diff --git a/hack/configs/kernel.sprout.toml b/hack/configs/kernel.sprout.toml
index 0a1c2c6..f7768f8 100644
--- a/hack/configs/kernel.sprout.toml
+++ b/hack/configs/kernel.sprout.toml
@@ -1,7 +1,7 @@
 version = 1
 
 [values]
-default-options = "initrd=\\initramfs init=/bin/sh console=hvc0"
+default-options = "initrd=\\initramfs console=hvc0"
 
 [actions.welcome]
 print.text = "Welcome to Sprout!"
diff --git a/src/actions/chainload.rs b/src/actions/chainload.rs
index a63e047..3962a97 100644
--- a/src/actions/chainload.rs
+++ b/src/actions/chainload.rs
@@ -47,33 +47,33 @@ pub fn chainload(context: Rc<SproutContext>, configuration: &ChainloadConfigurat
         .map(|item| context.stamp(item))
         .collect::<Vec<_>>()
         .join(" ");
+
+    let mut options_holder: Option<Box<CString16>> = None;
     if !options.is_empty() {
         let options = Box::new(
             CString16::try_from(&options[..])
                 .context("unable to convert chainloader options to CString16")?,
         );
-        info!("options: {}", options);
 
-        // TODO(azenla): Free this memory, if possible.
-        // The lifetime of the pointer needs ot outlive start_image.
-        // Maybe consider moving this up.
-        let options = Box::leak(options);
+        info!("options: {}", options);
 
         if options.num_bytes() > u32::MAX as usize {
             bail!("chainloader options too large");
         }
 
-        // SAFETY: options size is checked to validate it is safe to pass.
-        // Additionally, the pointer is allocated and retained on the heap which makes
-        // passing the options pointer safe to the next image.
+        // SAFETY: option size is checked to validate it is safe to pass.
+        // Additionally, the pointer is allocated and retained on heap, which makes
+        // passing the `options` pointer safe to the next image.
         unsafe {
             loaded_image_protocol
                 .set_load_options(options.as_ptr() as *const u8, options.num_bytes() as u32);
         }
+        options_holder = Some(options);
     }
 
     let (base, size) = loaded_image_protocol.info();
     info!("loaded image: base={:#x} size={:#x}", base.addr(), size);
     uefi::boot::start_image(image).context("failed to start image")?;
+    drop(options_holder);
     Ok(())
 }
diff --git a/vm/Dockerfile.initramfs b/vm/Dockerfile.initramfs
index fc1d188..c924ed5 100644
--- a/vm/Dockerfile.initramfs
+++ b/vm/Dockerfile.initramfs
@@ -2,7 +2,7 @@ FROM alpine:3.22@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c4
 RUN apk --no-cache add busybox-static
 RUN mkdir -p /tmp/initramfs/bin && cp /bin/busybox.static /tmp/initramfs/bin/busybox && \
   chroot /tmp/initramfs /bin/busybox --install -s /bin && \
-  chroot /tmp/initramfs ln -s /bin/sh /init && \
+  chroot /tmp/initramfs ln -s /bin/init /init && \
   cd /tmp/initramfs && \
   find . | cpio -R 0:0 --ignore-devno --renumber-inodes -o -H newc --quiet > /initramfs && \
   rm -rf /tmp/initramfs