diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index c26caace95..9d63b81dc3 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2025-01-21T10:29:14Z by kres 3075de9.
+# Generated on 2025-01-22T14:28:18Z by kres 3075de9.
 
 name: default
 concurrency:
@@ -1961,6 +1961,15 @@ jobs:
           WITH_CONTROL_PLANE_PORT: "443"
         run: |
           sudo -E make e2e-qemu
+      - name: e2e-uki-4k
+        env:
+          GITHUB_STEP_NAME: ${{ github.job}}-e2e-uki-4k
+          IMAGE_REGISTRY: registry.dev.siderolabs.io
+          SHORT_INTEGRATION_TEST: "yes"
+          WITH_4K_DISK: "true"
+          WITH_UKI_BOOT: "true"
+        run: |
+          sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/integration-misc-0-cron.yaml b/.github/workflows/integration-misc-0-cron.yaml
index 151e7b3a1d..ea208b3b50 100644
--- a/.github/workflows/integration-misc-0-cron.yaml
+++ b/.github/workflows/integration-misc-0-cron.yaml
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2024-12-11T13:30:10Z by kres 8183c20.
+# Generated on 2025-01-22T14:28:18Z by kres 3075de9.
 
 name: integration-misc-0-cron
 concurrency:
@@ -103,6 +103,15 @@ jobs:
           WITH_CONTROL_PLANE_PORT: "443"
         run: |
           sudo -E make e2e-qemu
+      - name: e2e-uki-4k
+        env:
+          GITHUB_STEP_NAME: ${{ github.job}}-e2e-uki-4k
+          IMAGE_REGISTRY: registry.dev.siderolabs.io
+          SHORT_INTEGRATION_TEST: "yes"
+          WITH_4K_DISK: "true"
+          WITH_UKI_BOOT: "true"
+        run: |
+          sudo -E make e2e-qemu
       - name: save artifacts
         if: always()
         uses: actions/upload-artifact@v4
diff --git a/.kres.yaml b/.kres.yaml
index 1702b44458..99ecc0faf8 100644
--- a/.kres.yaml
+++ b/.kres.yaml
@@ -684,6 +684,15 @@ spec:
             WITH_CONTROL_PLANE_PORT: 443
             IMAGE_REGISTRY: registry.dev.siderolabs.io
             WITH_CONFIG_PATCH: "@hack/test/patches/ephemeral-min-max.yaml"
+        - name: e2e-uki-4k
+          command: e2e-qemu
+          withSudo: true
+          environment:
+            GITHUB_STEP_NAME: ${{ github.job}}-e2e-uki-4k
+            SHORT_INTEGRATION_TEST: yes
+            IMAGE_REGISTRY: registry.dev.siderolabs.io
+            WITH_UKI_BOOT: true
+            WITH_4K_DISK: true
         - name: save-talos-logs
           conditions:
             - always
diff --git a/Makefile b/Makefile
index 93b68e0647..d35ccbce6f 100644
--- a/Makefile
+++ b/Makefile
@@ -131,6 +131,7 @@ INSTALLER_ARCH ?= all
 INSTALLER_ONLY_PKGS ?= \
     bash \
     cpio \
+    dosfstools \
     efibootmgr \
     kmod \
     squashfs-tools \
@@ -139,7 +140,6 @@ INSTALLER_ONLY_PKGS ?= \
     zstd
 
 IMAGER_EXTRA_PKGS ?= \
-    dosfstools \
     e2fsprogs \
     mtools \
     pigz \
@@ -444,9 +444,9 @@ image-%: ## Builds the specified image. Valid options are aws, azure, digital-oc
 		docker run --rm -t -v /dev:/dev -v $(PWD)/$(ARTIFACTS):/secureboot:ro -v $(PWD)/$(ARTIFACTS):/out -e SOURCE_DATE_EPOCH=$(SOURCE_DATE_EPOCH) --network=host --privileged $(REGISTRY_AND_USERNAME)/imager:$(IMAGE_TAG) $* --arch $$arch $(IMAGER_ARGS) ; \
 	done
 
-images-essential: image-aws image-azure image-gcp image-metal secureboot-installer ## Builds only essential images used in the CI (AWS, GCP, and Metal).
+images-essential: image-aws image-azure image-gcp image-metal image-metal-uki secureboot-installer ## Builds only essential images used in the CI (AWS, Azure, GCP, and Metal).
 
