diff --git a/.github/workflows/build_test.sh b/.github/workflows/build_test.sh
index d070410f80..b6b2d08e50 100755
--- a/.github/workflows/build_test.sh
+++ b/.github/workflows/build_test.sh
@@ -43,7 +43,6 @@ PACKAGES=(
     libqrencode-dev
     libssl-dev
     libtss2-dev
-    libxen-dev
     libxkbcommon-dev
     libxtables-dev
     libzstd-dev
@@ -69,6 +68,10 @@ COMPILER_VERSION="${COMPILER_VERSION:?}"
 LINKER="${LINKER:?}"
 RELEASE="$(lsb_release -cs)"
 
+if [ "$(uname -m)" = "aarch64" ] || [ "$(uname -m)" = "x86_64" ]; then
+    PACKAGES+=(libxen-dev)
+fi
+
 # Note: As we use postfixed clang/gcc binaries, we need to override $AR
 #       as well, otherwise meson falls back to ar from binutils which
 #       doesn't work with LTO
@@ -95,7 +98,7 @@ if [[ "$COMPILER" == clang ]]; then
             sudo tee /etc/apt/sources.list.d/llvm-toolchain.list
     fi
 
-    PACKAGES+=("clang-$COMPILER_VERSION" "lldb-$COMPILER_VERSION" "python3-lldb-$COMPILER_VERSION" "lld-$COMPILER_VERSION" "clangd-$COMPILER_VERSION")
+    PACKAGES+=("clang-$COMPILER_VERSION" "lldb-$COMPILER_VERSION" "python3-lldb-$COMPILER_VERSION" "lld-$COMPILER_VERSION" "clangd-$COMPILER_VERSION" "llvm-$COMPILER_VERSION")
 elif [[ "$COMPILER" == gcc ]]; then
     CC="gcc-$COMPILER_VERSION"
     CXX="g++-$COMPILER_VERSION"
@@ -109,7 +112,11 @@ elif [[ "$COMPILER" == gcc ]]; then
         sudo add-apt-repository -y --no-update ppa:ubuntu-toolchain-r/test
     fi
 
-    PACKAGES+=("gcc-$COMPILER_VERSION" "gcc-$COMPILER_VERSION-multilib")
+    PACKAGES+=("gcc-$COMPILER_VERSION")
+    if [ "$(uname -m)" = "x86_64" ]; then
+        # Only needed for ia32 EFI builds
+        PACKAGES+=("gcc-$COMPILER_VERSION-multilib")
+    fi
 else
     fatal "Unknown compiler: $COMPILER"
 fi
diff --git a/.github/workflows/unit_tests.sh b/.github/workflows/unit_tests.sh
index 477995eafa..7bebea682b 100755
--- a/.github/workflows/unit_tests.sh
+++ b/.github/workflows/unit_tests.sh
@@ -19,12 +19,11 @@ ADDITIONAL_DEPS=(
     libxkbcommon-dev
     libzstd-dev
     python3-libevdev
-    python3-pefile
+    python3-pip
     python3-pyelftools
     python3-pyparsing
     python3-pytest
     rpm
-    systemd-boot-efi
     zstd
 )
 
@@ -43,6 +42,11 @@ set -ex
 
 MESON_ARGS=()
 
