diff --git a/devices/qemu-aarch64/default.nix b/devices/qemu-aarch64/default.nix
index 61a2e65e..63976da6 100644
--- a/devices/qemu-aarch64/default.nix
+++ b/devices/qemu-aarch64/default.nix
@@ -26,8 +26,9 @@
         PCI_HOST_GENERIC="y";
 
         MTD = "y";
-        MTD_BLOCK2MTD = "y";
         MTD_BLOCK = "y";
+        MTD_CMDLINE_PARTS = "y";
+        MTD_PHRAM = "y";
 
         VIRTIO_MENU = "y";
         PCI = "y";
diff --git a/devices/qemu/default.nix b/devices/qemu/default.nix
index 554bbbbb..3d5e7560 100644
--- a/devices/qemu/default.nix
+++ b/devices/qemu/default.nix
@@ -52,8 +52,9 @@
         CPU_MIPS32_R2= "y";
 
         MTD = "y";
-        MTD_BLOCK2MTD = "y";
         MTD_BLOCK = "y";
+        MTD_CMDLINE_PARTS = "y";
+        MTD_PHRAM = "y";
 
         VIRTIO_MENU = "y";
         PCI = "y";
diff --git a/modules/arch/mips.nix b/modules/arch/mips.nix
index fb637d6e..155c147c 100644
--- a/modules/arch/mips.nix
+++ b/modules/arch/mips.nix
@@ -10,7 +10,7 @@
       OF = "y";
       USE_OF = "y";
     };
-    hardware.ram.startAddress = lim.parseInt "0x0";
+    hardware.ram.startAddress = lim.parseInt "0x80000000";
     boot.commandLine = [
       "console=ttyS0,115200" # true of all mips we've yet encountered
     ];
diff --git a/modules/outputs.nix b/modules/outputs.nix
index 61c4efac..64dc6e47 100644
--- a/modules/outputs.nix
+++ b/modules/outputs.nix
@@ -84,6 +84,7 @@ in
             (if pkgs.stdenv.hostPlatform.isAarch
              then "${pkgs.stdenv.cc.targetPrefix}objcopy -O binary -R .comment -S ${kernel} $out"
              else "cp ${kernel} $out");
+          phram_address = lib.toHexString (config.hardware.ram.startAddress + 256 * 1024 * 1024);
         in pkgs.runCommandCC "vmroot" {} ''
           mkdir $out
           cd $out
@@ -94,7 +95,7 @@ in
           echo ${cmdline} > commandline
           cat > run.sh << EOF
           #!${pkgs.runtimeShell}
-          CMDLINE=${cmdline} ${pkgs.pkgsBuildBuild.run-liminix-vm}/bin/run-liminix-vm --arch ${pkgs.stdenv.hostPlatform.qemuArch} \$* ${makeBootableImage} ${config.system.outputs.rootfs}
+          CMDLINE=${cmdline} PHRAM_ADDRESS=0x${phram_address} ${pkgs.pkgsBuildBuild.run-liminix-vm}/bin/run-liminix-vm --arch ${pkgs.stdenv.hostPlatform.qemuArch} \$* ${makeBootableImage} ${config.system.outputs.rootfs}
           EOF
           chmod +x run.sh
        '';
diff --git a/pkgs/run-liminix-vm/run-liminix-vm.sh b/pkgs/run-liminix-vm/run-liminix-vm.sh
index 7fa6351d..637977a5 100755
--- a/pkgs/run-liminix-vm/run-liminix-vm.sh
+++ b/pkgs/run-liminix-vm/run-liminix-vm.sh
@@ -54,13 +54,14 @@ case "$arch" in
 	;;
 esac
 
-INIT=${INIT-/bin/init}
+phram="mtdparts=phram0:16M(rootfs) phram.phram=phram0,${PHRAM_ADDRESS},16Mi,65536 root=/dev/mtdblock0";
+
 set -x
 $QEMU \
-    -m 256 \
+    -m 272 \
     -echr 16 \
-    -append "$CMDLINE liminix root=/dev/mtdblock0 block2mtd.block2mtd=/dev/vda,65536" \
-    -drive file=$rootfs,format=raw,readonly=off,if=virtio,index=0 \
+    -append "$CMDLINE liminix $phram" \
+    -device loader,file=$rootfs,addr=$PHRAM_ADDRESS \
     ${initramfs} \
     -netdev socket,id=access,mcast=230.0.0.1:1234,localaddr=127.0.0.1 \
     -device virtio-net,disable-legacy=on,disable-modern=off,netdev=access,mac=ba:ad:1d:ea:21:02 \