diff --git a/devices/tp-archer-ax23/default.nix b/devices/tp-archer-ax23/default.nix
index 2357e69..d240812 100644
--- a/devices/tp-archer-ax23/default.nix
+++ b/devices/tp-archer-ax23/default.nix
@@ -337,6 +337,8 @@
             # to 0x8800000. Let's put it at the 100MB mark at
             # 0x8000000+0x0640000=0x86400000
             loadAddress = lim.parseInt "0x86400000";
+            compressRoot = true;
+            replaceDtb = true;
           };
         };
         filesystem =
diff --git a/examples/ax23-extneder.nix b/examples/ax23-extneder.nix
index 388e957..1e0928f 100644
--- a/examples/ax23-extneder.nix
+++ b/examples/ax23-extneder.nix
@@ -28,6 +28,11 @@ in rec {
 
   hostname = "yardbird";
 
+  boot.tftp = {
+    serverip = "192.168.0.1";
+    ipaddr = "192.168.0.2";
+  };
+
   services.hostap = svc.hostapd.build {
     interface = config.hardware.networkInterfaces.wlan;
     params = {
diff --git a/modules/outputs/tftpboot.nix b/modules/outputs/tftpboot.nix
index 36d96ff..bf5a77e 100644
--- a/modules/outputs/tftpboot.nix
+++ b/modules/outputs/tftpboot.nix
@@ -22,6 +22,16 @@ in {
       type = types.bool;
       default = false;
     };
+    replaceDtb = mkOption {
+      description = ''
+        Replace DTB instead of overriding it.
+
+        Useful for older versions of uboot that don't support
+        overriding the DTB from the bootm/bootz command line.
+      '';
+      type = types.bool;
+      default = false;
+    };
   };
   options.system.outputs = {
     tftpboot = mkOption {
@@ -63,8 +73,13 @@ in {
             zimage = "bootz";
           }; in choices.${cfg.kernelFormat};
           cmdline = concatStringsSep " " config.boot.commandLine;
+          objcopy = "${pkgs.stdenv.cc.bintools.targetPrefix}objcopy";
+          stripAndZip = ''
+            ${objcopy} -O binary -R .reginfo -R .notes -R .note -R .comment -R .mdebug -R .note.gnu.build-id -S vmlinux.elf vmlinux.bin
+            rm -f vmlinux.bin.lzma ; lzma -k -z  vmlinux.bin
+          '';
         in
-          pkgs.runCommand "tftpboot" { nativeBuildInputs = with pkgs.pkgsBuildBuild; [ lzma dtc ];  } ''
+          pkgs.runCommand "tftpboot" { nativeBuildInputs = with pkgs.pkgsBuildBuild; [ lzma dtc pkgs.stdenv.cc ubootTools ];  } ''
             mkdir $out
             cd $out
             binsize() { local s=$(stat -L -c %s $1); echo $(($s + 0x1000 &(~0xfff))); }
@@ -77,12 +92,19 @@ in {
             imageSize=$(binsize ${image})
 
             ln -s ${o.manifest} manifest
-            ln -s ${image} image
             ln -s ${o.kernel} vmlinux  # handy for gdb
 
+            ${if cfg.compressRoot && cfg.replaceDtb
+              then ''
+                echo "Having both compressRoot and replaceDtb enabled is not currently supported"
+                exit 1
+              '' else ""
+            }
+
             ${if cfg.compressRoot
               then ''
                 lzma -z9cv ${o.rootfs} > rootfs.lz
+                # TODO this is no longer correct
                 rootfsLzStart=$(($imageStart + $imageSize))
                 rootfsLzSize=$(binsize rootfs.lz)
               ''
@@ -107,6 +129,13 @@ in {
             cmd="liminix ${cmdline} mtdparts=phram0:''${rootfsSize}(rootfs) phram.phram=phram0,''${rootfsStart},''${rootfsSize},${toString config.hardware.flash.eraseBlockSize} root=/dev/mtdblock0";
             fdtput -t s dtb /chosen bootargs "$cmd"
 
+            # re-package image with updated dtb
+            cp ${o.kernel} vmlinux.elf; chmod +w vmlinux.elf
+            ${objcopy} --update-section .appended_dtb=dtb vmlinux.elf
+            ${stripAndZip}
+            # TODO don't hardcode mips, entryPoint, loadAddress, name
+            mkimage -A mips -O linux -T kernel -C lzma -a 0x80001000 -e 0x80001000 -n 'MIPS Liminix Linux' -d vmlinux.bin.lzma image
+
             # dtc -I dtb -O dts -o /dev/stdout dtb | grep -A10 chosen ; exit 1
 
             cat > boot.scr << EOF