diff --git a/.github/workflows/mkosi.yml b/.github/workflows/mkosi.yml
index 2acde48fb4f..21dcb6ff03b 100644
--- a/.github/workflows/mkosi.yml
+++ b/.github/workflows/mkosi.yml
@@ -92,7 +92,7 @@ jobs:
 
     steps:
     - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
-    - uses: systemd/mkosi@9f280901d5ba81ce63072e0892649c27d41dd169
+    - uses: systemd/mkosi@e5706bd0761107bda96763191950c4198e0ccb27
 
     # Freeing up disk space with rm -rf can take multiple minutes. Since we don't need the extra free space
     # immediately, we remove the files in the background. However, we first move them to a different location
diff --git a/docs/HACKING.md b/docs/HACKING.md
index e05f029d909..5b1e3553277 100644
--- a/docs/HACKING.md
+++ b/docs/HACKING.md
@@ -52,7 +52,7 @@ image all the time when iterating on a patch, add the following to
 
 ```conf
 [Host]
-@RuntimeBuildSources=yes
+RuntimeBuildSources=yes
 ```
 
 After enabling this setting, the source and build directories will be mounted to
diff --git a/mkosi.images/system/mkosi.clean b/mkosi.clean
similarity index 100%
rename from mkosi.images/system/mkosi.clean
rename to mkosi.clean
diff --git a/mkosi.conf b/mkosi.conf
index 38d6e8331a2..c90f5bfc774 100644
--- a/mkosi.conf
+++ b/mkosi.conf
@@ -1,17 +1,28 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 
 [Config]
-@Images=system
 MinimumVersion=23~devel
+InitrdInclude=mkosi.initrd/
 
 [Output]
-@OutputDirectory=build/mkosi.output
-@BuildDirectory=build/mkosi.builddir
-@CacheDirectory=build/mkosi.cache
+RepartDirectories=mkosi.repart
+OutputDirectory=build/mkosi.output
+BuildDirectory=build/mkosi.builddir
+CacheDirectory=build/mkosi.cache
 
 [Content]
-@SELinuxRelabel=no
+SELinuxRelabel=no
 BuildSourcesEphemeral=yes
+Autologin=yes
+
+PostInstallationScripts=mkosi.sanitizers.chroot
+ExtraTrees=
+        mkosi.crt:/usr/lib/verity.d/mkosi.crt # sysext verification key
+        mkosi.leak-sanitizer-suppressions:/usr/lib/systemd/leak-sanitizer-suppressions
+        mkosi.coredump-journal-storage.conf:/usr/lib/systemd/coredump.conf.d/10-coredump-journal-storage.conf
+
+Environment=
+        SYSTEMD_REPART_OVERRIDE_FSTYPE_ROOT=%F
 
 # Adding more kernel command line arguments is likely to hit the kernel command line limit (512 bytes) in
 # various scenarios. Consider adding support for a credential instead if possible and using that.
@@ -43,13 +54,85 @@ KernelCommandLine=systemd.crash_shell
 KernelModulesInitrdExclude=.*
 KernelModulesInitrdInclude=default
 
