diff --git a/docs/pxe-boot.md b/docs/pxe-boot.md
index 08df36a..b852522 100644
--- a/docs/pxe-boot.md
+++ b/docs/pxe-boot.md
@@ -52,8 +52,15 @@ The generated menu currently exposes entries for:
 - iPXE shell
 - Reboot
 
-Kernel and initrd artifacts for the NixOS installer entry must be placed under
-`/srv/pxe/http/nixos` by an operator or a separate build process.
+The NixOS installer entry chain-loads `/srv/pxe/http/nixos/netboot.ipxe`,
+which is nixpkgs' own generated netboot iPXE script (correct `init=`/`initrd=`
+kernel parameters included) rather than a hand-rolled boot line — that script
+in turn expects its kernel/initrd siblings in the same directory. All three
+files (`bzImage`, `initrd`, `netboot.ipxe`) are built from this flake's own
+`modules/installer/iso.nix` netboot image (the same one `nix build .#pxe`
+produces) and staged automatically by
+`modules/pxe-boot/stage-installer-artifacts.nix` via `systemd.tmpfiles.rules`
+— no manual operator step required.
 
 The SystemRescue entry expects the source ISO at:
 
diff --git a/flake.nix b/flake.nix
index 9a08cdb..9548ef7 100644
--- a/flake.nix
+++ b/flake.nix
@@ -56,7 +56,7 @@
             ./modules/nix-cache/client.nix
             ./modules/nix-cache/remote-builder-client.nix
           ];
-          specialArgs = { inherit inputs vars; };
+          specialArgs = { inherit inputs vars netbootSystem; };
         };
 
       # Generated platform x build-type matrix. pxe-boot has no linode
diff --git a/modules/build-types/pxe-boot.nix b/modules/build-types/pxe-boot.nix
index b8735c3..e31deae 100644
--- a/modules/build-types/pxe-boot.nix
+++ b/modules/build-types/pxe-boot.nix
@@ -76,9 +76,7 @@ let
     choose target && goto ''${target}
 
     :nixos
-    kernel ''${base}/nixos/bzImage ip=dhcp
-    initrd ''${base}/nixos/initrd
-    boot
+    chain ''${base}/nixos/netboot.ipxe
 
     :rescue
     chain ''${base}/systemrescue.ipxe
@@ -91,6 +89,10 @@ let
   '';
 in
 {
+  imports = [
+    ../pxe-boot/stage-installer-artifacts.nix
+  ];
+
   environment.systemPackages = with pkgs; [
     ipxe
   ];
diff --git a/modules/pxe-boot/stage-installer-artifacts.nix b/modules/pxe-boot/stage-installer-artifacts.nix
new file mode 100644
index 0000000..4231306
--- /dev/null
+++ b/modules/pxe-boot/stage-installer-artifacts.nix
@@ -0,0 +1,23 @@
+{ netbootSystem, ... }:
+
+let
+  # config.system.build.kernel and .netbootRamdisk are directories, not the
+  # files themselves — nixpkgs' own system.build.kexecTree does the same
+  # ${...}/<file> dereference for the same reason.
+  inherit (netbootSystem.config.system.boot.loader) kernelFile;
+in
+{
+  # Builds this flake's own installer netboot image (the same one
+  # `nix build .#pxe` produces) and stages it where menu.ipxe's :nixos
+  # entry expects it, so the pxe-boot host is self-contained — no manual
+  # operator step to populate /srv/pxe/http/nixos after deploy.
+  systemd.tmpfiles.rules = [
+    # Declared here too (not just in build-types/pxe-boot.nix) so this
+    # module's C+ rules don't depend on cross-module list-merge ordering —
+    # tmpfiles' C type needs the target directory to already exist.
+    "d /srv/pxe/http/nixos 0755 root root -"
+    "C+ /srv/pxe/http/nixos/${kernelFile} 0644 root root - ${netbootSystem.config.system.build.kernel}/${kernelFile}"
+    "C+ /srv/pxe/http/nixos/initrd 0644 root root - ${netbootSystem.config.system.build.netbootRamdisk}/initrd"
+    "C+ /srv/pxe/http/nixos/netboot.ipxe 0644 root root - ${netbootSystem.config.system.build.netbootIpxeScript}/netboot.ipxe"
+  ];
+}
diff --git a/variables.nix b/variables.nix
index eb8ea29..919027c 100644
--- a/variables.nix
+++ b/variables.nix
@@ -23,6 +23,7 @@
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKKKzoEPl/ZW9KBRHBcp6/ThOngGpwMv5EhkTlgC4aDf root@nixos"
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIGtOWOCS+ImHc7NehguoyD7PbonGosKMZqc9+QR3v/h root@nixos"
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHxXTQxFnArK5HXG7czeoybZebCGfxpUdusJkPn+BCSp root@server"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMJhrfFayLBG+gWtO6oAvgambw5nWWgztiTFEaaaVRH debian@surface"
   ];
 
   # Admin SSH public key, authorized on the primary user of every host and