diff --git a/hosts/pxe-boot/configuration.nix b/hosts/pxe-boot/configuration.nix
index dee9a7c..f4927b9 100644
--- a/hosts/pxe-boot/configuration.nix
+++ b/hosts/pxe-boot/configuration.nix
@@ -62,6 +62,16 @@ in
     };
   };
 
+  # TFTP is only used to deliver the initial iPXE bootloader. After iPXE
+  # starts, all further assets are fetched via nginx over HTTP from /srv/pxe.
+  services.atftpd = {
+    enable = true;
+    root = "${pxeRoot}/boot";
+    extraOptions = [
+      "--verbose=5"
+    ];
+  };
+
   systemd.tmpfiles.rules = [
     "d ${pxeRoot} 0755 root root -"
     "d ${pxeRoot}/boot 0755 root root -"
@@ -76,6 +86,7 @@ in
   services.openssh.settings.PermitRootLogin = "yes";
 
   networking.firewall.allowedTCPPorts = [ 80 ];
+  networking.firewall.allowedUDPPorts = [ 69 ];
 
   system.stateVersion = "25.05";
 }