diff --git a/README.md b/README.md
index becd4a6..b2176e7 100644
--- a/README.md
+++ b/README.md
@@ -39,6 +39,8 @@ Tiny initramfs written in POSIX shell
   - Optional. Required for keymap support
 * `kmod` OR `busybox modutils` with [patch](https://gist.github.com/illiliti/ef9ee781b5c6bf36d9493d99b4a1ffb6) (already included in KISS Linux)
   - Optional. Required if kernel compiled with loadable external modules
+* `objcopy` and `objdump` OR `llvm-objcopy`
+  - Optional. Required for UKI support
 
 ## Installation
 
diff --git a/doc/tinyramfs.5 b/doc/tinyramfs.5
index 250b4c7..c9da297 100644
--- a/doc/tinyramfs.5
+++ b/doc/tinyramfs.5
@@ -1,184 +1,225 @@
-.\" Generated by scdoc 1.11.2
+.\" Generated by scdoc  1.11.3
 .\" Complete documentation for this program is not available as a GNU info page
 .ie \n(.g .ds Aq \(aq
 .el       .ds Aq '
 .nh
 .ad l
 .\" Begin generated content:
-.TH "tinyramfs" "5" "2022-05-11" "tinyramfs" "2022-05-09"
-.P
+.TH "tinyramfs" "5" "2025-07-22" "tinyramfs" "2022-05-09"
+.PP
 .SH NAME
-.P
+.PP
 tinyramfs - configuration file
-.P
+.PP
 .SH DESCRIPTION
-.P
+.PP
 A tinyramfs configuration file is written in POSIX sh.\& Configuration is done
 via variable asignment (eg.\& \fBoption=value\fR).\& Special characters and whitespace
 must be quoted or escaped, more info: \fBsh\fR(1).\& By default tinyramfs looks to
 \fB/etc/tinyramfs/config\fR for a configuration file.\&
-.P
+.PP
 .SH OPTIONS
-.P
+.PP
 Option marked with \fB(bool)\fR can hold a value of true or false.\& False if the
 variable is unset or empty, true otherwise.\&
-.P
+.PP
 Some options only apply to certain hooks and have been categorized accordingly.\&
-.P
+.PP
 Options which expect a device as a value can also refer to the device via
 \fBUUID\fR, \fBLABEL\fR, and \fBPARTUUID\fR (eg.\& LABEL=<label>).\& This requires a blkid
 utility which supports that identifier.\&
-.P
+.PP
 root
-.P
+.PP
 .RS 4
 The device your root filesystem is located on.\&
-.P
+.PP
 .RE
 hooks
-.P
+.PP
 .RS 4
-A comma separated list of hooks to include in the initramfs.\& Hooks can
-be found in /lib/tinyramfs/hook.\&d/.\&
-.P
+A comma separated list of hooks to include in the
+initramfs.\& Hooks can be found in /lib/tinyramfs/hook.\&d/.\& \fBThe
+order in which hooks appear is significant\fR; a device manager
+hook (e.\&g.\& the '\&eudev'\& hook) should be the first element of
+the list, the '\&ucode'\& hook should be placed before the '\&uki'\&
+hook, if both are used.\&
+.PP
 .RE
 monolith
-.P
+.PP
 .RS 4
 (bool) Instructs tinyramfs whether or not to include kernel modules in
 the initramfs.\&
-.P
+.PP
 .RE
 compress
-.P
+.PP
 .RS 4
 The utility to use for compressing the initramfs.\& The option accepts
 arbitrary commands (eg.\& '\&gzip -9'\&).\& Use '\&cat'\& for an uncompressed
