100644
--- a/plugins/nvme/fu-nvme-device.c
+++ b/plugins/nvme/fu-nvme-device.c
@@ -21,6 +21,13 @@ struct _FuNvmeDevice {
 	guint64			 write_block_size;
 };
 
+/**
+ * FU_NVME_DEVICE_FLAG_FORCE_ALIGN:
+ *
+ * Force alignment of the firmware file.
+ */
+#define FU_NVME_DEVICE_FLAG_FORCE_ALIGN		(1 << 0)
+
 G_DEFINE_TYPE (FuNvmeDevice, fu_nvme_device, FU_TYPE_UDEV_DEVICE)
 
 static void
@@ -330,7 +337,7 @@ fu_nvme_device_write_firmware (FuDevice *device,
 
 	/* some vendors provide firmware files whose sizes are not multiples
 	 * of blksz *and* the device won't accept blocks of different sizes */
-	if (fu_device_has_custom_flag (device, "force-align")) {
+	if (fu_device_has_private_flag (device, FU_NVME_DEVICE_FLAG_FORCE_ALIGN)) {
 		fw2 = fu_common_bytes_align (fw, block_size, 0xff);
 	} else {
 		fw2 = g_bytes_ref (fw);
@@ -403,6 +410,9 @@ fu_nvme_device_init (FuNvmeDevice *self)
 	fu_udev_device_set_flags (FU_UDEV_DEVICE (self),
 				  FU_UDEV_DEVICE_FLAG_OPEN_READ |
 				  FU_UDEV_DEVICE_FLAG_VENDOR_FROM_PARENT);
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_NVME_DEVICE_FLAG_FORCE_ALIGN,
+					 "force-align");
 }
 
 static void
diff --git a/plugins/synaptics-mst/fu-synaptics-mst-device.c b/plugins/synaptics-mst/fu-synaptics-mst-device.c
index b2a4e55a5..9f839ae3e 100644
--- a/plugins/synaptics-mst/fu-synaptics-mst-device.c
+++ b/plugins/synaptics-mst/fu-synaptics-mst-device.c
@@ -41,6 +41,13 @@
 
 #define FLASH_SETTLE_TIME		5000000	/* us */
 
+/**
+ * FU_SYNAPTICS_MST_DEVICE_FLAG_IGNORE_BOARD_ID:
+ *
+ * Ignore board ID firmware mismatch.
+ */
+#define FU_SYNAPTICS_MST_DEVICE_FLAG_IGNORE_BOARD_ID		(1 << 0)
+
 struct _FuSynapticsMstDevice {
 	FuUdevDevice		 parent_instance;
 	gchar			*device_kind;
@@ -81,6 +88,9 @@ fu_synaptics_mst_device_init (FuSynapticsMstDevice *self)
 				  FU_UDEV_DEVICE_FLAG_OPEN_READ |
 				  FU_UDEV_DEVICE_FLAG_OPEN_WRITE |
 				  FU_UDEV_DEVICE_FLAG_VENDOR_FROM_PARENT);
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_SYNAPTICS_MST_DEVICE_FLAG_IGNORE_BOARD_ID,
+					 "ignore-board-id");
 }
 
 static void
@@ -793,7 +803,7 @@ fu_synaptics_mst_device_prepare_firmware (FuDevice *device,
 	if (!fu_firmware_parse (firmware, fw, flags, error))
 		return NULL;
 	if ((flags & FWUPD_INSTALL_FLAG_IGNORE_VID_PID) == 0 &&
-	    !fu_device_has_custom_flag (device, "ignore-board-id")) {
+	    !fu_device_has_private_flag (device, FU_SYNAPTICS_MST_DEVICE_FLAG_IGNORE_BOARD_ID)) {
 		guint16 board_id = fu_synaptics_mst_firmware_get_board_id (FU_SYNAPTICS_MST_FIRMWARE (firmware));
 		if (board_id != self->board_id) {
 			g_set_error (error,
diff --git a/plugins/uefi-capsule/fu-plugin-uefi-capsule.c b/plugins/uefi-capsule/fu-plugin-uefi-capsule.c
index d7766c9c9..d8d6e62b8 100644
--- a/plugins/uefi-capsule/fu-plugin-uefi-capsule.c
+++ b/plugins/uefi-capsule/fu-plugin-uefi-capsule.c
@@ -310,7 +310,7 @@ fu_plugin_uefi_capsule_update_splash (FuPlugin *plugin, FuDevice *device, GError
 	};
 
