diff --git a/Dockerfile b/Dockerfile
index d4f3ab0..a206aaf 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -8,6 +8,7 @@ ARG RUST_PROFILE
 RUN adduser -S -s /bin/sh build
 COPY \
     --exclude=rust-toolchain.toml \
+    --exclude=hack \
     --chown=build:build \
     . /build
 WORKDIR /build
diff --git a/hack/dev/boot.sh b/hack/dev/boot.sh
index b22d4ce..092319a 100755
--- a/hack/dev/boot.sh
+++ b/hack/dev/boot.sh
@@ -13,7 +13,7 @@ clear
 
 set --
 if [ "${TARGET_ARCH}" = "x86_64" ]; then
-	set -- "${@}" qemu-system-x86_64 -M q35
+	set -- "${@}" qemu-system-x86_64 -M q35 -cpu SandyBridge,vmx=on
 elif [ "${TARGET_ARCH}" = "aarch64" ]; then
 	set -- "${@}" qemu-system-aarch64 -M virt -cpu cortex-a57
 fi
diff --git a/hack/dev/build.sh b/hack/dev/build.sh
index 13bf237..8a67c93 100755
--- a/hack/dev/build.sh
+++ b/hack/dev/build.sh
@@ -29,7 +29,8 @@ fi
 mkdir -p "${FINAL_DIR}"
 
 if [ "${SKIP_KERNEL_BUILD}" != "1" ] || [ "${SKIP_VM_BUILD}" != "1" ] || [ "${SKIP_SPROUT_BUILD}" != "1" ]; then
-	docker build -t "${DOCKER_PREFIX}/sprout-utils-copy-direct:${DOCKER_TAG}" -f hack/dev/utils/Dockerfile.copy-direct hack
+	docker build -t "${DOCKER_PREFIX}/sprout-utils-copy-direct:${DOCKER_TAG}" \
+		-f hack/dev/utils/Dockerfile.copy-direct hack
 fi
 
 copy_from_image_direct() {
@@ -47,7 +48,8 @@ copy_from_image_polyfill() {
 	SOURCE="${2}"
 	TARGET="${3}"
 
-	docker build -t "${IMAGE}-copy-polyfill:${DOCKER_TAG}" --build-arg "TARGET_IMAGE=${IMAGE}:${DOCKER_TAG}" -f hack/dev/utils/Dockerfile.copy-polyfill hack
+	docker build -t "${IMAGE}-copy-polyfill:${DOCKER_TAG}" --build-arg "TARGET_IMAGE=${IMAGE}:${DOCKER_TAG}" \
+		-f hack/dev/utils/Dockerfile.copy-polyfill hack
 	# note: the -w '//' is a workaround for Git Bash where / is magically rewritten.
 	docker run --rm -i -w '//' "${IMAGE}-copy-polyfill:${DOCKER_TAG}" cat "image/${SOURCE}" >"${TARGET}"
 }
@@ -61,10 +63,12 @@ copy_from_image() {
 
 if [ "${SKIP_KERNEL_BUILD}" != "1" ]; then
 	echo "[kernel build] ${TARGET_ARCH} ${RUST_PROFILE}"
-	docker build --platform="${DOCKER_TARGET}" -t "${DOCKER_PREFIX}/sprout-kernel-${TARGET_ARCH}:${DOCKER_TAG}" -f hack/dev/kernel/Dockerfile hack/dev/kernel
+	docker build --platform="${DOCKER_TARGET}" -t "${DOCKER_PREFIX}/sprout-kernel-${TARGET_ARCH}:${DOCKER_TAG}" \
+		-f hack/dev/kernel/Dockerfile hack/dev/kernel
 
 	if [ "${KERNEL_BUILD_TAG}" = "1" ]; then
-		docker build --platform="${DOCKER_TARGET}" -t "${DOCKER_PREFIX}/sprout-kernel-build-${TARGET_ARCH}:${DOCKER_TAG}" -f hack/dev/kernel/Dockerfile --target build hack/dev/kernel
+		docker build --platform="${DOCKER_TARGET}" -t "${DOCKER_PREFIX}/sprout-kernel-build-${TARGET_ARCH}:${DOCKER_TAG}" \
+			-f hack/dev/kernel/Dockerfile --target build hack/dev/kernel
 	fi
 
