diff --git a/modules/platforms/lxc.nix b/modules/platforms/lxc.nix
index d9c37a7..fb73b4f 100644
--- a/modules/platforms/lxc.nix
+++ b/modules/platforms/lxc.nix
@@ -63,9 +63,9 @@ in
     # back to decide `pct create`'s --unprivileged flag, so the two stay
     # in sync).
     #
-    # lxc-docker is the one exception: the kernel's NFS client doesn't set
-    # FS_USERNS_MOUNT, so mounting NFS from inside *any* non-init user
-    # namespace -- which is exactly what an unprivileged container's
+    # lxc-docker and lxc-pxe-boot are the exceptions: the kernel's NFS client
+    # doesn't set FS_USERNS_MOUNT, so mounting NFS from inside *any* non-init
+    # user namespace -- which is exactly what an unprivileged container's
     # UID-mapped root runs in -- is rejected at the VFS layer with EPERM,
     # no matter what Proxmox's own `mount=nfs;nfs4` container feature
     # allows at the AppArmor layer (confirmed live: TCP to the NFS server
@@ -73,13 +73,15 @@ in
     # `mount.nfs: Operation not permitted` still fires immediately with no
     # corresponding denial anywhere in the server's logs -- a kernel-level
     # rejection, not a network or export-permission one). Keying off
-    # hostName rather than something docker-build-type-specific because
-    # modules/build-types/docker.nix is also composed for linode-docker/
-    # proxmox-docker, which don't import proxmox-lxc.nix at all --setting
-    # this option there would break their eval with "option does not
-    # exist" regardless of any mkIf guard, since mkIf only makes a value
-    # conditional, not whether the option needs to exist somewhere.
-    privileged = config.networking.hostName == "docker";
+    # hostName rather than something build-type-specific because
+    # modules/build-types/{docker,pxe-boot}.nix are also composed for
+    # linode-docker/proxmox-docker/proxmox-pxe-boot, which don't import
+    # proxmox-lxc.nix at all -- setting this option there would break their
+    # eval with "option does not exist" regardless of any mkIf guard, since
+    # mkIf only makes a value conditional, not whether the option needs to
+    # exist somewhere.
+    privileged = config.networking.hostName == "docker"
+      || config.networking.hostName == "pxe-boot";
   };
 
   boot.loader = {