diff --git a/wfvm/autounattend.nix b/wfvm/autounattend.nix
index 13505eb..f79df37 100644
--- a/wfvm/autounattend.nix
+++ b/wfvm/autounattend.nix
@@ -13,7 +13,8 @@
 , timeZone ? "UTC"
 , services ? {}
 , impureShellCommands ? []
-, driveLetter ? "D:"
+, efi ? true
+, driveLetter ? if efi then "E:" else "D:"
 , ...
 }:
 
@@ -144,12 +145,12 @@ let
               <CreatePartitions>
                 <CreatePartition wcm:action="add">
                   <Order>1</Order>
-                  <Type>EFI</Type>
-                  <Size>100</Size>
+                  <Type>${if efi then "EFI" else "Primary"}</Type>
+                  <Size>300</Size>
                 </CreatePartition>
                 <CreatePartition wcm:action="add">
                   <Order>2</Order>
-                  <Type>MSR</Type>
+                  <Type>${if efi then "MSR" else "Primary"}</Type>
                   <Size>16</Size>
                 </CreatePartition>
                 <CreatePartition wcm:action="add">
@@ -161,7 +162,7 @@ let
               <ModifyPartitions>
                 <ModifyPartition wcm:action="add">
                   <Order>1</Order>
-                  <Format>FAT32</Format>
+                  <Format>${if efi then "FAT32" else "NTFS"}</Format>
                   <Label>System</Label>
                   <PartitionID>1</PartitionID>
                 </ModifyPartition>
diff --git a/wfvm/utils.nix b/wfvm/utils.nix
index 3b42a0a..de605ac 100644
--- a/wfvm/utils.nix
+++ b/wfvm/utils.nix
@@ -1,4 +1,4 @@
-{ pkgs, baseRtc ? "2020-04-20T14:21:42", cores ? "4", qemuMem ? "4G" }:
+{ pkgs, baseRtc ? "2020-04-20T14:21:42", cores ? "4", qemuMem ? "4G", efi ? true }:
 
 rec {
   # qemu_test is a smaller closure only building for a single system arch
@@ -10,10 +10,11 @@ rec {
     "-smp ${cores}"
     "-m ${qemuMem}"
     "-M q35"
-    "-bios ${pkgs.OVMF.fd}/FV/OVMF.fd"
     "-rtc base=${baseRtc}"
     "-device qemu-xhci"
     "-device e1000,netdev=n1"
+  ] ++ pkgs.lib.optionals efi [
+    "-bios ${pkgs.OVMF.fd}/FV/OVMF.fd"
   ] ++ extraFlags;
 
   # Pass empty config file to prevent ssh from failing to create ~/.ssh
diff --git a/wfvm/win.nix b/wfvm/win.nix
index 4cc8884..d189a3e 100644
--- a/wfvm/win.nix
+++ b/wfvm/win.nix
@@ -7,12 +7,13 @@
 , users ? {}
 # autounattend always installs index 1, so this default is backward-compatible
 , imageSelection ? "1"
+, efi ? true
 , ...
 }@attrs:
 
 let
   lib = pkgs.lib;
-  utils = import ./utils.nix { inherit pkgs; };
+  utils = import ./utils.nix { inherit pkgs efi; };
   libguestfs = pkgs.libguestfs-with-appliance;
 
   # p7zip on >20.03 has known vulns but we have no better option
@@ -85,7 +86,7 @@ let
         "usb-storage,drive=virtio-win"
         # USB boot
         "-drive"
-        "id=win-install,file=usbimage.img,if=none,format=raw,readonly=on"
+        "id=win-install,file=usbimage.img,if=none,format=raw,readonly=on,media=${if efi then "disk" else "cdrom"}"
         "-device"
         "usb-storage,drive=win-install"
         # Output image
@@ -98,7 +99,7 @@ let
       ''
         #!${pkgs.runtimeShell}
         set -euxo pipefail
-        export PATH=${lib.makeBinPath [ p7zip utils.qemu libguestfs pkgs.wimlib ]}:$PATH
+        export PATH=${lib.makeBinPath [ p7zip utils.qemu libguestfs pkgs.wimlib pkgs.cdrkit ]}:$PATH
 
         # Create a bootable "USB" image
         # Booting in USB mode circumvents the "press any key to boot from cdrom" prompt
@@ -124,7 +125,11 @@ let
 
         cp ${autounattend.autounattendXML} win/autounattend.xml
 
+        ${if efi then ''
         virt-make-fs --partition --type=fat win/ usbimage.img
+        '' else ''
+        mkisofs -iso-level 4 -l -R -udf -D -b boot/etfsboot.com -no-emul-boot -boot-load-size 8 -hide boot.catalog -eltorito-alt-boot -o usbimage.img win/
+        ''}
         rm -rf win
 
         # Qemu requires files to be rw