 	copy_from_image "${DOCKER_PREFIX}/sprout-kernel-${TARGET_ARCH}" "kernel.efi" "${FINAL_DIR}/kernel.efi"
@@ -72,10 +76,12 @@ fi
 
 if [ "${SKIP_VM_BUILD}" != "1" ]; then
 	echo "[vm build] ${TARGET_ARCH} ${RUST_PROFILE}"
-	docker build --platform="${DOCKER_TARGET}" -t "${DOCKER_PREFIX}/sprout-ovmf-${TARGET_ARCH}:${DOCKER_TAG}" -f hack/dev/vm/Dockerfile.ovmf "${FINAL_DIR}"
+	docker build --platform="${DOCKER_TARGET}" -t "${DOCKER_PREFIX}/sprout-ovmf-${TARGET_ARCH}:${DOCKER_TAG}" \
+		-f hack/dev/vm/Dockerfile.ovmf "${FINAL_DIR}"
 	copy_from_image "${DOCKER_PREFIX}/sprout-ovmf-${TARGET_ARCH}" "ovmf.fd" "${FINAL_DIR}/ovmf.fd"
 	copy_from_image "${DOCKER_PREFIX}/sprout-ovmf-${TARGET_ARCH}" "shell.efi" "${FINAL_DIR}/shell.efi"
-	docker build --platform="${DOCKER_TARGET}" -t "${DOCKER_PREFIX}/sprout-initramfs-${TARGET_ARCH}:${DOCKER_TAG}" -f hack/dev/vm/Dockerfile.initramfs "${FINAL_DIR}"
+	docker build --platform="${DOCKER_TARGET}" -t "${DOCKER_PREFIX}/sprout-initramfs-${TARGET_ARCH}:${DOCKER_TAG}" \
+		-f hack/dev/vm/Dockerfile.initramfs "${FINAL_DIR}"
 	copy_from_image "${DOCKER_PREFIX}/sprout-initramfs-${TARGET_ARCH}" "initramfs" "${FINAL_DIR}/initramfs"
 	docker build --platform="${DOCKER_TARGET}" -t "${DOCKER_PREFIX}/sprout-xen-${TARGET_ARCH}:${DOCKER_TAG}" -f hack/dev/vm/Dockerfile.xen "${FINAL_DIR}"
 	copy_from_image "${DOCKER_PREFIX}/sprout-xen-${TARGET_ARCH}" "xen.efi" "${FINAL_DIR}/xen.efi"
@@ -88,13 +94,15 @@ if [ "${SKIP_SPROUT_BUILD}" != "1" ]; then
 		cargo build --target "${RUST_TARGET}" --profile "${RUST_PROFILE}" --bin sprout
 		cp "target/${RUST_TARGET}/${RUST_TARGET_SUBDIR}/sprout.efi" "${FINAL_DIR}/sprout.efi"
 	else
-		docker build --platform="${DOCKER_TARGET}" -t "${DOCKER_PREFIX}/sprout-${TARGET_ARCH}:${DOCKER_TAG}" --build-arg="RUST_TARGET_SUBDIR=${RUST_TARGET_SUBDIR}" -f Dockerfile .
+		docker build --platform="${DOCKER_TARGET}" -t "${DOCKER_PREFIX}/sprout-${TARGET_ARCH}:${DOCKER_TAG}" \
+			--build-arg="RUST_TARGET_SUBDIR=${RUST_TARGET_SUBDIR}" \
+			-f Dockerfile .
 		copy_from_image "${DOCKER_PREFIX}/sprout-${TARGET_ARCH}" "sprout.efi" "${FINAL_DIR}/sprout.efi"
 	fi
 
 	cp "hack/dev/configs/${SPROUT_CONFIG_NAME}.sprout.toml" "${FINAL_DIR}/sprout.toml"
-  cp "hack/dev/configs/xen.cfg" "${FINAL_DIR}/xen.cfg"
-  cp "hack/dev/assets/edera-splash.png" "${FINAL_DIR}/edera-splash.png"
+	cp "hack/dev/configs/xen.cfg" "${FINAL_DIR}/xen.cfg"
+	cp "hack/dev/assets/edera-splash.png" "${FINAL_DIR}/edera-splash.png"
 