 	/* no UX capsule support, so deleting var if it exists */
-	if (fu_device_has_custom_flag (device, "no-ux-capsule")) {
+	if (fu_device_has_private_flag (device, FU_UEFI_DEVICE_FLAG_NO_UX_CAPSULE)) {
 		g_debug ("not providing UX capsule");
 		return fu_efivar_delete (FU_EFIVAR_GUID_FWUPDATE,
 					    "fwupd-ux-capsule", error);
@@ -509,9 +509,9 @@ fu_plugin_uefi_capsule_coldplug_device (FuPlugin *plugin, FuUefiDevice *dev, GEr
 		return FALSE;
 
 	/* if not already set by quirks */
-	if (fu_device_get_custom_flags (FU_DEVICE (dev)) == NULL &&
-	    fu_plugin_has_custom_flag (plugin, "use-legacy-bootmgr-desc")) {
-		fu_device_set_custom_flags (FU_DEVICE (dev), "use-legacy-bootmgr-desc");
+	if (fu_plugin_has_custom_flag (plugin, "use-legacy-bootmgr-desc")) {
+		fu_device_add_private_flag (FU_DEVICE (dev),
+					    FU_UEFI_DEVICE_FLAG_USE_LEGACY_BOOTMGR_DESC);
 	}
 
 	/* set fallback name if nothing else is set */
diff --git a/plugins/uefi-capsule/fu-uefi-device.c b/plugins/uefi-capsule/fu-uefi-device.c
index 9f8d46227..a6f0299ad 100644
--- a/plugins/uefi-capsule/fu-uefi-device.c
+++ b/plugins/uefi-capsule/fu-uefi-device.c
@@ -599,11 +599,11 @@ fu_uefi_device_write_firmware (FuDevice *device,
 	/* update the firmware before the bootloader runs */
 	if (fu_device_get_metadata_boolean (device, "RequireShimForSecureBoot"))
 		flags |= FU_UEFI_BOOTMGR_FLAG_USE_SHIM_FOR_SB;
-	if (fu_device_has_custom_flag (device, "use-shim-unique"))
+	if (fu_device_has_private_flag (device, FU_UEFI_DEVICE_FLAG_USE_SHIM_UNIQUE))
 		flags |= FU_UEFI_BOOTMGR_FLAG_USE_SHIM_UNIQUE;
 
 	/* some legacy devices use the old name to deduplicate boot entries */
-	if (fu_device_has_custom_flag (device, "use-legacy-bootmgr-desc"))
+	if (fu_device_has_private_flag (device, FU_UEFI_DEVICE_FLAG_USE_LEGACY_BOOTMGR_DESC))
 		bootmgr_desc = "Linux-Firmware-Updater";
 	if (!fu_uefi_bootmgr_bootnext (device, esp_path, bootmgr_desc, flags, error))
 		return FALSE;
@@ -776,6 +776,15 @@ static void
 fu_uefi_device_init (FuUefiDevice *self)
 {
 	fu_device_add_protocol (FU_DEVICE (self), "org.uefi.capsule");
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_UEFI_DEVICE_FLAG_NO_UX_CAPSULE,
+					 "no-ux-capsule");
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_UEFI_DEVICE_FLAG_USE_SHIM_UNIQUE,
+					 "use-shim-unique");
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_UEFI_DEVICE_FLAG_USE_LEGACY_BOOTMGR_DESC,
+					 "use-legacy-bootmgr-desc");
 }
 
 static void
diff --git a/plugins/uefi-capsule/fu-uefi-device.h b/plugins/uefi-capsule/fu-uefi-device.h
index 10168430a..9087ae6c7 100644
--- a/plugins/uefi-capsule/fu-uefi-device.h
+++ b/plugins/uefi-capsule/fu-uefi-device.h
@@ -37,6 +37,25 @@ typedef enum {
 	FU_UEFI_DEVICE_STATUS_LAST
 } FuUefiDeviceStatus;
 