+ExtraTrees=
+        %O/minimal-0.root-%a.raw:/usr/share/minimal_0.raw
+        %O/minimal-0.root-%a-verity.raw:/usr/share/minimal_0.verity
+        %O/minimal-0.root-%a-verity-sig.raw:/usr/share/minimal_0.verity.sig
+        %O/minimal-1.root-%a.raw:/usr/share/minimal_1.raw
+        %O/minimal-1.root-%a-verity.raw:/usr/share/minimal_1.verity
+        %O/minimal-1.root-%a-verity-sig.raw:/usr/share/minimal_1.verity.sig
+        %O/minimal-base:/usr/share/TEST-13-NSPAWN-container-template
+        %O/exitrd:/exitrd
+
+InitrdPackages=
+        btrfs-progs
+        findutils
+        grep
+        sed
+
+Packages=
+        acl
+        attr
+        bash-completion
+        bpftrace
+        btrfs-progs
+        clang
+        coreutils
+        curl
+        diffutils
+        dnsmasq
+        dosfstools
+        e2fsprogs
+        findutils
+        gdb
+        grep
+        gzip
+        jq
+        kbd
+        kexec-tools
+        kmod
+        knot
+        less
+        lld
+        llvm
+        lvm2
+        man
+        mdadm
+        mtools
+        nano
+        nftables
+        nvme-cli
+        opensc
+        openssl
+        p11-kit
+        pciutils
+        python3
+        qrencode
+        radvd
+        rsync
+        sed
+        socat
+        strace
+        systemd
+        tar
+        tmux
+        tree
+        udev
+        util-linux
+        valgrind
+        which
+        wireguard-tools
+        xfsprogs
+        zsh
+        zstd
+
 [Host]
 Credentials=journal.storage=persistent
-@Incremental=yes
-@RuntimeBuildSources=yes
-@RuntimeScratch=no
-@QemuSmp=2
-@QemuSwtpm=yes
-@QemuVsock=yes
-@QemuKvm=yes
+Incremental=yes
+RuntimeBuildSources=yes
+RuntimeScratch=no
+QemuSmp=2
+QemuSwtpm=yes
+QemuVsock=yes
+QemuKvm=yes
 ToolsTreePackages=virtiofsd
diff --git a/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.build.chroot b/mkosi.conf.d/10-arch/mkosi.build.chroot
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/10-arch/mkosi.build.chroot
rename to mkosi.conf.d/10-arch/mkosi.build.chroot
diff --git a/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.conf b/mkosi.conf.d/10-arch/mkosi.conf
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/10-arch/mkosi.conf
rename to mkosi.conf.d/10-arch/mkosi.conf
diff --git a/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.conf.d/10-debug.conf b/mkosi.conf.d/10-arch/mkosi.conf.d/10-debug.conf
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/10-arch/mkosi.conf.d/10-debug.conf
rename to mkosi.conf.d/10-arch/mkosi.conf.d/10-debug.conf
diff --git a/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.prepare b/mkosi.conf.d/10-arch/mkosi.prepare
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/10-arch/mkosi.prepare
rename to mkosi.conf.d/10-arch/mkosi.prepare
diff --git a/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.build.chroot b/mkosi.conf.d/10-centos-fedora/mkosi.build.chroot
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.build.chroot
rename to mkosi.conf.d/10-centos-fedora/mkosi.build.chroot
diff --git a/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf b/mkosi.conf.d/10-centos-fedora/mkosi.conf
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf
rename to mkosi.conf.d/10-centos-fedora/mkosi.conf
diff --git a/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf.d/10-debug.conf b/mkosi.conf.d/10-centos-fedora/mkosi.conf.d/10-debug.conf
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf.d/10-debug.conf
rename to mkosi.conf.d/10-centos-fedora/mkosi.conf.d/10-debug.conf
diff --git a/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf.d/10-selinux.conf b/mkosi.conf.d/10-centos-fedora/mkosi.conf.d/10-selinux.conf
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf.d/10-selinux.conf
rename to mkosi.conf.d/10-centos-fedora/mkosi.conf.d/10-selinux.conf
diff --git a/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.prepare b/mkosi.conf.d/10-centos-fedora/mkosi.prepare
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.prepare
rename to mkosi.conf.d/10-centos-fedora/mkosi.prepare
diff --git a/mkosi.conf.d/10-centos.conf b/mkosi.conf.d/10-centos.conf
deleted file mode 100644
index ee8d0e5581e..00000000000
--- a/mkosi.conf.d/10-centos.conf
+++ /dev/null
@@ -1,11 +0,0 @@
-# SPDX-License-Identifier: LGPL-2.1-or-later
-
-[Match]
-Distribution=centos
-
-[Distribution]
-@Release=9
-Repositories=epel
-             epel-next
-             hyperscale-packages-main
-             hyperscale-packages-experimental
diff --git a/mkosi.images/system/mkosi.conf.d/10-centos/mkosi.conf b/mkosi.conf.d/10-centos/mkosi.conf
similarity index 84%
rename from mkosi.images/system/mkosi.conf.d/10-centos/mkosi.conf
rename to mkosi.conf.d/10-centos/mkosi.conf
index 121257e8e53..66aa0611d68 100644
--- a/mkosi.images/system/mkosi.conf.d/10-centos/mkosi.conf
+++ b/mkosi.conf.d/10-centos/mkosi.conf
@@ -3,6 +3,13 @@
 [Match]
 Distribution=centos
 
+[Distribution]
+Release=9
+Repositories=epel
+             epel-next
+             hyperscale-packages-main
+             hyperscale-packages-experimental
+
 [Content]
 Environment=
         Environment=
diff --git a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi-pinning.pref b/mkosi.conf.d/10-debian-ubuntu/mkosi-pinning.pref
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi-pinning.pref
rename to mkosi.conf.d/10-debian-ubuntu/mkosi-pinning.pref
diff --git a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.build.chroot b/mkosi.conf.d/10-debian-ubuntu/mkosi.build.chroot
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.build.chroot
rename to mkosi.conf.d/10-debian-ubuntu/mkosi.build.chroot
diff --git a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf b/mkosi.conf.d/10-debian-ubuntu/mkosi.conf
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf
rename to mkosi.conf.d/10-debian-ubuntu/mkosi.conf
index 654ca91bab8..5f9e3843e36 100644
--- a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf
+++ b/mkosi.conf.d/10-debian-ubuntu/mkosi.conf
@@ -4,6 +4,9 @@
 Distribution=|debian
 Distribution=|ubuntu
 
+[Distribution]
+PackageManagerTrees=mkosi-pinning.pref:/etc/apt/preferences.d/mkosi-pinning.pref
+
 [Content]
 Environment=
         GIT_URL=https://salsa.debian.org/systemd-team/systemd.git
@@ -11,9 +14,6 @@ Environment=
         GIT_BRANCH=debian/master
         GIT_COMMIT=abf24e775c67cf054f474526dd5d9d952a00228b
 