 initramfs.\&
-.P
+.PP
 .RE
 hostonly
-.P
+.PP
 .RS 4
 (bool) Whether or not to only copy modules specific to your system.\&
-.P
+.PP
 .RE
 root_type
-.P
+.PP
 .RS 4
 The filesystem you'\&re using for your root device (eg.\& ext4).\&
-.P
+.PP
 .RE
 .SS KEYMAP
-.P
+.PP
 keymap_path
-.P
+.PP
 .RS 4
 Path to your keymap.\&
-.P
+.PP
 .RE
 .SS LUKS
-.P
+.PP
 luks_discard
-.P
+.PP
 .RS 4
 (bool) Allow the use of discard (TRIM) requests for your luks device.\&
-.P
+.PP
 \fBWARNING\fR: This option may have a negative security impact.\& For more info
 read \fBcryptsetup\fR(8).\&
-.P
+.PP
 .RE
 luks_header
-.P
+.PP
 .RS 4
 Path to your LUKS header.\&
-.P
+.PP
 .RE
 luks_root
-.P
+.PP
 .RS 4
 The device your LUKS volume is located on.\&
-.P
+.PP
 .RE
 luks_name
-.P
+.PP
 .RS 4
 The name to map your LUKS device to.\&
-.P
+.PP
 .RE
 luks_key
-.P
+.PP
 .RS 4
 Path to your LUKS keyfile.\&
-.P
+.PP
 .RE
 .SS LVM
-.P
+.PP
 lvm_config
-.P
+.PP
 .RS 4
 Path to your LVM configuration file.\&
-.P
+.PP
 .RE
 lvm_discard
-.P
+.PP
 .RS 4
 (bool) Allow the use of discard (TRIM) requests for your LVM device.\&
-.P
+.PP
 .RE
 lvm_group
-.P
+.PP
 .RS 4
 The name of your LVM volume group.\&
-.P
+.PP
 .RE
 lvm_name
-.P
+.PP
 .RS 4
 The name of your LVM logical volume.\&
-.P
+.PP
 .RE
 lvm_tag
-.P
+.PP
 .RS 4
 The tag of your LVM logical volume.\&
-.P
+.PP
 .RE
 .SS RESUME
-.P
+.PP
 resume
-.P
+.PP
 .RS 4
 The location of your swap partition.\&
-.P
+.PP
 .RE
 .SS ZFS
-.P
+.PP
 zfs_key
-.P
+.PP
 .RS 4
 Path to your ZFS keyfile.\&
-.P
+.PP
 .RE
 zfs_root
-.P
+.PP
 .RS 4
 The device your ZFS volume is located on.\&
-.P
+.PP
+.RE
+.SS UCODE
+.PP
+ucode_image
+.PP
+.RS 4
+Path to a pre-built microcode image (optional, will be
+generated if not specified).\&
+.PP
+.RE
+.SS UKI
+.PP
+uki_cmdline
+.PP
+.RS 4
+Kernel command line to include in the image.\&
+.PP
+.RE
+uki_efistub
+.PP
+.RS 4
+Path to an EFI Stub loader.\& Will try to use
+/lib/systemd/boot/efi/linuxx64.\&efi.\&stub if unset.\&
+.PP
+.RE
+uki_kernel
+.PP
+.RS 4
+Path to the kernel.\& $kernel holds the kernel version passed to tinyramfs.\&
+.PP
+.RE
+uki_only
+.PP
+.RS 4
+(bool) Whether or not to remove the initramfs image after
+using it to generate the UKI.\&
+.PP
 .RE
 .SH FILES
-.P
+.PP
 /lib/tinyramfs/hook.\&d/
 .RS 4
 tinyramfs hooks
-.P
+.PP
 .RE
 .SH SEE ALSO
-.P
+.PP
 \fBtinyramfs\fR(8)
-.P
+.PP
 .SH AUTHORS
-.P
+.PP
 tinyramfs by illiliti \fBhttps://github.\&com/illiliti\fR
 .br
 man page by fluorescent_haze \fBhttps://github.\&com/fluorescent-haze\fR
diff --git a/doc/tinyramfs.5.scd b/doc/tinyramfs.5.scd
index c892218..d668866 100644
--- a/doc/tinyramfs.5.scd
+++ b/doc/tinyramfs.5.scd
@@ -1,4 +1,4 @@
-tinyramfs(5) "tinyramfs" "2022-05-09"
+tinyramfs(5) "tinyramfs" "2025-07-22"
 