+/**
+ * FU_UEFI_DEVICE_FLAG_NO_UX_CAPSULE:
+ *
+ * No not use the additional UX capsule.
+ */
+#define FU_UEFI_DEVICE_FLAG_NO_UX_CAPSULE		(1 << 0)
+/**
+ * FU_UEFI_DEVICE_FLAG_USE_SHIM_UNIQUE:
+ *
+ * Use a unique shim filename to work around a common BIOS bug.
+ */
+#define FU_UEFI_DEVICE_FLAG_USE_SHIM_UNIQUE		(1 << 1)
+/**
+ * FU_UEFI_DEVICE_FLAG_USE_LEGACY_BOOTMGR_DESC:
+ *
+ * Use the legacy boot manager description to work around a Lenovo BIOS bug.
+ */
+#define FU_UEFI_DEVICE_FLAG_USE_LEGACY_BOOTMGR_DESC	(1 << 2)
+
 FuUefiDevice	*fu_uefi_device_new_from_guid		(const gchar	*guid);
 FuUefiDevice	*fu_uefi_device_new_from_dev		(FuDevice	*dev);
 void		 fu_uefi_device_set_esp			(FuUefiDevice	*self,
diff --git a/plugins/vli/fu-vli-pd-device.c b/plugins/vli/fu-vli-pd-device.c
index b70313097..247625286 100644
--- a/plugins/vli/fu-vli-pd-device.c
+++ b/plugins/vli/fu-vli-pd-device.c
@@ -18,6 +18,13 @@ struct _FuVliPdDevice
 	FuVliDevice		 parent_instance;
 };
 
+/**
+ * FU_VLI_PD_DEVICE_FLAG_HAS_I2C_PS186:
+ *
+ * Device has a PS186 attached via I²C.
+ */
+#define FU_VLI_PD_DEVICE_FLAG_HAS_I2C_PS186		(1 << 0)
+
 G_DEFINE_TYPE (FuVliPdDevice, fu_vli_pd_device, FU_TYPE_VLI_DEVICE)
 
 static gboolean
@@ -319,7 +326,7 @@ fu_vli_pd_device_setup (FuDevice *device, GError **error)
 		fu_device_remove_flag (FU_DEVICE (self), FWUPD_DEVICE_FLAG_IS_BOOTLOADER);
 
 	/* detect any I²C child, e.g. parade device */
-	if (fu_device_has_custom_flag (FU_DEVICE (self), "has-i2c-ps186")) {
+	if (fu_device_has_private_flag (device, FU_VLI_PD_DEVICE_FLAG_HAS_I2C_PS186)) {
 		if (!fu_vli_pd_device_parade_setup (self, error))
 			return FALSE;
 	}
@@ -688,6 +695,9 @@ fu_vli_pd_device_init (FuVliPdDevice *self)
 	fu_device_set_remove_delay (FU_DEVICE (self), FU_DEVICE_REMOVE_DELAY_RE_ENUMERATE);
 	fu_device_set_version_format (FU_DEVICE (self), FWUPD_VERSION_FORMAT_QUAD);
 	fu_vli_device_set_spi_auto_detect (FU_VLI_DEVICE (self), FALSE);
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_VLI_PD_DEVICE_FLAG_HAS_I2C_PS186,
+					 "has-i2c-ps186");
 
 	/* connect up attach or detach vfuncs when kind is known */
 	g_signal_connect (self, "notify::kind",
diff --git a/plugins/vli/fu-vli-usbhub-device.c b/plugins/vli/fu-vli-usbhub-device.c
index 626984f6a..c578984e8 100644
--- a/plugins/vli/fu-vli-usbhub-device.c
+++ b/plugins/vli/fu-vli-usbhub-device.c
@@ -28,6 +28,49 @@ struct _FuVliUsbhubDevice
 
 G_DEFINE_TYPE (FuVliUsbhubDevice, fu_vli_usbhub_device, FU_TYPE_VLI_DEVICE)
 
