diff --git a/flake.nix b/flake.nix
index 9e92cc8..99fce5b 100644
--- a/flake.nix
+++ b/flake.nix
@@ -18,12 +18,14 @@
         pkgs = import nixpkgs { inherit system; };
         patosPkgs = self.packages.${system};
         version = "0.0.1";
+        secureBoot = "false";
+        cpuArch = "intel";
         updateUrl = "http://10.0.2.2:8000/";
       in
       {
         packages = {
           default = patosPkgs.image;
-          image = pkgs.callPackage ./pkgs/image { inherit patosPkgs version updateUrl; };
+          image = pkgs.callPackage ./pkgs/image { inherit patosPkgs version updateUrl cpuArch secureBoot; };
           rootfs = pkgs.callPackage ./pkgs/rootfs/mkrootfs.nix { inherit patosPkgs version; };
           initrd = pkgs.callPackage ./pkgs/rootfs/mkinitrd.nix { inherit patosPkgs version; };
           kernel = pkgs.callPackage ./pkgs/kernel { };
diff --git a/pkgs/image/default.nix b/pkgs/image/default.nix
index a248a09..05d9c72 100644
--- a/pkgs/image/default.nix
+++ b/pkgs/image/default.nix
@@ -1,16 +1,21 @@
 {
+  lib,
   pkgs,
   patosPkgs,
   version,
   runCommand,
-  updateUrl
+  updateUrl,
+  cpuArch ? "",
+  secureBoot ? "false"
 }:
 let
   pname = "patos-image";
 in
 runCommand pname {
-  inherit version;
-  inherit updateUrl;
+  inherit version cpuArch updateUrl secureBoot;
+
+  microcode = lib.optionalString (cpuArch == "amd") "--microcode ${pkgs.microcode-amd}/amd-ucode.img"
+      + lib.optionalString (cpuArch == "intel") "--microcode ${pkgs.microcode-intel}/intel-ucode.img";
 
   buildInputs = with pkgs; [
     erofs-utils
@@ -25,7 +30,7 @@ runCommand pname {
     SYSTEMD_REPART_MKFS_OPTIONS_EROFS = "--all-root -zlz4hc,12 -C1048576 -Efragments,dedupe,ztailpacking";
   };
 
-  kernelCmdLine = "console=ttyS0 patos.secureboot=false";
+  kernelCmdLine = "console=ttyS0 patos.secureboot=${secureBoot}";
 }
 ''
 mkdir -p $out/init.repart.d $out/final.repart.d
@@ -176,6 +181,7 @@ ln -sf patos_$version.root.raw patos_${version}_$rootUuid.root
 ${patosPkgs.systemd}/usr/bin/ukify build \
   --linux ${patosPkgs.kernel}/bzImage \
   --initrd ${patosPkgs.initrd}/initrd.xz \
+  $microcode \
   --os-release @rootfs/etc/os-release \
   --cmdline "$kernelCmdLine roothash=$roothash" \
   -o patos_${version}.efi