-images: image-akamai image-aws image-azure image-digital-ocean image-exoscale image-cloudstack image-gcp image-hcloud image-iso image-metal image-nocloud image-opennebula image-openstack image-oracle image-scaleway image-upcloud image-vmware image-vultr ## Builds all known images (AWS, Azure, DigitalOcean, Exoscale, Cloudstack, GCP, HCloud, Metal, NoCloud, OpenNebula, OpenStack, Oracle, Scaleway, UpCloud, Vultr and VMware).
+images: image-akamai image-aws image-azure image-digital-ocean image-exoscale image-cloudstack image-gcp image-hcloud image-iso image-metal image-metal-uki image-nocloud image-opennebula image-openstack image-oracle image-scaleway image-upcloud image-vmware image-vultr ## Builds all known images (AWS, Azure, DigitalOcean, Exoscale, Cloudstack, GCP, HCloud, Metal, NoCloud, OpenNebula, OpenStack, Oracle, Scaleway, UpCloud, Vultr and VMware).
 
 .PHONY: iso
 iso: image-iso ## Builds the ISO and outputs it to the artifact directory.
diff --git a/go.mod b/go.mod
index a47aceb652..b6d4677af3 100644
--- a/go.mod
+++ b/go.mod
@@ -142,7 +142,7 @@ require (
 	github.com/siderolabs/gen v0.8.0
 	github.com/siderolabs/go-api-signature v0.3.6
 	github.com/siderolabs/go-blockdevice v0.4.8
-	github.com/siderolabs/go-blockdevice/v2 v2.0.11
+	github.com/siderolabs/go-blockdevice/v2 v2.0.12
 	github.com/siderolabs/go-circular v0.2.1
 	github.com/siderolabs/go-cmd v0.1.3
 	github.com/siderolabs/go-copy v0.1.0
diff --git a/go.sum b/go.sum
index 4aa504d024..6c2c49e908 100644
--- a/go.sum
+++ b/go.sum
@@ -646,8 +646,8 @@ github.com/siderolabs/go-api-signature v0.3.6 h1:wDIsXbpl7Oa/FXvxB6uz4VL9INA9fmr
 github.com/siderolabs/go-api-signature v0.3.6/go.mod h1:hoH13AfunHflxbXfh+NoploqV13ZTDfQ1mQJWNVSW9U=
 github.com/siderolabs/go-blockdevice v0.4.8 h1:KfdWvIx0Jft5YVuCsFIJFwjWEF1oqtzkgX9PeU9cX4c=
 github.com/siderolabs/go-blockdevice v0.4.8/go.mod h1:4PeOuk71pReJj1JQEXDE7kIIQJPVe8a+HZQa+qjxSEA=
-github.com/siderolabs/go-blockdevice/v2 v2.0.11 h1:r7mbbXMn8OZmJA2fJJdomjlZKexRi66ELVZGXJUaNU8=
-github.com/siderolabs/go-blockdevice/v2 v2.0.11/go.mod h1:74htzCV913UzaLZ4H+NBXkwWlYnBJIq5m/379ZEcu8w=
+github.com/siderolabs/go-blockdevice/v2 v2.0.12 h1:lBqWOpsET+alfJmZbMCZH3UCBVtfnhLEEx5LdxwZUUk=
+github.com/siderolabs/go-blockdevice/v2 v2.0.12/go.mod h1:74htzCV913UzaLZ4H+NBXkwWlYnBJIq5m/379ZEcu8w=
 github.com/siderolabs/go-circular v0.2.1 h1:a++iVCn9jyhICX3POQZZX8n72p2h5JGdGU6w1ulmpcA=
 github.com/siderolabs/go-circular v0.2.1/go.mod h1:ZDItzVyXK+B/XuqTBV5MtQtSv06VI+oCmWGRnNCATo8=
 github.com/siderolabs/go-cmd v0.1.3 h1:JrgZwqhJQeoec3QRON0LK+fv+0y7d0DyY7zsfkO6ciw=
diff --git a/hack/test/e2e-qemu.sh b/hack/test/e2e-qemu.sh
index da806baf10..2a73c09bca 100755
--- a/hack/test/e2e-qemu.sh
+++ b/hack/test/e2e-qemu.sh
@@ -218,6 +218,24 @@ case "${WITH_IOMMU:-false}" in
     ;;
 esac
 