-[Distribution]
-PackageManagerTrees=mkosi-pinning.pref:/etc/apt/preferences.d/mkosi-pinning.pref
-
 VolatilePackages=
         libnss-myhostname
         libnss-mymachines
diff --git a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf.d/10-debug.conf b/mkosi.conf.d/10-debian-ubuntu/mkosi.conf.d/10-debug.conf
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf.d/10-debug.conf
rename to mkosi.conf.d/10-debian-ubuntu/mkosi.conf.d/10-debug.conf
diff --git a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf.d/efi.conf b/mkosi.conf.d/10-debian-ubuntu/mkosi.conf.d/efi.conf
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf.d/efi.conf
rename to mkosi.conf.d/10-debian-ubuntu/mkosi.conf.d/efi.conf
diff --git a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf.d/network.conf b/mkosi.conf.d/10-debian-ubuntu/mkosi.conf.d/network.conf
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf.d/network.conf
rename to mkosi.conf.d/10-debian-ubuntu/mkosi.conf.d/network.conf
diff --git a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.postinst b/mkosi.conf.d/10-debian-ubuntu/mkosi.postinst
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.postinst
rename to mkosi.conf.d/10-debian-ubuntu/mkosi.postinst
diff --git a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.prepare b/mkosi.conf.d/10-debian-ubuntu/mkosi.prepare
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.prepare
rename to mkosi.conf.d/10-debian-ubuntu/mkosi.prepare
diff --git a/mkosi.conf.d/10-debian.conf b/mkosi.conf.d/10-debian.conf
deleted file mode 100644
index 8674e884fad..00000000000
--- a/mkosi.conf.d/10-debian.conf
+++ /dev/null
@@ -1,7 +0,0 @@
-# SPDX-License-Identifier: LGPL-2.1-or-later
-
-[Match]
-Distribution=debian
-
-[Distribution]
-@Release=testing
diff --git a/mkosi.images/system/mkosi.conf.d/10-debian/mkosi.conf b/mkosi.conf.d/10-debian/mkosi.conf
similarity index 78%
rename from mkosi.images/system/mkosi.conf.d/10-debian/mkosi.conf
rename to mkosi.conf.d/10-debian/mkosi.conf
index 50dfa11db42..c960a1b2ecd 100644
--- a/mkosi.images/system/mkosi.conf.d/10-debian/mkosi.conf
+++ b/mkosi.conf.d/10-debian/mkosi.conf
@@ -3,6 +3,9 @@
 [Match]
 Distribution=debian
 
+[Distribution]
+Release=testing
+
 [Content]
 Packages=
         linux-perf
diff --git a/mkosi.images/system/mkosi.conf.d/10-debian/mkosi.conf.d/arm64.conf b/mkosi.conf.d/10-debian/mkosi.conf.d/arm64.conf
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/10-debian/mkosi.conf.d/arm64.conf
rename to mkosi.conf.d/10-debian/mkosi.conf.d/arm64.conf
diff --git a/mkosi.images/system/mkosi.conf.d/10-debian/mkosi.conf.d/x86-64.conf b/mkosi.conf.d/10-debian/mkosi.conf.d/x86-64.conf
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/10-debian/mkosi.conf.d/x86-64.conf
rename to mkosi.conf.d/10-debian/mkosi.conf.d/x86-64.conf
diff --git a/mkosi.conf.d/10-fedora.conf b/mkosi.conf.d/10-fedora.conf
deleted file mode 100644
index 71948d8c0d3..00000000000
--- a/mkosi.conf.d/10-fedora.conf
+++ /dev/null
@@ -1,7 +0,0 @@
-# SPDX-License-Identifier: LGPL-2.1-or-later
-
-[Match]
-Distribution=fedora
-
-[Distribution]
-@Release=rawhide
diff --git a/mkosi.images/system/mkosi.conf.d/10-fedora/mkosi.conf b/mkosi.conf.d/10-fedora/mkosi.conf
similarity index 93%
rename from mkosi.images/system/mkosi.conf.d/10-fedora/mkosi.conf
rename to mkosi.conf.d/10-fedora/mkosi.conf
index c4617d26fe8..b9f310d3c17 100644
--- a/mkosi.images/system/mkosi.conf.d/10-fedora/mkosi.conf
+++ b/mkosi.conf.d/10-fedora/mkosi.conf
@@ -3,6 +3,9 @@
 [Match]
 Distribution=fedora
 