+/**
+ * FU_VLI_USBHUB_DEVICE_FLAG_ATTACH_WITH_GPIOB:
+ *
+ * Use GPIO-B reset to reset the device.
+ */
+#define FU_VLI_USBHUB_DEVICE_FLAG_ATTACH_WITH_GPIOB	(1 << 0)
+/**
+ * FU_VLI_USBHUB_DEVICE_FLAG_USB2:
+ *
+ * Device is USB-2 speed.
+ */
+#define FU_VLI_USBHUB_DEVICE_FLAG_USB2			(1 << 1)
+/**
+ * FU_VLI_USBHUB_DEVICE_FLAG_USB3:
+ *
+ * Device is USB-3 speed.
+ */
+#define FU_VLI_USBHUB_DEVICE_FLAG_USB3			(1 << 2)
+/**
+ * FU_VLI_USBHUB_DEVICE_FLAG_UNLOCK_LEGACY813:
+ *
+ * Device type VL813 needs unlocking with a custom VDR request.
+ */
+#define FU_VLI_USBHUB_DEVICE_FLAG_UNLOCK_LEGACY813	(1 << 3)
+/**
+ * FU_VLI_USBHUB_DEVICE_FLAG_HAS_SHARED_SPI_PD:
+ *
+ * Device shares the SPI device with the PD device.
+ */
+#define FU_VLI_USBHUB_DEVICE_FLAG_HAS_SHARED_SPI_PD	(1 << 4)
+/**
+ * FU_VLI_USBHUB_DEVICE_FLAG_HAS_MSP430:
+ *
+ * Device has a MSP430 attached via I²C.
+ */
+#define FU_VLI_USBHUB_DEVICE_FLAG_HAS_MSP430		(1 << 5)
+/**
+ * FU_VLI_USBHUB_DEVICE_FLAG_HAS_RTD21XX:
+ *
+ * Device has a RTD21XX attached via I²C.
+ */
+#define FU_VLI_USBHUB_DEVICE_FLAG_HAS_RTD21XX		(1 << 6)
+
 static void
 fu_vli_usbhub_device_to_string (FuDevice *device, guint idt, GString *str)
 {
@@ -265,7 +308,7 @@ fu_vli_usbhub_device_attach_full (FuDevice *device, FuDevice *proxy, GError **er
 
 	/* some hardware has to toggle a GPIO to reset the entire PCB */
 	if (fu_vli_device_get_kind (FU_VLI_DEVICE (proxy)) == FU_VLI_DEVICE_KIND_VL817 &&
-	    fu_device_has_custom_flag (proxy, "attach-with-gpiob")) {
+	    fu_device_has_private_flag (device, FU_VLI_USBHUB_DEVICE_FLAG_ATTACH_WITH_GPIOB)) {
 		guint8 tmp = 0x0;
 
 		/* set GPIOB output enable */
@@ -498,12 +541,14 @@ fu_vli_usbhub_device_probe (FuDevice *device, GError **error)
 		return FALSE;
 
 	/* quirks now applied... */
-	if (usbver > 0x0300 || fu_device_has_custom_flag (device, "usb3")) {
+	if (usbver > 0x0300 ||
+	    fu_device_has_private_flag (device, FU_VLI_USBHUB_DEVICE_FLAG_USB3)) {
 		fu_device_set_summary (device, "USB 3.x Hub");
 		/* prefer to show the USB 3 device and only fall back to the
 		 * USB 2 version as a recovery */
 		fu_device_set_priority (device, 1);
-	} else if (usbver > 0x0200 || fu_device_has_custom_flag (device, "usb2")) {
+	} else if (usbver > 0x0200 ||
+		   fu_device_has_private_flag (device, FU_VLI_USBHUB_DEVICE_FLAG_USB2)) {
 		fu_device_set_summary (device, "USB 2.x Hub");
 	} else {
 		fu_device_set_summary (device, "USB Hub");
@@ -593,7 +638,7 @@ fu_vli_usbhub_device_ready (FuDevice *device, GError **error)
 	g_autoptr(GError) error_tmp = NULL;
 
 	/* try to read a block of data which will fail for 813-type devices */
-	if (fu_device_has_custom_flag (FU_DEVICE (self), "needs-unlock-legacy813") &&
+	if (fu_device_has_private_flag (device, FU_VLI_USBHUB_DEVICE_FLAG_UNLOCK_LEGACY813) &&
 	    !fu_vli_device_spi_read_block (FU_VLI_DEVICE (self), 0x0, (guint8 *) &self->hd1_hdr,
 					   sizeof(self->hd1_hdr), &error_tmp)) {
 		g_warning ("failed to read, trying to unlock 813: %s", error_tmp->message);
@@ -659,18 +704,18 @@ fu_vli_usbhub_device_ready (FuDevice *device, GError **error)
 	}
 