+case "${WITH_4K_DISK:-false}" in
+  false)
+    ;;
+  *)
+    QEMU_FLAGS+=("--disk-block-size=4096")
+    ;;
+esac
+
+case "${WITH_UKI_BOOT:-false}" in
+  false)
+    ;;
+  *)
+    INSTALLER_IMAGE=${INSTALLER_IMAGE}-amd64-secureboot # we don't use secureboot part here, but this installer contains UKIs
+    QEMU_FLAGS+=("--uki-path=_out/metal-amd64-uki.efi")
+    ;;
+esac
+
+
 function create_cluster {
   build_registry_mirrors
 
diff --git a/pkg/machinery/go.mod b/pkg/machinery/go.mod
index 3556ec36ed..6c2e88dc5d 100644
--- a/pkg/machinery/go.mod
+++ b/pkg/machinery/go.mod
@@ -27,7 +27,7 @@ require (
 	github.com/siderolabs/crypto v0.5.1
 	github.com/siderolabs/gen v0.8.0
 	github.com/siderolabs/go-api-signature v0.3.6
-	github.com/siderolabs/go-blockdevice/v2 v2.0.11
+	github.com/siderolabs/go-blockdevice/v2 v2.0.12
 	github.com/siderolabs/go-pointer v1.0.0
 	github.com/siderolabs/net v0.4.0
 	github.com/siderolabs/protoenc v0.2.1
diff --git a/pkg/machinery/go.sum b/pkg/machinery/go.sum
index 37522cb2ea..e9702a218b 100644
--- a/pkg/machinery/go.sum
+++ b/pkg/machinery/go.sum
@@ -114,8 +114,8 @@ github.com/siderolabs/gen v0.8.0 h1:Pj93+hexkk5hQ7izjJ6YXnEWc8vlzOmDwFz13/VzS7o=
 github.com/siderolabs/gen v0.8.0/go.mod h1:an3a2Y53O7kUjnnK8Bfu3gewtvnIOu5RTU6HalFtXQQ=
 github.com/siderolabs/go-api-signature v0.3.6 h1:wDIsXbpl7Oa/FXvxB6uz4VL9INA9fmr3EbmjEZYFJrU=
 github.com/siderolabs/go-api-signature v0.3.6/go.mod h1:hoH13AfunHflxbXfh+NoploqV13ZTDfQ1mQJWNVSW9U=
-github.com/siderolabs/go-blockdevice/v2 v2.0.11 h1:r7mbbXMn8OZmJA2fJJdomjlZKexRi66ELVZGXJUaNU8=
-github.com/siderolabs/go-blockdevice/v2 v2.0.11/go.mod h1:74htzCV913UzaLZ4H+NBXkwWlYnBJIq5m/379ZEcu8w=
+github.com/siderolabs/go-blockdevice/v2 v2.0.12 h1:lBqWOpsET+alfJmZbMCZH3UCBVtfnhLEEx5LdxwZUUk=
+github.com/siderolabs/go-blockdevice/v2 v2.0.12/go.mod h1:74htzCV913UzaLZ4H+NBXkwWlYnBJIq5m/379ZEcu8w=
 github.com/siderolabs/go-pointer v1.0.0 h1:6TshPKep2doDQJAAtHUuHWXbca8ZfyRySjSBT/4GsMU=
 github.com/siderolabs/go-pointer v1.0.0/go.mod h1:HTRFUNYa3R+k0FFKNv11zgkaCLzEkWVzoYZ433P3kHc=
 github.com/siderolabs/go-retry v0.3.3 h1:zKV+S1vumtO72E6sYsLlmIdV/G/GcYSBLiEx/c9oCEg=
diff --git a/pkg/provision/providers/qemu/launch.go b/pkg/provision/providers/qemu/launch.go
index c8147123e1..f0fb053b6f 100644
--- a/pkg/provision/providers/qemu/launch.go
+++ b/pkg/provision/providers/qemu/launch.go
@@ -280,7 +280,7 @@ func withCNI(ctx context.Context, config *LaunchConfig, f func(config *LaunchCon
 }
 
 func checkPartitions(config *LaunchConfig) (bool, error) {
-	info, err := blkid.ProbePath(config.DiskPaths[0])
+	info, err := blkid.ProbePath(config.DiskPaths[0], blkid.WithSectorSize(config.DiskBlockSizes[0]))
 	if err != nil {
 		return false, fmt.Errorf("error probing disk: %w", err)
 	}