diff --git a/wfvm/autounattend.nix b/wfvm/autounattend.nix
index d4e4dfb..5c8572c 100644
--- a/wfvm/autounattend.nix
+++ b/wfvm/autounattend.nix
@@ -14,6 +14,7 @@
 , services ? {}
 , impureShellCommands ? []
 , driveLetter ? "D:"
+, efi ? true
 , imageSelection ? "Windows 11 Pro N"
 , enableTpm
 , ...
@@ -119,7 +120,8 @@ let
   # Windows expects a flat list of users while we want to manage them as a set
   flatUsers = builtins.attrValues (builtins.mapAttrs (name: s: s // { inherit name; }) users);
 
-  diskId = 2;
+  diskId =
+    if efi then 2 else 1;
 
   autounattendXML = pkgs.writeText "autounattend.xml" ''
     <?xml version="1.0" encoding="utf-8"?>
@@ -159,12 +161,12 @@ let
               <CreatePartitions>
                 <CreatePartition wcm:action="add">
                   <Order>1</Order>
-                  <Type>EFI</Type>
+                  <Type>${if efi then "EFI" else "Primary"}</Type>
                   <Size>300</Size>
                 </CreatePartition>
                 <CreatePartition wcm:action="add">
                   <Order>2</Order>
-                  <Type>MSR</Type>
+                  <Type>${if efi then "MSR" else "Primary"}</Type>
                   <Size>16</Size>
                 </CreatePartition>
                 <CreatePartition wcm:action="add">
@@ -176,7 +178,7 @@ let
               <ModifyPartitions>
                 <ModifyPartition wcm:action="add">
                   <Order>1</Order>
-                  <Format>FAT32</Format>
+                  <Format>${if efi then "FAT32" else "NTFS"}</Format>
                   <Label>System</Label>
                   <PartitionID>1</PartitionID>
                 </ModifyPartition>
diff --git a/wfvm/utils.nix b/wfvm/utils.nix
index fee901f..1cc9f80 100644
--- a/wfvm/utils.nix
+++ b/wfvm/utils.nix
@@ -2,6 +2,7 @@
 , baseRtc ? "2022-10-10T10:10:10"
 , cores ? "4"
 , qemuMem ? "4G"
+, efi ? true
 , enableTpm ? false
 }:
 
@@ -23,6 +24,7 @@ rec {
     "-rtc base=${baseRtc}"
     "-device qemu-xhci"
     "-device virtio-net-pci,netdev=n1"
+  ] ++ pkgs.lib.optionals efi [
     "-bios ${OVMF.fd}/FV/OVMF.fd"
   ] ++ pkgs.lib.optionals enableTpm [
     "-chardev" "socket,id=chrtpm,path=tpm.sock"
diff --git a/wfvm/win.nix b/wfvm/win.nix
index 2319fe5..1cc2646 100644
--- a/wfvm/win.nix
+++ b/wfvm/win.nix
@@ -8,12 +8,13 @@
 , enableTpm ? true
 # autounattend always installs index 1, so this default is backward-compatible
 , imageSelection ? "Windows 11 Pro N"
+, efi ? true
 , ...
 }@attrs:
 
 let
   lib = pkgs.lib;
-  utils = import ./utils.nix { inherit pkgs enableTpm; };
+  utils = import ./utils.nix { inherit pkgs efi enableTpm; };
   inherit (pkgs) guestfs-tools;
 
   # p7zip on >20.03 has known vulns but we have no better option
@@ -95,7 +96,7 @@ let
         "usb-storage,drive=virtio-win"
         # USB boot
         "-drive"
-        "id=win-install,file=usbimage.img,if=none,format=raw,readonly=on,media=disk"
+        "id=win-install,file=${if efi then "usb" else "cd"}image.img,if=none,format=raw,readonly=on,media=${if efi then "disk" else "cdrom"}"
         "-device"
         "usb-storage,drive=win-install"
         # Output image
@@ -124,7 +125,11 @@ let
 
         cp ${autounattend.autounattendXML} win/autounattend.xml
 
+        ${if efi then ''
         virt-make-fs --partition --type=fat win/ usbimage.img
+        '' else ''
+        ${pkgs.cdrkit}/bin/mkisofs -iso-level 4 -l -R -udf -D -b boot/etfsboot.com -no-emul-boot -boot-load-size 8 -hide boot.catalog -eltorito-alt-boot -o cdimage.img win/
+        ''}
         rm -rf win
 
         ${utils.tpmStartCommands}