+[Distribution]
+Release=rawhide
+
 [Content]
 Environment=
         GIT_URL=https://src.fedoraproject.org/rpms/systemd.git
diff --git a/mkosi.conf.d/10-opensuse.conf b/mkosi.conf.d/10-opensuse.conf
deleted file mode 100644
index f976fc80435..00000000000
--- a/mkosi.conf.d/10-opensuse.conf
+++ /dev/null
@@ -1,8 +0,0 @@
-# SPDX-License-Identifier: LGPL-2.1-or-later
-
-[Match]
-Distribution=opensuse
-
-[Distribution]
-@Release=tumbleweed
-PackageManagerTrees=mkosi.conf.d/macros.db_backend:/etc/rpm/macros.db_backend
diff --git a/mkosi.images/system/mkosi.conf.d/10-opensuse/initrd/mkosi.postinst b/mkosi.conf.d/10-opensuse/initrd/mkosi.postinst
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/10-opensuse/initrd/mkosi.postinst
rename to mkosi.conf.d/10-opensuse/initrd/mkosi.postinst
diff --git a/mkosi.conf.d/macros.db_backend b/mkosi.conf.d/10-opensuse/macros.db_backend
similarity index 100%
rename from mkosi.conf.d/macros.db_backend
rename to mkosi.conf.d/10-opensuse/macros.db_backend
diff --git a/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.build.chroot b/mkosi.conf.d/10-opensuse/mkosi.build.chroot
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.build.chroot
rename to mkosi.conf.d/10-opensuse/mkosi.build.chroot
diff --git a/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.conf b/mkosi.conf.d/10-opensuse/mkosi.conf
similarity index 95%
rename from mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.conf
rename to mkosi.conf.d/10-opensuse/mkosi.conf
index e488b2dd4be..c5a014f70bf 100644
--- a/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.conf
+++ b/mkosi.conf.d/10-opensuse/mkosi.conf
@@ -6,6 +6,10 @@ Distribution=opensuse
 [Config]
 InitrdInclude=initrd/
 
+[Distribution]
+Release=tumbleweed
+PackageManagerTrees=macros.db_backend:/etc/rpm/macros.db_backend
+
 [Content]
 Environment=
         GIT_URL=https://src.opensuse.org/rpm/systemd
diff --git a/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.conf.d/10-debug.conf b/mkosi.conf.d/10-opensuse/mkosi.conf.d/10-debug.conf
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.conf.d/10-debug.conf
rename to mkosi.conf.d/10-opensuse/mkosi.conf.d/10-debug.conf
diff --git a/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.prepare b/mkosi.conf.d/10-opensuse/mkosi.prepare
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.prepare
rename to mkosi.conf.d/10-opensuse/mkosi.prepare
diff --git a/mkosi.conf.d/10-ubuntu.conf b/mkosi.conf.d/10-ubuntu.conf
deleted file mode 100644
index da2d318295e..00000000000
--- a/mkosi.conf.d/10-ubuntu.conf
+++ /dev/null
@@ -1,8 +0,0 @@
-# SPDX-License-Identifier: LGPL-2.1-or-later
-
-[Match]
-Distribution=ubuntu
-
-[Distribution]
-@Release=noble
-Repositories=universe
diff --git a/mkosi.images/system/mkosi.conf.d/10-ubuntu/mkosi.conf b/mkosi.conf.d/10-ubuntu/mkosi.conf
similarity index 77%
rename from mkosi.images/system/mkosi.conf.d/10-ubuntu/mkosi.conf
rename to mkosi.conf.d/10-ubuntu/mkosi.conf
index 86f9736ed97..1ffa3ab0318 100644
--- a/mkosi.images/system/mkosi.conf.d/10-ubuntu/mkosi.conf
+++ b/mkosi.conf.d/10-ubuntu/mkosi.conf
@@ -3,6 +3,10 @@
 [Match]
 Distribution=ubuntu
 
+[Distribution]
+Release=noble
+Repositories=universe
+
 [Content]
 Packages=
         linux-image-generic
diff --git a/mkosi.images/system/mkosi.conf.d/10-ubuntu/mkosi.conf.d/non-x86.conf b/mkosi.conf.d/10-ubuntu/mkosi.conf.d/non-x86.conf
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/10-ubuntu/mkosi.conf.d/non-x86.conf
rename to mkosi.conf.d/10-ubuntu/mkosi.conf.d/non-x86.conf
diff --git a/mkosi.images/system/mkosi.conf.d/10-ubuntu/mkosi.conf.d/x86.conf b/mkosi.conf.d/10-ubuntu/mkosi.conf.d/x86.conf
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/10-ubuntu/mkosi.conf.d/x86.conf
rename to mkosi.conf.d/10-ubuntu/mkosi.conf.d/x86.conf
diff --git a/mkosi.images/system/mkosi.conf.d/10-ubuntu/noble-backports-ports.sources b/mkosi.conf.d/10-ubuntu/noble-backports-ports.sources
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/10-ubuntu/noble-backports-ports.sources
rename to mkosi.conf.d/10-ubuntu/noble-backports-ports.sources
diff --git a/mkosi.images/system/mkosi.conf.d/10-ubuntu/noble-backports.sources b/mkosi.conf.d/10-ubuntu/noble-backports.sources
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/10-ubuntu/noble-backports.sources
rename to mkosi.conf.d/10-ubuntu/noble-backports.sources
diff --git a/mkosi.conf.d/20-none.conf b/mkosi.conf.d/20-none.conf
new file mode 100644
index 00000000000..57a2f3f0e37
--- /dev/null
+++ b/mkosi.conf.d/20-none.conf
@@ -0,0 +1,9 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+# If we're only rerunning the build script, remove all subimage dependencies to speed up builds.
+
+[Match]
+Format=none
+
+[Config]
+Dependencies=
diff --git a/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.conf b/mkosi.conf.d/20-particle/mkosi.conf
similarity index 74%
rename from mkosi.images/system/mkosi.conf.d/20-particle/mkosi.conf
rename to mkosi.conf.d/20-particle/mkosi.conf
index 8c1920b0ce4..99dad00f5af 100644
--- a/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.conf
+++ b/mkosi.conf.d/20-particle/mkosi.conf
@@ -8,8 +8,8 @@ RepartDirectories=
 RepartDirectories=mkosi.repart
 
