diff --git a/kubernetes/README.md b/kubernetes/README.md
index 6823930..47f445b 100644
--- a/kubernetes/README.md
+++ b/kubernetes/README.md
@@ -63,8 +63,8 @@ WORKER_COUNT=5 just up    # More workers (default: 3)
 cd kubernetes
 nix build .#k8s-master-0
 
-OVMF_FD=$(nix eval --raw 'nixpkgs#OVMF.fd')
-cp -f /nix/store/*-OVMF-*/FV/OVMF_VARS.fd /tmp/k8s-vars.fd
+OVMF_FD=$(nix build --no-link --print-out-paths nixpkgs#OVMF.fd)
+cp -f "$OVMF_FD/FV/OVMF_VARS.fd" /tmp/k8s-vars.fd
 chmod +w /tmp/k8s-vars.fd
 
 qemu-system-x86_64 \
diff --git a/kubernetes/flake.nix b/kubernetes/flake.nix
index fb10d81..ff84920 100644
--- a/kubernetes/flake.nix
+++ b/kubernetes/flake.nix
@@ -142,6 +142,7 @@
       })
       configs
       // {
+        ovmf = pkgs.OVMF.fd;
         images = pkgs.runCommand "k8s-images" {} ''
           mkdir -p $out
           ${lib.concatStringsSep "\n" (
diff --git a/kubernetes/justfile b/kubernetes/justfile
index d5f6502..8e45319 100755
--- a/kubernetes/justfile
+++ b/kubernetes/justfile
@@ -4,7 +4,8 @@
 export CLUSTER_INDEX := env_var_or_default("CLUSTER_INDEX", "0")
 export WORKER_COUNT := env_var_or_default("WORKER_COUNT", "3")
 
-OVMF_CODE_PATH := `nix eval --raw nixpkgs#OVMF.fd`
+# OVMF must be built (not just evaluated) so FV/OVMF_CODE.fd actually exists
+OVMF_CODE_PATH := `nix build --no-link --print-out-paths .#ovmf`
 KUBE_DIR := justfile_directory()
 TOFU := KUBE_DIR / "tofu"
 ANSIBLE := KUBE_DIR / "ansible"