 # NAME
 
@@ -28,8 +28,12 @@ root
 
 hooks
 
-	A comma separated list of hooks to include in the initramfs. Hooks can
-	be found in /lib/tinyramfs/hook.d/.
+	A comma separated list of hooks to include in the
+	initramfs. Hooks can be found in /lib/tinyramfs/hook.d/. *The
+	order in which hooks appear is significant*; a device manager
+	hook (e.g. the 'eudev' hook) should be the first element of
+	the list, the 'ucode' hook should be placed before the 'uki'
+	hook, if both are used.
 
 monolith
 
@@ -119,6 +123,33 @@ zfs_root
 
 	The device your ZFS volume is located on.
 
+## UCODE
+
+ucode_image
+
+	Path to a pre-built microcode image (optional, will be
+	generated if not specified).
+
+## UKI
+
+uki_cmdline
+
+	Kernel command line to include in the image.
+
+uki_efistub
+
+	Path to an EFI Stub loader. Will try to use
+	/lib/systemd/boot/efi/linuxx64.efi.stub if unset.
+
+uki_kernel
+
+	Path to the kernel. $kernel holds the kernel version passed to tinyramfs.
+
+uki_only
+
+	(bool) Whether or not to remove the initramfs image after
+	using it to generate the UKI.
+
 # FILES
 
 /lib/tinyramfs/hook.d/
diff --git a/hook/ucode/ucode b/hook/ucode/ucode
new file mode 100644
index 0000000..07dea60
--- /dev/null
+++ b/hook/ucode/ucode
@@ -0,0 +1,48 @@
+# vim: set ft=sh:
+# shellcheck shell=sh
+#
+# https://shellcheck.net/wiki/SC2154
+# shellcheck disable=2154
+
+[ -f "$ucode_image" ] && return
+
+family="$(sed -n '/cpu family/ {s/.*: //p;q}' /proc/cpuinfo)"
+fwdir=/lib/firmware
+prefix=kernel/x86/microcode
+
+mkdir -p "${ucodedir:=${tmpdir}/.ignore/ucode}/root/${prefix}"
+
+if [ "$hostonly" ]; then
+    if grep -iq 'vendor_id.*amd' /proc/cpuinfo 2>/dev/null; then
+        if [ "$family" -ge 21 ]; then
+            amd="${fwdir}/amd-ucode/microcode_amd_fam$(printf '%x' "$family")h.bin"
+        else
+            amd="${fwdir}/amd-ucode/microcode_amd.bin"
+        fi
+
+        cp -f "$amd" "${ucodedir}/root/${prefix}/AuthenticAMD.bin"
+    elif grep -iq 'vendor_id.*intel' /proc/cpuinfo 2>/dev/null; then
+        model="$(sed -n '/model[ \t]*:/ {s/.*: //p;q}' /proc/cpuinfo)"
+        stepping="$(sed -n '/stepping/ {s/.*: //p;q}' /proc/cpuinfo)"
+        fw="$(printf '%02x-%02x-%02x' "$family" "$model" "$stepping")"
+
+        cp -f "${fwdir}/intel-ucode/$fw" \
+           "${ucodedir}/root/${prefix}/GenuineIntel.bin"
+    fi
+else
+    set +f # enable globbing temporarily
+
+    [ -d "$fwdir"/amd-ucode ] &&
+        cat "$fwdir"/amd-ucode/microcode_amd*.bin > "${ucodedir}/root/${prefix}/AuthenticAMD.bin"
+
+    [ -d "$fwdir"/intel-ucode ] &&
+        cat "$fwdir"/intel-ucode/* > "${ucodedir}/root/${prefix}/GenuineIntel.bin"
+
+    set -f
+fi
+
+[ -f "${ucodedir}/root/${prefix}/AuthenticAMD.bin" ] ||
+    [ -f "${ucodedir}/root/${prefix}/GenuineIntel.bin" ] &&
+        (cd "$ucodedir"/root && find . | cpio -oH newc 2> /dev/null) > "$ucodedir"/ucode.img
+
+unset family fwdir prefix model stepping amd
diff --git a/hook/ucode/ucode.late b/hook/ucode/ucode.late
new file mode 100644
index 0000000..414cbc2
--- /dev/null
+++ b/hook/ucode/ucode.late
@@ -0,0 +1,10 @@
+# vim: set ft=sh:
+# shellcheck shell=sh
+#
+# https://shellcheck.net/wiki/SC2154
+# shellcheck disable=2154
+
+if [ -f "${ucode_image:=${ucodedir:=${tmpdir}/.ignore/ucode}/ucode.img}" ]; then
+    mv "$output" "$ucodedir"/initramfs.img
+    cat "$ucode_image" "$ucodedir"/initramfs.img > "$output"
+fi
diff --git a/hook/uki/uki b/hook/uki/uki
new file mode 100644
index 0000000..065a8c5
--- /dev/null
+++ b/hook/uki/uki
@@ -0,0 +1,14 @@
+# vim: set ft=sh:
+# shellcheck shell=sh
+#
+# https://shellcheck.net/wiki/SC2154
+# shellcheck disable=2154
+
+[ -r "${uki_efistub:=/lib/systemd/boot/efi/linuxx64.efi.stub}" ]