 [Validation]
-@SecureBoot=yes
-@SignExpectedPcr=yes
+SecureBoot=yes
+SignExpectedPcr=yes
 
 [Host]
-@RuntimeSize=8G
+RuntimeSize=8G
diff --git a/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.extra/usr/lib/repart.d/15-swap.conf b/mkosi.conf.d/20-particle/mkosi.extra/usr/lib/repart.d/15-swap.conf
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/20-particle/mkosi.extra/usr/lib/repart.d/15-swap.conf
rename to mkosi.conf.d/20-particle/mkosi.extra/usr/lib/repart.d/15-swap.conf
diff --git a/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.extra/usr/lib/repart.d/20-root.conf b/mkosi.conf.d/20-particle/mkosi.extra/usr/lib/repart.d/20-root.conf
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/20-particle/mkosi.extra/usr/lib/repart.d/20-root.conf
rename to mkosi.conf.d/20-particle/mkosi.extra/usr/lib/repart.d/20-root.conf
diff --git a/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.extra/usr/lib/tmpfiles.d/99-mkosi.conf b/mkosi.conf.d/20-particle/mkosi.extra/usr/lib/tmpfiles.d/99-mkosi.conf
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/20-particle/mkosi.extra/usr/lib/tmpfiles.d/99-mkosi.conf
rename to mkosi.conf.d/20-particle/mkosi.extra/usr/lib/tmpfiles.d/99-mkosi.conf
diff --git a/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.finalize b/mkosi.conf.d/20-particle/mkosi.finalize
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/20-particle/mkosi.finalize
rename to mkosi.conf.d/20-particle/mkosi.finalize
diff --git a/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.postinst.chroot b/mkosi.conf.d/20-particle/mkosi.postinst.chroot
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/20-particle/mkosi.postinst.chroot
rename to mkosi.conf.d/20-particle/mkosi.postinst.chroot
diff --git a/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.repart/00-esp.conf b/mkosi.conf.d/20-particle/mkosi.repart/00-esp.conf
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/20-particle/mkosi.repart/00-esp.conf
rename to mkosi.conf.d/20-particle/mkosi.repart/00-esp.conf
diff --git a/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.repart/10-usr.conf b/mkosi.conf.d/20-particle/mkosi.repart/10-usr.conf
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/20-particle/mkosi.repart/10-usr.conf
rename to mkosi.conf.d/20-particle/mkosi.repart/10-usr.conf
diff --git a/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.repart/11-usr-verity.conf b/mkosi.conf.d/20-particle/mkosi.repart/11-usr-verity.conf
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/20-particle/mkosi.repart/11-usr-verity.conf
rename to mkosi.conf.d/20-particle/mkosi.repart/11-usr-verity.conf
diff --git a/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.repart/12-usr-verity-sig.conf b/mkosi.conf.d/20-particle/mkosi.repart/12-usr-verity-sig.conf
similarity index 100%
rename from mkosi.images/system/mkosi.conf.d/20-particle/mkosi.repart/12-usr-verity-sig.conf
rename to mkosi.conf.d/20-particle/mkosi.repart/12-usr-verity-sig.conf
diff --git a/mkosi.images/system/coredump-journal-storage.conf b/mkosi.coredump-journal-storage.conf
similarity index 100%
rename from mkosi.images/system/coredump-journal-storage.conf
rename to mkosi.coredump-journal-storage.conf
diff --git a/mkosi.images/system/mkosi.extra/.autorelabel b/mkosi.extra/.autorelabel
similarity index 100%
rename from mkosi.images/system/mkosi.extra/.autorelabel
rename to mkosi.extra/.autorelabel
diff --git a/mkosi.images/system/mkosi.extra/etc/iscsi/iscsid.conf b/mkosi.extra/etc/iscsi/iscsid.conf
similarity index 100%
rename from mkosi.images/system/mkosi.extra/etc/iscsi/iscsid.conf
rename to mkosi.extra/etc/iscsi/iscsid.conf
diff --git a/mkosi.images/system/mkosi.extra/etc/issue b/mkosi.extra/etc/issue
similarity index 100%
rename from mkosi.images/system/mkosi.extra/etc/issue
rename to mkosi.extra/etc/issue
diff --git a/mkosi.images/system/mkosi.extra/usr/lib/sysctl.d/99-apparmor-unpriv-userns.conf b/mkosi.extra/usr/lib/sysctl.d/99-apparmor-unpriv-userns.conf
similarity index 100%
rename from mkosi.images/system/mkosi.extra/usr/lib/sysctl.d/99-apparmor-unpriv-userns.conf
rename to mkosi.extra/usr/lib/sysctl.d/99-apparmor-unpriv-userns.conf
diff --git a/mkosi.images/system/mkosi.extra/usr/lib/systemd/journald.conf.d/ratelimit.conf b/mkosi.extra/usr/lib/systemd/journald.conf.d/ratelimit.conf
similarity index 100%
rename from mkosi.images/system/mkosi.extra/usr/lib/systemd/journald.conf.d/ratelimit.conf
rename to mkosi.extra/usr/lib/systemd/journald.conf.d/ratelimit.conf
diff --git a/mkosi.images/system/mkosi.extra/usr/lib/systemd/system-preset/00-mkosi.preset b/mkosi.extra/usr/lib/systemd/system-preset/00-mkosi.preset
similarity index 100%
rename from mkosi.images/system/mkosi.extra/usr/lib/systemd/system-preset/00-mkosi.preset
rename to mkosi.extra/usr/lib/systemd/system-preset/00-mkosi.preset
diff --git a/mkosi.images/system/mkosi.extra/usr/lib/systemd/system-preset/99-mkosi.preset b/mkosi.extra/usr/lib/systemd/system-preset/99-mkosi.preset
similarity index 100%
rename from mkosi.images/system/mkosi.extra/usr/lib/systemd/system-preset/99-mkosi.preset
rename to mkosi.extra/usr/lib/systemd/system-preset/99-mkosi.preset
diff --git a/mkosi.images/system/mkosi.extra/usr/lib/systemd/system/iscsi-init.service.d/asan.conf b/mkosi.extra/usr/lib/systemd/system/iscsi-init.service.d/asan.conf
similarity index 100%
rename from mkosi.images/system/mkosi.extra/usr/lib/systemd/system/iscsi-init.service.d/asan.conf
rename to mkosi.extra/usr/lib/systemd/system/iscsi-init.service.d/asan.conf
diff --git a/mkosi.images/system/mkosi.extra/usr/lib/systemd/system/user@.service.d/99-SYSTEMD_UNIT_PATH.conf b/mkosi.extra/usr/lib/systemd/system/user@.service.d/99-SYSTEMD_UNIT_PATH.conf
similarity index 100%
rename from mkosi.images/system/mkosi.extra/usr/lib/systemd/system/user@.service.d/99-SYSTEMD_UNIT_PATH.conf
rename to mkosi.extra/usr/lib/systemd/system/user@.service.d/99-SYSTEMD_UNIT_PATH.conf
diff --git a/mkosi.images/system/mkosi.extra/usr/lib/tmpfiles.d/locale.conf b/mkosi.extra/usr/lib/tmpfiles.d/locale.conf
similarity index 100%
rename from mkosi.images/system/mkosi.extra/usr/lib/tmpfiles.d/locale.conf
rename to mkosi.extra/usr/lib/tmpfiles.d/locale.conf
diff --git a/mkosi.images/system/mkosi.extra/usr/share/dbus-1/system.d/systemd.test.ExecStopPost.conf b/mkosi.extra/usr/share/dbus-1/system.d/systemd.test.ExecStopPost.conf
similarity index 100%
rename from mkosi.images/system/mkosi.extra/usr/share/dbus-1/system.d/systemd.test.ExecStopPost.conf
rename to mkosi.extra/usr/share/dbus-1/system.d/systemd.test.ExecStopPost.conf
diff --git a/mkosi.images/exitrd/mkosi.conf b/mkosi.images/exitrd/mkosi.conf
index 2e867cbd452..3b25091759c 100644
--- a/mkosi.images/exitrd/mkosi.conf
+++ b/mkosi.images/exitrd/mkosi.conf
@@ -1,22 +1,14 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 
-[Config]
-ConfigureScripts=
-
 [Output]
 Format=directory
 
