diff --git a/modules/pxe-boot/mount-pxe-images.nix b/modules/pxe-boot/mount-pxe-images.nix
index 853ab08..656562f 100644
--- a/modules/pxe-boot/mount-pxe-images.nix
+++ b/modules/pxe-boot/mount-pxe-images.nix
@@ -1,24 +1,42 @@
-{ config, vars, ... }:
+{ config, lib, vars, ... }:
 
 let
   # Use the same FQDN approach as docker/mount-data.nix — a bare hostname is
   # unreliable: systemd-resolved only tries LLMNR for single-label names, and
   # a global search domain causes it to skip the interface-scoped LAN DNS.
   nfsServer = "${vars.nfsServerHost}.${vars.homeDomain}";
-
-  # x-systemd.automount is unsupported inside LXC containers (systemd logs
-  # "Starting of <unit>.automount unsupported" and never mounts). Use nofail
-  # there so a boot with the NFS server unreachable doesn't hang instead.
-  automountOpts = if config.boot.isContainer then [ "nofail" ] else [ "x-systemd.automount" ];
 in
 {
   fileSystems.${vars.nfsShares.proxmoxPxeImages.mountpoint} = {
     device = "${nfsServer}:${vars.storageRoot}/${vars.nfsShares.proxmoxPxeImages.subpath}";
     fsType = "nfs";
     options = [
-      "nfsvers=4.2"
       "_netdev"
       "noatime"
-    ] ++ automountOpts;
+    ] ++ (if config.boot.isContainer
+    # NFSv4 requires rpc_pipefs (sunrpc filesystem), which Proxmox LXC
+    # containers block unless `features: mount=nfs` is set. Use NFSv3+nolock
+    # instead: no rpc_pipefs dependency at the protocol level, and rpcbind
+    # on the server handles port resolution without needing client-side
+    # sunrpc infrastructure. nofail keeps boot clean if server is unreachable.
+    then [ "nfsvers=3" "proto=tcp" "nolock" "nofail" ]
+    else [ "nfsvers=4.2" "x-systemd.automount" ]);
+  };
+
+  # NixOS pulls var-lib-nfs-rpc_pipefs.mount (the sunrpc filesystem) into
+  # nfs-client.target for any nfs fileSystems entry. In LXC containers the
+  # sunrpc mount is blocked by Proxmox's AppArmor profile, causing it to fail
+  # and the activation to report an error even though our mount uses nofail.
+  # Add ConditionVirtualization=!container via drop-in so systemd skips the
+  # unit entirely in containers (skip = inactive, not failed), which keeps
+  # nfs-client.target green and activation clean.
+  systemd.units = lib.mkIf config.boot.isContainer {
+    "var-lib-nfs-rpc_pipefs.mount" = {
+      overrideStrategy = "asDropin";
+      text = ''
+        [Unit]
+        ConditionVirtualization=!container
+      '';
+    };
   };
 }