diff --git a/docs/pxe-boot.md b/docs/pxe-boot.md
index 4ec2b8a..d66ad84 100644
--- a/docs/pxe-boot.md
+++ b/docs/pxe-boot.md
@@ -7,12 +7,14 @@ The `pxe-boot` host serves HTTP boot assets for iPXE clients.
 - Hostname: `pxe-boot`
 - Web service: nginx on TCP port 80
 - PXE root: `/srv/pxe`
-- iPXE entry script: `/srv/pxe/boot.ipxe`
-- Generated iPXE menu: `/srv/pxe/menu.ipxe`
-- TFTP fallback script: `/srv/pxe/boot/autoexec.ipxe`
+- HTTP root for scripts and images: `/srv/pxe/http`
+- TFTP root for first-stage bootloaders: `/srv/pxe/tftp`
+- iPXE entry script: `/srv/pxe/http/boot.ipxe`
+- Generated iPXE menu: `/srv/pxe/http/menu.ipxe`
+- TFTP fallback script: `/srv/pxe/tftp/autoexec.ipxe`
 - Boot binaries copied from the Nix `ipxe` package:
-  - `/srv/pxe/boot/ipxe.efi`
-  - `/srv/pxe/boot/undionly.kpxe`
+  - `/srv/pxe/tftp/ipxe.efi`
+  - `/srv/pxe/tftp/undionly.kpxe`
 
 ## Directory Layout
 
@@ -20,12 +22,18 @@ The host creates these directories with systemd tmpfiles:
 
 ```text
 /srv/pxe
-/srv/pxe/boot
-/srv/pxe/nixos
-/srv/pxe/ubuntu
-/srv/pxe/rescue
+/srv/pxe/http
+/srv/pxe/http/images
+/srv/pxe/http/nixos
+/srv/pxe/http/ubuntu
+/srv/pxe/http/rescue
+/srv/pxe/tftp
 ```
 
+Mount shared image storage under `/srv/pxe/http`, preferably
+`/srv/pxe/http/images` unless a menu entry expects files in a specific
+directory such as `/srv/pxe/http/nixos`.
+
 The HTTP iPXE chain is:
 
 ```text
@@ -35,9 +43,6 @@ undionly.kpxe or ipxe.efi
   -> http://192.168.2.247/menu.ipxe
 ```
 
-The same scripts are also exposed under `/boot/` for compatibility with older
-checks and any DHCP option that already points there.
-
 The generated menu currently exposes entries for:
 
 - NixOS installer
@@ -46,8 +51,9 @@ The generated menu currently exposes entries for:
 - Reboot
 
 Kernel and initrd artifacts for installer or rescue entries must be placed under
-the matching `/srv/pxe/<entry>/` directories by an operator or a separate build
-process. This repository defines the service and menu, not the installer images.
+the matching `/srv/pxe/http/<entry>/` directories by an operator or a separate
+build process. This repository defines the service and menu, not the installer
+images.
 
 ## Validation
 
@@ -62,10 +68,6 @@ After deployment by an operator, basic service checks are:
 ```bash
 curl http://pxe-boot/boot.ipxe
 curl http://pxe-boot/menu.ipxe
-curl http://pxe-boot/boot/menu.ipxe
-curl http://pxe-boot/boot/autoexec.ipxe
-curl -I http://pxe-boot/boot/ipxe.efi
-curl -I http://pxe-boot/boot/undionly.kpxe
 ```
 
 During a successful BIOS chainload, TFTP should deliver `undionly.kpxe` once,
diff --git a/hosts/pxe-boot/configuration.nix b/hosts/pxe-boot/configuration.nix
index 46d9071..4c17ac0 100644
--- a/hosts/pxe-boot/configuration.nix
+++ b/hosts/pxe-boot/configuration.nix
@@ -2,6 +2,8 @@
 
 let
   pxeRoot = "/srv/pxe";
+  httpRoot = "${pxeRoot}/http";
+  tftpRoot = "${pxeRoot}/tftp";
   pxeBaseUrl = "http://192.168.2.247";
 
   bootIpxe = pkgs.writeText "boot.ipxe" ''
@@ -68,7 +70,7 @@ in
 
     virtualHosts."pxe-boot" = {
       default = true;
-      root = pxeRoot;
+      root = httpRoot;
       locations."/" = {
         extraConfig = ''
           autoindex on;
@@ -78,10 +80,10 @@ in
   };
 
   # TFTP is only used to deliver the initial iPXE bootloader. After iPXE
-  # starts, all further assets are fetched via nginx over HTTP from /srv/pxe.
+  # starts, all further assets are fetched via nginx over HTTP.
   services.atftpd = {
     enable = true;
-    root = "${pxeRoot}/boot";
+    root = tftpRoot;
     extraOptions = [
       "--verbose=5"
     ];
@@ -89,17 +91,17 @@ in
 
   systemd.tmpfiles.rules = [
     "d ${pxeRoot} 0755 root root -"
-    "d ${pxeRoot}/boot 0755 root root -"
-    "d ${pxeRoot}/nixos 0755 root root -"
-    "d ${pxeRoot}/ubuntu 0755 root root -"
-    "d ${pxeRoot}/rescue 0755 root root -"
-    "C+ ${pxeRoot}/boot.ipxe 0644 root root - ${bootIpxe}"
-    "C+ ${pxeRoot}/menu.ipxe 0644 root root - ${menuIpxe}"
-    "C+ ${pxeRoot}/boot/autoexec.ipxe 0644 root root - ${autoexecIpxe}"
-    "C+ ${pxeRoot}/boot/boot.ipxe 0644 root root - ${bootIpxe}"
-    "C+ ${pxeRoot}/boot/menu.ipxe 0644 root root - ${menuIpxe}"
-    "C+ ${pxeRoot}/boot/ipxe.efi 0644 root root - ${pkgs.ipxe}/ipxe.efi"
-    "C+ ${pxeRoot}/boot/undionly.kpxe 0644 root root - ${pkgs.ipxe}/undionly.kpxe"
+    "d ${httpRoot} 0755 root root -"
+    "d ${httpRoot}/images 0755 root root -"
+    "d ${httpRoot}/nixos 0755 root root -"
+    "d ${httpRoot}/ubuntu 0755 root root -"
+    "d ${httpRoot}/rescue 0755 root root -"
+    "d ${tftpRoot} 0755 root root -"
+    "C+ ${httpRoot}/boot.ipxe 0644 root root - ${bootIpxe}"
+    "C+ ${httpRoot}/menu.ipxe 0644 root root - ${menuIpxe}"
+    "C+ ${tftpRoot}/autoexec.ipxe 0644 root root - ${autoexecIpxe}"
+    "C+ ${tftpRoot}/ipxe.efi 0644 root root - ${pkgs.ipxe}/ipxe.efi"
+    "C+ ${tftpRoot}/undionly.kpxe 0644 root root - ${pkgs.ipxe}/undionly.kpxe"
   ];
 
   services.openssh.settings.PermitRootLogin = "yes";