 [Content]
 Bootable=no
-@Locale=C.UTF-8
+Locale=C.UTF-8
 WithDocs=no
 CleanPackageMetadata=yes
 MakeInitrd=yes
 
-BuildSources=
-Packages=
-BuildPackages=
-VolatilePackages=
-
 Packages=
         bash
diff --git a/mkosi.images/minimal-0/mkosi.conf b/mkosi.images/minimal-0/mkosi.conf
index a929fb6eea3..6f4dfb8b99d 100644
--- a/mkosi.images/minimal-0/mkosi.conf
+++ b/mkosi.images/minimal-0/mkosi.conf
@@ -2,7 +2,6 @@
 
 [Config]
 Dependencies=minimal-base
-ConfigureScripts=
 
 [Distribution]
 CacheOnly=always
@@ -15,11 +14,3 @@ SplitArtifacts=yes
 BaseTrees=%O/minimal-base
 Environment=SYSTEMD_REPART_OVERRIDE_FSTYPE=squashfs
 Bootable=no
-
-BuildSources=
-Packages=
-BuildPackages=
-VolatilePackages=
-
-[Host]
-Incremental=no
diff --git a/mkosi.images/minimal-1/mkosi.conf b/mkosi.images/minimal-1/mkosi.conf
index a929fb6eea3..6f4dfb8b99d 100644
--- a/mkosi.images/minimal-1/mkosi.conf
+++ b/mkosi.images/minimal-1/mkosi.conf
@@ -2,7 +2,6 @@
 