 	mkdir -p "${FINAL_DIR}/efi/EFI/BOOT"
 	cp "${FINAL_DIR}/sprout.efi" "${FINAL_DIR}/efi/EFI/BOOT/${EFI_NAME}.EFI"
@@ -105,11 +113,11 @@ if [ "${SKIP_SPROUT_BUILD}" != "1" ]; then
 		cp "${FINAL_DIR}/shell.efi" "${FINAL_DIR}/efi/EFI/BOOT/SHELL.EFI"
 	fi
 	if [ -f "${FINAL_DIR}/xen.efi" ]; then
-  	cp "${FINAL_DIR}/xen.efi" "${FINAL_DIR}/efi/EFI/BOOT/XEN.EFI"
-  fi
+		cp "${FINAL_DIR}/xen.efi" "${FINAL_DIR}/efi/EFI/BOOT/XEN.EFI"
+	fi
 	if [ -f "${FINAL_DIR}/xen.cfg" ]; then
-  	cp "${FINAL_DIR}/xen.cfg" "${FINAL_DIR}/efi/EFI/BOOT/XEN.CFG"
-  fi
+		cp "${FINAL_DIR}/xen.cfg" "${FINAL_DIR}/efi/EFI/BOOT/XEN.CFG"
+	fi
 	cp "${FINAL_DIR}/sprout.toml" "${FINAL_DIR}/efi/SPROUT.TOML"
 	cp "${FINAL_DIR}/edera-splash.png" "${FINAL_DIR}/efi/EDERA-SPLASH.PNG"
 	cp "${FINAL_DIR}/initramfs" "${FINAL_DIR}/efi/INITRAMFS"
@@ -117,6 +125,8 @@ fi
 
 if [ "${SKIP_BOOT_BUILD}" != "1" ]; then
 	echo "[boot build] ${TARGET_ARCH} ${RUST_PROFILE}"
-	docker build --platform="${DOCKER_TARGET}" -t "${DOCKER_PREFIX}/sprout-boot-${TARGET_ARCH}:${DOCKER_TAG}" --build-arg "EFI_NAME=${EFI_NAME}" -f hack/dev/boot/Dockerfile "${FINAL_DIR}"
+	docker build --platform="${DOCKER_TARGET}" -t "${DOCKER_PREFIX}/sprout-boot-${TARGET_ARCH}:${DOCKER_TAG}" \
+		--build-arg "EFI_NAME=${EFI_NAME}" \
+		-f hack/dev/boot/Dockerfile "${FINAL_DIR}"
 	copy_from_image "${DOCKER_PREFIX}/sprout-boot-${TARGET_ARCH}" "sprout.img" "${FINAL_DIR}/sprout.img"
 fi
diff --git a/hack/dev/configs/kernel.sprout.toml b/hack/dev/configs/kernel.sprout.toml
index 40404fe..5b84406 100644
--- a/hack/dev/configs/kernel.sprout.toml
+++ b/hack/dev/configs/kernel.sprout.toml
@@ -8,6 +8,13 @@ chainload.path = "$boot\\EFI\\BOOT\\kernel.efi"
 chainload.options = ["console=hvc0"]
 chainload.linux-initrd = "$boot\\initramfs"
 
+[actions.chainload-xen]
+chainload.path = "$boot\\EFI\\BOOT\\xen.efi"
+
+[entries.xen]
+title = "Boot Xen"
+actions = ["chainload-xen"]
+
 [entries.kernel]
 title = "Boot Linux"
 actions = ["chainload-kernel"]
diff --git a/hack/dev/configs/xen.cfg b/hack/dev/configs/xen.cfg
index ae0ee4e..358ac4d 100644
--- a/hack/dev/configs/xen.cfg
+++ b/hack/dev/configs/xen.cfg
@@ -2,6 +2,6 @@
 default=sprout
 
