diff --git a/flake.nix b/flake.nix
index a09ffdd..3a678da 100644
--- a/flake.nix
+++ b/flake.nix
@@ -342,6 +342,25 @@
                   fileSystems."/".device = lib.mkForce "/dev/disk/by-label/nixos-usb";
                   fileSystems."/boot".device = lib.mkForce "/dev/disk/by-label/ESP-USB";
                   system.autoUpgrade.enable = lib.mkForce false;
+
+                  # The Sintra's Aaeon firmware USB-boots in Legacy/BIOS mode — it
+                  # boots the live ISO via its isolinux (BIOS) El Torito image, not
+                  # the UEFI ESP. systemd-boot is UEFI-only, so a dd'd systemd-boot
+                  # image isn't recognised as bootable. Switch THIS USB image to
+                  # GRUB with BOTH BIOS (MBR + bios_grub partition, via the "hybrid"
+                  # table below) and UEFI (removable /EFI/BOOT/BOOTX64.EFI) — mirroring
+                  # the live ISO's dual boot — so it boots on Legacy and UEFI alike.
+                  # Scoped to the USB image; the eMMC install keeps systemd-boot.
+                  boot.loader.systemd-boot.enable = lib.mkForce false;
+                  boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
+                  boot.loader.grub = {
+                    enable = lib.mkForce true;
+                    efiSupport = true;
+                    efiInstallAsRemovable = true;
+                    # make-disk-image's build VM exposes the image as /dev/vda;
+                    # GRUB installs its BIOS stage to that disk's MBR.
+                    devices = lib.mkForce [ "/dev/vda" ];
+                  };
                 })
               ];
             };
@@ -349,7 +368,8 @@
               inherit pkgs lib;
               config = cfg.config;
               format = "raw";
-              partitionTableType = "efi";
+              # hybrid = GPT + bios_grub partition + ESP → BIOS + UEFI bootable.
+              partitionTableType = "hybrid";
               diskSize = "auto";
               label = "nixos-usb"; # ext4 root label (make-disk-image -L)
             };