+if [ "$(uname -m)" = "aarch64" ] || [ "$(uname -m)" = "x86_64" ]; then
+    ADDITIONAL_DEPS+=(python3-pefile)
+    ADDITIONAL_DEPS+=(systemd-boot-efi)
+fi
+
 # (Re)set the current oom-{score-}adj. For some reason root on GH actions is able to _decrease_
 # its oom-score even after dropping all capabilities (including CAP_SYS_RESOURCE), until the
 # score is explicitly changed after sudo. No idea what's going on, but it breaks
diff --git a/mkosi/mkosi.conf.d/centos-fedora/mkosi.conf b/mkosi/mkosi.conf.d/centos-fedora/mkosi.conf
index 2b87dfaf22..69d1c22975 100644
--- a/mkosi/mkosi.conf.d/centos-fedora/mkosi.conf
+++ b/mkosi/mkosi.conf.d/centos-fedora/mkosi.conf
@@ -8,7 +8,6 @@ Distribution=|fedora
 PrepareScripts=systemd.prepare
 VolatilePackages=
         systemd
-        systemd-boot
         systemd-container
         systemd-devel
         systemd-journal-remote
diff --git a/mkosi/mkosi.conf.d/centos/mkosi.conf.d/20-efi.conf b/mkosi/mkosi.conf.d/centos/mkosi.conf.d/20-efi.conf
new file mode 100644
index 0000000000..edefbe7977
--- /dev/null
+++ b/mkosi/mkosi.conf.d/centos/mkosi.conf.d/20-efi.conf
@@ -0,0 +1,18 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Repositories=epel
+Architecture=|x86
+Architecture=|x86-64
+Architecture=|arm
+Architecture=|arm64
+Architecture=|riscv32
+Architecture=|riscv64
+Architecture=|loongarch64
+
+[Content]
+Packages=
+        sbsigntools
+
+VolatilePackages=
+        systemd-boot
diff --git a/mkosi/mkosi.conf.d/centos/mkosi.conf.d/20-epel-packages.conf b/mkosi/mkosi.conf.d/centos/mkosi.conf.d/20-epel-packages.conf
index 11dc96918a..6bcc663e59 100644
--- a/mkosi/mkosi.conf.d/centos/mkosi.conf.d/20-epel-packages.conf
+++ b/mkosi/mkosi.conf.d/centos/mkosi.conf.d/20-epel-packages.conf
@@ -10,4 +10,3 @@ Packages=
         erofs-utils
         knot
         qrencode
-        sbsigntools
diff --git a/mkosi/mkosi.conf.d/debian-ubuntu/mkosi.conf.d/debug.conf b/mkosi/mkosi.conf.d/debian-ubuntu/mkosi.conf.d/debug.conf
index 2bb6164aa4..78e5e78cef 100644
--- a/mkosi/mkosi.conf.d/debian-ubuntu/mkosi.conf.d/debug.conf
+++ b/mkosi/mkosi.conf.d/debian-ubuntu/mkosi.conf.d/debug.conf
@@ -13,7 +13,6 @@ VolatilePackages=
         libsystemd-shared-dbgsym
         libsystemd0-dbgsym
         libudev1-dbgsym
-        systemd-boot-dbgsym
         systemd-container-dbgsym
         systemd-coredump-dbgsym
         systemd-cryptsetup-dbgsym
diff --git a/mkosi/mkosi.conf.d/debian-ubuntu/mkosi.conf.d/efi-debug.conf b/mkosi/mkosi.conf.d/debian-ubuntu/mkosi.conf.d/efi-debug.conf
new file mode 100644
index 0000000000..b6422af16a
--- /dev/null
+++ b/mkosi/mkosi.conf.d/debian-ubuntu/mkosi.conf.d/efi-debug.conf
@@ -0,0 +1,17 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Environment=WITH_DEBUG=1
+
+[Match]
+Architecture=|x86
+Architecture=|x86-64
+Architecture=|arm
+Architecture=|arm64
+Architecture=|riscv32
+Architecture=|riscv64
+Architecture=|loongarch64
+
+[Content]
+VolatilePackages=
+        systemd-boot-dbgsym
diff --git a/mkosi/mkosi.conf.d/fedora/mkosi.conf b/mkosi/mkosi.conf.d/fedora/mkosi.conf
index adb7779a1e..b954d2802a 100644
--- a/mkosi/mkosi.conf.d/fedora/mkosi.conf
+++ b/mkosi/mkosi.conf.d/fedora/mkosi.conf
@@ -21,5 +21,4 @@ Packages=
         knot
         qrencode
         rpmautospec
-        sbsigntools
         scsi-target-utils
diff --git a/mkosi/mkosi.conf.d/fedora/mkosi.conf.d/efi.conf b/mkosi/mkosi.conf.d/fedora/mkosi.conf.d/efi.conf
new file mode 100644
index 0000000000..44de850ee0
--- /dev/null
+++ b/mkosi/mkosi.conf.d/fedora/mkosi.conf.d/efi.conf
