diff --git a/modules/build-types/pxe-boot.nix b/modules/build-types/pxe-boot.nix
index 16a43b5..f8961f8 100644
--- a/modules/build-types/pxe-boot.nix
+++ b/modules/build-types/pxe-boot.nix
@@ -427,18 +427,21 @@ in
       # Without this dnsmasq tries to bind port 53 which systemd-resolved
       # already owns, causing startup failure.
       port = 0;
-      dhcp-range = [ "192.168.2.0,proxy" ];
-      dhcp-match = [
-        "set:ipxe,175"
-        "set:efi64,option:client-arch,7"
-        "set:efi64,option:client-arch,9"
-      ];
+      log-dhcp = true;
+      dhcp-range = "192.168.2.0,proxy";
+      # Detect iPXE clients on the second DHCP round (after loading the
+      # iPXE binary) so we can serve the HTTP menu instead of TFTP.
+      dhcp-match = "set:ipxe,175";
       dhcp-userclass = "set:ipxe,iPXE";
-      dhcp-boot = [
-        "tag:ipxe,tag:efi64,http://${vars.pxeServerIp}/boot.ipxe"
-        "tag:ipxe,http://${vars.pxeServerIp}/boot.ipxe"
-        "tag:efi64,ipxe.efi,,${vars.pxeServerIp}"
-        "undionly.kpxe,,${vars.pxeServerIp}"
+      # iPXE second boot: chain to HTTP boot menu.
+      dhcp-boot = "tag:ipxe,http://${vars.pxeServerIp}/boot.ipxe";
+      # Initial boot: use pxe-service so dnsmasq sends proxy DHCP offers.
+      # dhcp-boot alone does not trigger proxy offers in dnsmasq 2.93.
+      # Arch 0 = BIOS, 7 = EFI BC (OVMF), 9 = EFI x86-64.
+      pxe-service = [
+        "0,\"Network Boot\",undionly.kpxe,${vars.pxeServerIp}"
+        "7,\"Network Boot\",ipxe.efi,${vars.pxeServerIp}"
+        "9,\"Network Boot\",ipxe.efi,${vars.pxeServerIp}"
       ];
     };
   };