 	/* detect the PD child */
-	if (fu_device_has_custom_flag (FU_DEVICE (self), "has-shared-spi-pd")) {
+	if (fu_device_has_private_flag (device, FU_VLI_USBHUB_DEVICE_FLAG_HAS_SHARED_SPI_PD)) {
 		if (!fu_vli_usbhub_device_pd_setup (self, error))
 			return FALSE;
 	}
 
 	/* detect the I²C child */
 	if (fu_usb_device_get_spec (FU_USB_DEVICE (self)) >= 0x0300 &&
-	    fu_device_has_custom_flag (FU_DEVICE (self), "has-msp430")) {
+	    fu_device_has_private_flag (device, FU_VLI_USBHUB_DEVICE_FLAG_HAS_MSP430)) {
 		if (!fu_vli_usbhub_device_msp430_setup (self, error))
 			return FALSE;
 	}
-	if (fu_device_has_custom_flag (FU_DEVICE (self), "has-rtd21xx")) {
+	if (fu_device_has_private_flag (device, FU_VLI_USBHUB_DEVICE_FLAG_HAS_RTD21XX)) {
 		if (!fu_vli_usbhub_device_rtd21xx_setup (self, error))
 			return FALSE;
 	}
@@ -993,6 +1038,27 @@ fu_vli_usbhub_device_init (FuVliUsbhubDevice *self)
 	fu_device_add_icon (FU_DEVICE (self), "audio-card");
 	fu_device_add_protocol (FU_DEVICE (self), "com.vli.usbhub");
 	fu_device_set_remove_delay (FU_DEVICE (self), FU_DEVICE_REMOVE_DELAY_RE_ENUMERATE);
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_VLI_USBHUB_DEVICE_FLAG_ATTACH_WITH_GPIOB,
+					 "attach-with-gpiob");
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_VLI_USBHUB_DEVICE_FLAG_USB2,
+					 "usb3");
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_VLI_USBHUB_DEVICE_FLAG_USB3,
+					 "usb2");
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_VLI_USBHUB_DEVICE_FLAG_UNLOCK_LEGACY813,
+					 "unlock-legacy813");
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_VLI_USBHUB_DEVICE_FLAG_HAS_SHARED_SPI_PD,
+					 "has-shared-spi-pd");
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_VLI_USBHUB_DEVICE_FLAG_HAS_MSP430,
+					 "has-msp430");
+	fu_device_register_private_flag (FU_DEVICE (self),
+					 FU_VLI_USBHUB_DEVICE_FLAG_HAS_RTD21XX,
+					 "has-rtd21xx");
 }
 
 static void
diff --git a/src/fu-device-list.c b/src/fu-device-list.c
index 2300516e9..7ad16b9a7 100644
--- a/src/fu-device-list.c
+++ b/src/fu-device-list.c
@@ -541,7 +541,7 @@ fu_device_list_item_set_device (FuDeviceItem *item, FuDevice *device)
 static void
 fu_device_list_replace (FuDeviceList *self, FuDeviceItem *item, FuDevice *device)
 {
-	const gchar *custom_flags;
+	guint64 private_flags;
 	GPtrArray *vendor_ids;
 
 	/* clear timeout if scheduled */
@@ -562,10 +562,10 @@ fu_device_list_replace (FuDeviceList *self, FuDeviceItem *item, FuDevice *device
 	}
 
 	/* copy over custom flags */
-	custom_flags = fu_device_get_custom_flags (item->device);
-	if (custom_flags != NULL) {
-		g_debug ("copying old custom flags %s to new device", custom_flags);
-		fu_device_set_custom_flags (device, custom_flags);
+	private_flags = fu_device_get_private_flags (item->device);
+	if (private_flags != 0) {
+		g_debug ("copying old custom flags 0x%x to new device", (guint) private_flags);
+		fu_device_set_private_flags (device, private_flags);
 	}
 
 	/* copy over the version strings if not set */