 [sprout]
-options=console=hvc0
-kernel=\EFI\BOOT\KERNEL.EFI
+options=clocksource=tsc smp=on smt=on ioapic_ack=new dom0_vcpus_pin=on spec-ctrl=gds-mit=no noreboot console=com1
+kernel=\EFI\BOOT\KERNEL.EFI console=hvc0
 ramdisk=\initramfs
diff --git a/hack/dev/configs/xen.sprout.toml b/hack/dev/configs/xen.sprout.toml
new file mode 100644
index 0000000..46a2a2e
--- /dev/null
+++ b/hack/dev/configs/xen.sprout.toml
@@ -0,0 +1,11 @@
+version = 1
+
+[extractors.boot.filesystem-device-match]
+has-item = "\\EFI\\BOOT\\xen.efi"
+
+[actions.chainload-xen]
+chainload.path = "$boot\\EFI\\BOOT\\xen.efi"
+
+[entries.xen]
+title = "Boot Xen"
+actions = ["chainload-xen"]
diff --git a/hack/dev/kernel/docker-build.sh b/hack/dev/kernel/docker-build.sh
index 3d36142..982813e 100755
--- a/hack/dev/kernel/docker-build.sh
+++ b/hack/dev/kernel/docker-build.sh
@@ -29,11 +29,18 @@ else
 fi
 
 make CROSS_COMPILE="${MAYBE_CROSS_COMPILE}" ARCH="${TARGET_KARCH}" defconfig
+if [ "${TARGET_KARCH}" = "x86_64" ]
+then
+  make CROSS_COMPILE="${MAYBE_CROSS_COMPILE}" ARCH="${TARGET_KARCH}" xen.config
+  ./scripts/config -e XEN_PV
+  ./scripts/config -e XEN_PV_DOM0
+fi
 make CROSS_COMPILE="${MAYBE_CROSS_COMPILE}" ARCH="${TARGET_KARCH}" mod2yesconfig
 
 ./scripts/config -e DRM_VIRTIO_GPU
 ./scripts/config -e FRAMEBUFFER_CONSOLE
 ./scripts/config -e FRAMEBUFFER_CONSOLE_DETECT_PRIMARY
+./scripts/config -e XEN_DOM0
 
 make "-j$(nproc)" CROSS_COMPILE="${MAYBE_CROSS_COMPILE}" ARCH="${TARGET_KARCH}"
 
diff --git a/hack/dev/vm/Dockerfile.initramfs b/hack/dev/vm/Dockerfile.initramfs
index c924ed5..bfff6d9 100644
--- a/hack/dev/vm/Dockerfile.initramfs
+++ b/hack/dev/vm/Dockerfile.initramfs
@@ -1,11 +1,27 @@
+FROM alpine:3.22@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1 AS rootfs
+RUN apk --no-cache add alpine-base tzdata
+RUN rc-update add devfs sysinit && \
+    rc-update add dmesg sysinit && \
+    rc-update add mdev sysinit && \
+    rc-update add cgroups sysinit && \
+    rc-update add sysctl boot && \
+    rc-update add hostname boot && \
+    rc-update add bootmisc boot && \
+    rc-update add syslog boot && \
+    rc-update add mount-ro shutdown && \
+    rc-update add killprocs shutdown && \
+    rc-update add savecache shutdown && \
+    ln -s /sbin/init /init && \
+    echo 'root:root' | chpasswd && \
+    echo 'sprout' > /etc/hostname && \
+    echo '' > /etc/motd && \
+    ln -s /usr/share/zoneinfo/UTC /etc/localtime && \
+    echo 'hvc0::respawn:/sbin/getty -L hvc0 115200 vt100' >> /etc/inittab
+
 FROM alpine:3.22@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1 AS build
-RUN apk --no-cache add busybox-static
-RUN mkdir -p /tmp/initramfs/bin && cp /bin/busybox.static /tmp/initramfs/bin/busybox && \
-  chroot /tmp/initramfs /bin/busybox --install -s /bin && \
-  chroot /tmp/initramfs ln -s /bin/init /init && \
-  cd /tmp/initramfs && \
-  find . | cpio -R 0:0 --ignore-devno --renumber-inodes -o -H newc --quiet > /initramfs && \
-  rm -rf /tmp/initramfs
+COPY --from=rootfs / /rootfs
+WORKDIR /rootfs
+RUN find . | cpio -R 0:0 --ignore-devno --renumber-inodes -o -H newc --quiet > /initramfs
 
 FROM scratch AS final
 COPY --from=build /initramfs /initramfs
diff --git a/hack/format.sh b/hack/format.sh
index 49f5251..f9a2aa1 100755
--- a/hack/format.sh
+++ b/hack/format.sh
@@ -4,4 +4,4 @@ set -e
 cd "$(dirname "${0}")/.." || exit 1
 
 cargo fmt --all
-shfmt -w hack/*.sh
+shfmt -w hack/**/*.sh