 [Config]
 Dependencies=minimal-base
-ConfigureScripts=
 
 [Distribution]
 CacheOnly=always
@@ -15,11 +14,3 @@ SplitArtifacts=yes
 BaseTrees=%O/minimal-base
 Environment=SYSTEMD_REPART_OVERRIDE_FSTYPE=squashfs
 Bootable=no
-
-BuildSources=
-Packages=
-BuildPackages=
-VolatilePackages=
-
-[Host]
-Incremental=no
diff --git a/mkosi.images/minimal-base/mkosi.conf b/mkosi.images/minimal-base/mkosi.conf
index 7eb147379fe..f6deeeadfb8 100644
--- a/mkosi.images/minimal-base/mkosi.conf
+++ b/mkosi.images/minimal-base/mkosi.conf
@@ -1,22 +1,14 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 
-[Config]
-ConfigureScripts=
-
 [Output]
 Format=directory
 
 [Content]
 Bootable=no
-@Locale=C.UTF-8
+Locale=C.UTF-8
 WithDocs=no
 CleanPackageMetadata=yes
 
-BuildSources=
-Packages=
-BuildPackages=
-VolatilePackages=
-
 Packages=
         bash
         coreutils
diff --git a/mkosi.images/system/initrd/mkosi.conf b/mkosi.images/system/initrd/mkosi.conf
deleted file mode 100644
index ed9bfdc5d8c..00000000000
--- a/mkosi.images/system/initrd/mkosi.conf
+++ /dev/null
@@ -1,7 +0,0 @@
-# SPDX-License-Identifier: LGPL-2.1-or-later
-
-[Content]
-PostInstallationScripts=../mkosi.sanitizers.chroot
-ExtraTrees=
-    ../leak-sanitizer-suppressions:/usr/lib/systemd/leak-sanitizer-suppressions
-    ../coredump-journal-storage.conf:/usr/lib/systemd/coredump.conf.d/10-coredump-journal-storage.conf
diff --git a/mkosi.images/system/mkosi.conf b/mkosi.images/system/mkosi.conf
deleted file mode 100644
index bf08e756e2a..00000000000
--- a/mkosi.images/system/mkosi.conf
+++ /dev/null
@@ -1,81 +0,0 @@
-# SPDX-License-Identifier: LGPL-2.1-or-later
-
-[Config]
-InitrdInclude=initrd/
-
-[Output]
-RepartDirectories=mkosi.repart
-
-[Content]
-Autologin=yes
-ExtraTrees=
-        %D/mkosi.crt:/usr/lib/verity.d/mkosi.crt # sysext verification key
-        leak-sanitizer-suppressions:/usr/lib/systemd/leak-sanitizer-suppressions
-        coredump-journal-storage.conf:/usr/lib/systemd/coredump.conf.d/10-coredump-journal-storage.conf
-
-PostInstallationScripts=mkosi.sanitizers.chroot
-
-Environment=
-        SYSTEMD_REPART_OVERRIDE_FSTYPE_ROOT=%F
-
-InitrdPackages=
-        btrfs-progs
-        findutils
-        grep
-        sed
-
-Packages=
-        acl
-        attr
-        bash-completion
-        bpftrace
-        btrfs-progs
-        clang
-        coreutils
-        curl
-        diffutils
-        dnsmasq
-        dosfstools
-        e2fsprogs
-        findutils
-        gdb
-        grep
-        gzip
-        jq
-        kbd
-        kexec-tools
-        kmod
-        knot
-        less
-        lld
-        llvm
-        lvm2
-        man
-        mdadm
-        mtools
-        nano
-        nftables
-        nvme-cli
-        opensc
-        openssl
-        p11-kit
-        pciutils
-        python3
-        qrencode
-        radvd
-        rsync
-        sed
-        socat
-        strace
-        systemd
-        tar
-        tmux
-        tree
-        udev
-        util-linux
-        valgrind
-        which
-        wireguard-tools
-        xfsprogs
-        zsh
-        zstd
diff --git a/mkosi.images/system/mkosi.conf.d/20-images.conf b/mkosi.images/system/mkosi.conf.d/20-images.conf
deleted file mode 100644
index 8641984c7c4..00000000000
--- a/mkosi.images/system/mkosi.conf.d/20-images.conf
+++ /dev/null
@@ -1,22 +0,0 @@
-# SPDX-License-Identifier: LGPL-2.1-or-later
-
-[Match]
-Format=!none
-
-[Config]
-Dependencies=
-        exitrd
-        minimal-base
-        minimal-0
-        minimal-1
-
-[Content]
-ExtraTrees=
-        %O/minimal-0.root-%a.raw:/usr/share/minimal_0.raw
-        %O/minimal-0.root-%a-verity.raw:/usr/share/minimal_0.verity
-        %O/minimal-0.root-%a-verity-sig.raw:/usr/share/minimal_0.verity.sig
-        %O/minimal-1.root-%a.raw:/usr/share/minimal_1.raw
-        %O/minimal-1.root-%a-verity.raw:/usr/share/minimal_1.verity
-        %O/minimal-1.root-%a-verity-sig.raw:/usr/share/minimal_1.verity.sig
-        %O/minimal-base:/usr/share/TEST-13-NSPAWN-container-template
-        %O/exitrd:/exitrd
diff --git a/mkosi.initrd/mkosi.conf b/mkosi.initrd/mkosi.conf
new file mode 100644
index 00000000000..8f8cc2fbe6f
