diff --git a/devices/openwrt-one/default.nix b/devices/openwrt-one/default.nix
index 7d6d694e..a0a2b29a 100644
--- a/devices/openwrt-one/default.nix
+++ b/devices/openwrt-one/default.nix
@@ -28,11 +28,42 @@
     Installation
     ============
 
-    - build the default output (the FIT image)
-    - rename it to 'openwrt-mediatek-filogic-openwrt_one-squashfs-sysupgrade.itb'
-    - start a TFTP server
-    - use 'Load production system via TFTP then write to NAND' and 'Boot production system from NAND'
-      from the serial uboot menu
+      TODO: add instructions on how to boot directly from TFTP to memory
+      and how to install from TFTP to flash without going through OpenWrt.
+
+      The instructions below assume you can boot and SSH into OpenWrt:
+
+      Boot into OpenWrt and create a 'liminix' UBI partition:
+
+        root@OpenWrt:~# ubimkvol /dev/ubi0 --name=liminix --maxavsize
+
+    Remember the 'Volume ID' that was created for this new partition
+
+    Build the UBI image and write it to this new partition:
+
+        $ nix-build -I liminix-config=./my-configuration.nix  --arg device "import ./devices/belkin-rt3200" -A outputs.default
+        $ cat result/rootfs | ssh root@192.168.1.1 "cat > /tmp/rootfs"
+        $ ssh root@192.168.1.1
+        root@OpenWrt:~# ubiupdatevol /dev/ubi0_X /tmp/rootfs # replace X with the volume id, if needed check with `ubinfo`
+
+    Reboot into the U-Boot prompt and boot with:
+
+        OpenWrt One> ubifsmount ubi0:liminix && ubifsload ''${loadaddr} boot/fit && bootm ''${loadaddr}'
+
+    If this works, reboot into OpenWrt and configure U-Boot to boot ubifs by default:
+
+        root@OpenWrt:~# fw_setenv orig_boot_production $(fw_printenv -n boot_production)
+        root@OpenWrt:~# fw_setenv boot_production 'led white on ; ubifsmount ubi0:liminix && ubifsload ''${loadaddr} boot/fit && bootm ''${loadaddr}'
+
+    Troubleshooting
+    ===============
+
+      The instructions above assume you can boot and SSH into the (recovery)
+      OpenWrt installation. If you have broken your device to the point where that
+      is no longer possible, you could re-install OpenWrt, but probably you could
+      also install directly from U-Boot:
+
+        https://github.com/u-boot/u-boot/blob/master/doc/README.ubi
   '';
 
   system = {
@@ -73,6 +104,7 @@
       imports = [
         ../../modules/arch/aarch64.nix
         ../../modules/outputs/tftpboot.nix
+        ../../modules/outputs/ubifs.nix
       ];
       config = {
         kernel = {
@@ -581,7 +613,9 @@
             loadAddress = lim.parseInt "0x46000000";
           };
           imageFormat = "fit";
+          loader.fit.enable = lib.mkDefault true; # override this if you are building tftpboot
         };
+        rootfsType = lib.mkDefault "ubifs"; # override this if you are building tftpboot
         filesystem =
         let inherit (pkgs.pseudofile) dir symlink;
              in
@@ -656,14 +690,22 @@
             # mtd5: 0ff00000 00020000 "ubi"
             eraseBlockSize = 65536;
           };
+          ubi = {
+            # TODO taken from belkin-rt3200, to review
+            minIOSize = "2048";
+            logicalEraseBlockSize = "126976";
+            physicalEraseBlockSize = "131072";
+            maxLEBcount = "1024"; # guessing
+          };
 
-          defaultOutput = "uimage";
+
+          defaultOutput = "ubimage";
           loadAddress = lim.parseInt "0x44000000";
           entryPoint = lim.parseInt "0x44000000";
           # TODO AFAICT this should be 2048, but I got 'FIT: image rootfs-1 start not aligned to page boundaries' with that...
           #alignment = 2048;
           alignment = 4096;
-          rootDevice = "/dev/fit0";
+          rootDevice = "ubi0:liminix";
           dts = {
             src = "${openwrt.src}/target/linux/mediatek/dts/mt7981b-openwrt-one.dts";
             includePaths = [
diff --git a/modules/outputs/uimage.nix b/modules/outputs/uimage.nix
index ec25f1ec..b36ef60a 100644
--- a/modules/outputs/uimage.nix
+++ b/modules/outputs/uimage.nix
@@ -25,6 +25,6 @@ in
     inherit (config.boot) commandLineDtbNode;
     inherit (config.hardware) loadAddress entryPoint alignment;
     inherit (config.boot) imageFormat;
-    inherit (o) kernel dtb rootfs;
+    inherit (o) kernel dtb;
   };
 }
diff --git a/pkgs/kernel/uimage.nix b/pkgs/kernel/uimage.nix
index 8657a55b..001f9c97 100644
--- a/pkgs/kernel/uimage.nix
+++ b/pkgs/kernel/uimage.nix
@@ -22,7 +22,6 @@ in {
 , imageFormat
 , alignment ? null
 , dtb ? null
-, rootfs
 } : stdenv.mkDerivation {
   name = "kernel.image";
   phases = [
@@ -54,7 +53,6 @@ in {
 
   buildPhaseFIT = ''
     ${stripAndZip}
-    cp ${rootfs} rootfs
     cat ${./kernel_fdt.its} > mkimage.its
     cat << _VARS  >> mkimage.its
     / {
@@ -70,22 +68,6 @@ in {
                 data = /incbin/("./tmp.dtb");
                 arch = "${arch}";
             };
-            rootfs-1 {
-                description = "Liminix rootfs";
-                data = /incbin/("./rootfs");
-                type = "filesystem";
-                hash-1 {
-                        algo = "crc32";
-                };
-                hash-2 {
-                        algo = "sha1";
-                };
-            };
-        };
-        configurations {
-            config-1 {
-                loadables = "rootfs-1";
-            };
         };
     };
     _VARS