@@ -0,0 +1,18 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Distribution=fedora
+Architecture=|x86
+Architecture=|x86-64
+Architecture=|arm
+Architecture=|arm64
+Architecture=|riscv32
+Architecture=|riscv64
+Architecture=|loongarch64
+
+[Content]
+Packages=
+        sbsigntools
+
+VolatilePackages=
+        systemd-boot
diff --git a/mkosi/mkosi.conf.d/opensuse/mkosi.conf b/mkosi/mkosi.conf.d/opensuse/mkosi.conf
index fbfa476bfb..24cafd55e4 100644
--- a/mkosi/mkosi.conf.d/opensuse/mkosi.conf
+++ b/mkosi/mkosi.conf.d/opensuse/mkosi.conf
@@ -16,7 +16,6 @@ VolatilePackages=
         libsystemd0
         libudev1
         systemd
-        systemd-boot
         systemd-container
         systemd-devel
         systemd-doc
@@ -71,7 +70,6 @@ Packages=
         qrencode
         quota
         rsync
-        sbsigntools
         sed
         shadow
         softhsm
diff --git a/mkosi/mkosi.conf.d/opensuse/mkosi.conf.d/debug.conf b/mkosi/mkosi.conf.d/opensuse/mkosi.conf.d/debug.conf
index ac39456bea..4614ea06a2 100644
--- a/mkosi/mkosi.conf.d/opensuse/mkosi.conf.d/debug.conf
+++ b/mkosi/mkosi.conf.d/opensuse/mkosi.conf.d/debug.conf
@@ -7,7 +7,6 @@ Environment=WITH_DEBUG=1
 VolatilePackages=
         libsystemd0-debuginfo
         libudev1-debuginfo
-        systemd-boot-debuginfo
         systemd-container-debuginfo
         systemd-debuginfo
         systemd-debugsource
diff --git a/mkosi/mkosi.conf.d/opensuse/mkosi.conf.d/efi-debug.conf b/mkosi/mkosi.conf.d/opensuse/mkosi.conf.d/efi-debug.conf
new file mode 100644
index 0000000000..b63e00be5e
--- /dev/null
+++ b/mkosi/mkosi.conf.d/opensuse/mkosi.conf.d/efi-debug.conf
@@ -0,0 +1,17 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Environment=WITH_DEBUG=1
+
+[Match]
+Architecture=|x86
+Architecture=|x86-64
+Architecture=|arm
+Architecture=|arm64
+Architecture=|riscv32
+Architecture=|riscv64
+Architecture=|loongarch64
+
+[Content]
+VolatilePackages=
+        systemd-boot-debuginfo
diff --git a/mkosi/mkosi.conf.d/opensuse/mkosi.conf.d/efi.conf b/mkosi/mkosi.conf.d/opensuse/mkosi.conf.d/efi.conf
new file mode 100644
index 0000000000..7ee6b4eaf7
--- /dev/null
+++ b/mkosi/mkosi.conf.d/opensuse/mkosi.conf.d/efi.conf
@@ -0,0 +1,18 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Distribution=opensuse
+Architecture=|x86
+Architecture=|x86-64
+Architecture=|arm
+Architecture=|arm64
+Architecture=|riscv32
+Architecture=|riscv64
+Architecture=|loongarch64
+
+[Content]
+VolatilePackages=
+        systemd-boot
+
+Packages=
+        sbsigntools
diff --git a/mkosi/mkosi.images/build/mkosi.conf.d/debian-ubuntu/mkosi.conf b/mkosi/mkosi.images/build/mkosi.conf.d/debian-ubuntu/mkosi.conf
index ee71965f29..240f357b98 100644
--- a/mkosi/mkosi.images/build/mkosi.conf.d/debian-ubuntu/mkosi.conf
+++ b/mkosi/mkosi.images/build/mkosi.conf.d/debian-ubuntu/mkosi.conf
@@ -13,5 +13,5 @@ Packages=
         clangd
         erofs-utils
         git-core
-        libclang-rt-dev
+        ?exact-name(libclang-rt-dev)
         dpkg-dev
diff --git a/mkosi/mkosi.images/initrd/mkosi.conf.d/opensuse.conf b/mkosi/mkosi.images/initrd/mkosi.conf.d/opensuse.conf
index b43bc43631..add9983ea9 100644
--- a/mkosi/mkosi.images/initrd/mkosi.conf.d/opensuse.conf
+++ b/mkosi/mkosi.images/initrd/mkosi.conf.d/opensuse.conf
@@ -14,7 +14,6 @@ VolatilePackages=
         libsystemd0
         libudev1
         systemd
-        systemd-boot # TODO: Drop once opensuse moves the systemd-stub tmpfiles snippet back to the systemd package
         # Pull in systemd-container so that the import-generator is available
         systemd-container
         systemd-experimental