+[ -r "$uki_kernel" ]
+
+if command -v llvm-objcopy > /dev/null || command -v objcopy > /dev/null; then
+   mkdir -p "${ukidir:=${tmpdir}/.ignore/uki}"
+
+   printf '%s\n' "$uki_cmdline" > "$ukidir"/cmdline
+fi
diff --git a/hook/uki/uki.late b/hook/uki/uki.late
new file mode 100644
index 0000000..a4c330c
--- /dev/null
+++ b/hook/uki/uki.late
@@ -0,0 +1,47 @@
+# vim: set ft=sh:
+# shellcheck shell=sh
+#
+# https://shellcheck.net/wiki/SC2154
+# shellcheck disable=2154
+
+if [ -d "${ukidir:=${tmpdir}/.ignore/uki}" ]; then
+    mv "$output" "$output".initramfs
+
+    if command -v llvm-objcopy > /dev/null; then
+        llvm-objcopy \
+            --add-section .osrel="/etc/os-release" \
+            --set-section-flags .osrel=data,readonly \
+            --add-section .cmdline="$ukidir"/cmdline \
+            --set-section-flags .cmdline=data,readonly \
+            --add-section .initrd="$output".initramfs \
+            --set-section-flags .initrd=code,readonly \
+            --add-section .linux="$uki_kernel" \
+            --set-section-flags .linux=code,readonly \
+            "$uki_efistub" "$output"
+    elif command -v objcopy > /dev/null; then
+        align=$(objdump -p "$uki_efistub" | awk -Wposix '/^SectionAlignment/ {printf "%d", "0x"$2}' 2> /dev/null)
+        osrel="$(objdump -h "$uki_efistub" | awk -Wposix '/.*\.reloc/ {print sprintf("%d","0x"$3) + sprintf("%d","0x"$4)}' 2> /dev/null)"
+        osrel=$(printf 0x%x $((osrel + align - osrel % align)))
+        cmdline=$((osrel + $(wc -c < /etc/os-release)))
+        cmdline=$(printf 0x%x $((cmdline + align - cmdline % align)))
+        initrd=$((cmdline + $(wc -c < "$ukidir"/cmdline)))
+        initrd=$(printf 0x%x $((initrd + align - initrd % align)))
+        linux=$((initrd + $(wc -c < "$output".initramfs)))
+        linux=$(printf 0x%x $((linux + align - linux % align)))
+
+        objcopy \
+            --add-section .osrel="/etc/os-release" --change-section-vma .osrel="$osrel" \
+            --add-section .cmdline="$ukidir"/cmdline --change-section-vma .cmdline="$cmdline"\
+            --add-section .initrd="$output".initramfs --change-section-vma .initrd="$initrd" \
+            --add-section .linux="$uki_kernel" --change-section-vma .linux="$linux" \
+            "$uki_efistub" "$output"
+
+        unset align osrel cmdline initrd linux
+    fi
+
+    if [ -f "$output" ]; then
+        [ "$uki_only" ] && rm -f "$output".initramfs
+    else
+        mv "$output".initramfs "$output"
+    fi
+fi
diff --git a/tinyramfs b/tinyramfs
index 042ab8a..2d0ab90 100755
--- a/tinyramfs
+++ b/tinyramfs
@@ -157,8 +157,29 @@ create_image()
     [ -z "$force" ] && [ -e "$output" ] &&
         panic 'initramfs image already exist'
 
-    (cd "$tmpdir" && find . | cpio -oH newc 2> /dev/null) | ${compress:-cat} > "$output" ||
+    (cd "$tmpdir" && find . -not \( -path ./.ignore -prune \) | cpio -oH newc 2> /dev/null) |
+        ${compress:-cat} > "$output" ||
         panic 'failed to generate initramfs image'
+}
+
+late_hooks()
+{
+    # https://shellcheck.net/wiki/SC2086
+    # shellcheck disable=2086
+    { IFS=,; set -- $hooks; unset IFS; }
+
+    # https://shellcheck.net/wiki/SC1090
+    # shellcheck disable=1090
+    for _hook; do
+        _name=$_hook
+        
+        for _dir in ${local+./hook} /etc/tinyramfs/hook.d /lib/tinyramfs/hook.d; do
+            _hook="${_dir}/${_name}/${_name}.late"
+            [ -f "$_hook" ] && break
+        done
+
+        [ -f "$_hook" ] && print "evaluating hook: ${_name}.late" && . "$_hook"
+    done
 
     print "done: $output" '+>'
 }
@@ -208,3 +229,4 @@ init_base
 copy_hooks
 copy_modules
 create_image
+late_hooks