diff --git a/docs/pxe-boot.md b/docs/pxe-boot.md
index 26a6712..5b8cc5f 100644
--- a/docs/pxe-boot.md
+++ b/docs/pxe-boot.md
@@ -29,7 +29,7 @@ The host creates these directories with systemd tmpfiles:
 ```text
 /srv/pxe
 /srv/pxe/http
-/srv/pxe/http/images
+/srv/pxe/http/images  -> /mnt/pxe-images  (symlink to NFS share)
 /srv/pxe/http/auto-installer
 /srv/pxe/http/nixos-minimal
 /srv/pxe/http/debian
@@ -39,9 +39,13 @@ The host creates these directories with systemd tmpfiles:
 /srv/pxe/tftp
 ```
 
-Mount shared image storage under `/srv/pxe/http`, preferably
-`/srv/pxe/http/images` unless a menu entry expects files in a specific
-directory such as `/srv/pxe/http/auto-installer`.
+`/srv/pxe/http/images` is a symlink to `/mnt/pxe-images`, which is an NFSv4.2
+mount of `server.sweet.home:/tank/proxmox/pxe-images`
+(`modules/pxe-boot/mount-pxe-images.nix`). Place large images there (ISOs,
+disk images) rather than on the pxe-boot host's own root disk. For an LXC
+pxe-boot container the mount uses `nofail` (eager, non-blocking on server
+unavailability); for a Proxmox VM it uses `x-systemd.automount` (lazy,
+triggered on first access).
 
 The HTTP iPXE chain is:
 
@@ -116,6 +120,9 @@ The SystemRescue entry expects the source ISO at:
 /srv/pxe/http/images/systemrescue.iso
 ```
 
+Since `/srv/pxe/http/images` is the NFS-backed symlink, place the ISO on the
+NFS share at `server.sweet.home:/tank/proxmox/pxe-images/systemrescue.iso`.
+
 The `stage-systemrescue.service` oneshot extracts that ISO into:
 
 ```text
diff --git a/modules/build-types/pxe-boot.nix b/modules/build-types/pxe-boot.nix
index 7e74f06..8179adb 100644
--- a/modules/build-types/pxe-boot.nix
+++ b/modules/build-types/pxe-boot.nix
@@ -132,6 +132,7 @@ in
 {
   imports = [
     ../pxe-boot/stage-installer-artifacts.nix
+    ../pxe-boot/mount-pxe-images.nix
   ];
 
   environment.systemPackages = with pkgs; [
@@ -170,7 +171,7 @@ in
     tmpfiles.rules = [
       "d ${pxeRoot} 0755 root root -"
       "d ${httpRoot} 0755 root root -"
-      "d ${httpRoot}/images 0755 root root -"
+      "L+ ${httpRoot}/images - - - - ${vars.nfsShares.proxmoxPxeImages.mountpoint}"
       "d ${httpRoot}/auto-installer 0755 root root -"
       "d ${httpRoot}/nixos-minimal 0755 root root -"
       "d ${httpRoot}/systemrescue 0755 root root -"
diff --git a/modules/pxe-boot/mount-pxe-images.nix b/modules/pxe-boot/mount-pxe-images.nix
new file mode 100644
index 0000000..853ab08
--- /dev/null
+++ b/modules/pxe-boot/mount-pxe-images.nix
@@ -0,0 +1,24 @@
+{ config, vars, ... }:
+
+let
+  # Use the same FQDN approach as docker/mount-data.nix — a bare hostname is
+  # unreliable: systemd-resolved only tries LLMNR for single-label names, and
+  # a global search domain causes it to skip the interface-scoped LAN DNS.
+  nfsServer = "${vars.nfsServerHost}.${vars.homeDomain}";
+
+  # x-systemd.automount is unsupported inside LXC containers (systemd logs
+  # "Starting of <unit>.automount unsupported" and never mounts). Use nofail
+  # there so a boot with the NFS server unreachable doesn't hang instead.
+  automountOpts = if config.boot.isContainer then [ "nofail" ] else [ "x-systemd.automount" ];
+in
+{
+  fileSystems.${vars.nfsShares.proxmoxPxeImages.mountpoint} = {
+    device = "${nfsServer}:${vars.storageRoot}/${vars.nfsShares.proxmoxPxeImages.subpath}";
+    fsType = "nfs";
+    options = [
+      "nfsvers=4.2"
+      "_netdev"
+      "noatime"
+    ] ++ automountOpts;
+  };
+}