--- /dev/null
+++ b/mkosi.initrd/mkosi.conf
@@ -0,0 +1,7 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Content]
+PostInstallationScripts=../mkosi.sanitizers.chroot
+ExtraTrees=
+    ../mkosi.leak-sanitizer-suppressions:/usr/lib/systemd/leak-sanitizer-suppressions
+    ../mkosi.coredump-journal-storage.conf:/usr/lib/systemd/coredump.conf.d/10-coredump-journal-storage.conf
diff --git a/mkosi.images/system/initrd/mkosi.extra/usr/lib/encrypted-var.repart.d/00-root.conf b/mkosi.initrd/mkosi.extra/usr/lib/encrypted-var.repart.d/00-root.conf
similarity index 100%
rename from mkosi.images/system/initrd/mkosi.extra/usr/lib/encrypted-var.repart.d/00-root.conf
rename to mkosi.initrd/mkosi.extra/usr/lib/encrypted-var.repart.d/00-root.conf
diff --git a/mkosi.images/system/initrd/mkosi.extra/usr/lib/systemd/system/encrypted-var.service b/mkosi.initrd/mkosi.extra/usr/lib/systemd/system/encrypted-var.service
similarity index 100%
rename from mkosi.images/system/initrd/mkosi.extra/usr/lib/systemd/system/encrypted-var.service
rename to mkosi.initrd/mkosi.extra/usr/lib/systemd/system/encrypted-var.service
diff --git a/mkosi.images/system/initrd/mkosi.extra/usr/lib/systemd/system/initrd-run-mount.service b/mkosi.initrd/mkosi.extra/usr/lib/systemd/system/initrd-run-mount.service
similarity index 100%
rename from mkosi.images/system/initrd/mkosi.extra/usr/lib/systemd/system/initrd-run-mount.service
rename to mkosi.initrd/mkosi.extra/usr/lib/systemd/system/initrd-run-mount.service
diff --git a/mkosi.images/system/initrd/mkosi.extra/usr/lib/systemd/system/initrdcred.service b/mkosi.initrd/mkosi.extra/usr/lib/systemd/system/initrdcred.service
similarity index 100%
rename from mkosi.images/system/initrd/mkosi.extra/usr/lib/systemd/system/initrdcred.service
rename to mkosi.initrd/mkosi.extra/usr/lib/systemd/system/initrdcred.service
diff --git a/mkosi.images/system/leak-sanitizer-suppressions b/mkosi.leak-sanitizer-suppressions
similarity index 100%
rename from mkosi.images/system/leak-sanitizer-suppressions
rename to mkosi.leak-sanitizer-suppressions
diff --git a/mkosi.images/system/mkosi.postinst.chroot b/mkosi.postinst.chroot
similarity index 100%
rename from mkosi.images/system/mkosi.postinst.chroot
rename to mkosi.postinst.chroot
diff --git a/mkosi.images/system/mkosi.repart/00-esp.conf b/mkosi.repart/00-esp.conf
similarity index 100%
rename from mkosi.images/system/mkosi.repart/00-esp.conf
rename to mkosi.repart/00-esp.conf
diff --git a/mkosi.images/system/mkosi.repart/10-root.conf b/mkosi.repart/10-root.conf
similarity index 100%
rename from mkosi.images/system/mkosi.repart/10-root.conf
rename to mkosi.repart/10-root.conf
diff --git a/mkosi.images/system/mkosi.sanitizers.chroot b/mkosi.sanitizers.chroot
similarity index 100%
rename from mkosi.images/system/mkosi.sanitizers.chroot
rename to mkosi.sanitizers.chroot
diff --git a/mkosi.images/system/mkosi.sync b/mkosi.sync
similarity index 100%
rename from mkosi.images/system/mkosi.sync
rename to mkosi.sync
diff --git a/test/integration-test-wrapper.py b/test/integration-test-wrapper.py
index 743a14c3d8a..d7a622abe80 100755
--- a/test/integration-test-wrapper.py
+++ b/test/integration-test-wrapper.py
@@ -134,7 +134,6 @@ def main():
         '--runtime-network=none',
         '--runtime-scratch=no',
         *args.mkosi_args,
-        '--append',
         '--qemu-firmware', args.firmware,
         '--qemu-kvm', "auto" if not bool(int(os.getenv("TEST_NO_KVM", "0"))) else "no",
         '--kernel-command-line-extra',
@@ -184,9 +183,8 @@ def main():
                     text=True,
                 ).stdout
             )
-            images = {image["Image"]: image for image in j["Images"]}
-            distribution = images["system"]["Distribution"]
-            release = images["system"]["Release"]
+            distribution = j["Images"][-1]["Distribution"]
+            release = j["Images"][-1]["Release"]
             artifact = f"ci-mkosi-{id}-{iteration}-{distribution}-{release}-failed-test-journals"
             ops += [f"gh run download {id} --name {artifact} -D ci/{artifact}"]
             journal_file = Path(f"ci/{artifact}/test/journal/{name}.journal")