diff --git a/.github/workflows/mkosi.yml b/.github/workflows/mkosi.yml
index 0e87823687..524e1e05d3 100644
--- a/.github/workflows/mkosi.yml
+++ b/.github/workflows/mkosi.yml
@@ -74,7 +74,7 @@ jobs:
 
     steps:
     - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633
-    - uses: systemd/mkosi@1099ead1ccaa11b62b7a16ee312193bd0e6b6404
+    - uses: systemd/mkosi@5fd70560a1b1ac854b9e1c5a450df311f9000121
 
     # Freeing up disk space with rm -rf can take multiple minutes. Since we don't need the extra free space
     # immediately, we remove the files in the background. However, we first move them to a different location
@@ -100,7 +100,6 @@ jobs:
         ToolsTree=default
         ToolsTreeDistribution=fedora
         QemuVsock=yes
-        # Sometimes we run on a host with /dev/kvm, but it is broken, so explicitly disable it
         QemuKvm=yes
         # TODO: Drop once https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2038777 is fixed in Github Actions
         QemuFirmware=uefi
@@ -112,6 +111,7 @@ jobs:
         tee mkosi.conf.d/99-ci.conf <<EOF
         [Host]
         KernelCommandLineExtra=systemd.unit=mkosi-check-and-shutdown.service
+                               systemd.log_level=debug
                                systemd.journald.max_level_console=debug
                                # udev's debug log output is very verbose, so up it to info in CI.
                                udev.log_level=info
diff --git a/mkosi.conf b/mkosi.conf
index cea204961b..96843db488 100644
--- a/mkosi.conf
+++ b/mkosi.conf
@@ -2,7 +2,7 @@
 
 [Config]
 Images=system
-MinimumVersion=21
+MinimumVersion=23~devel
 
 [Output]
 @OutputDirectory=mkosi.output
@@ -22,7 +22,7 @@ BuildSourcesEphemeral=yes
 @RuntimeSize=8G
 ToolsTreePackages=virtiofsd
 KernelCommandLineExtra=systemd.crash_shell
-                       systemd.log_level=debug
+                       systemd.log_level=debug,console:info
                        systemd.log_ratelimit_kmsg=0
                        systemd.journald.forward_to_console
                        systemd.journald.max_level_console=warning
diff --git a/mkosi.images/system/mkosi.conf b/mkosi.images/system/mkosi.conf
index 7aa64c4e0e..303af4acb1 100644
--- a/mkosi.images/system/mkosi.conf
+++ b/mkosi.images/system/mkosi.conf
@@ -1,8 +1,5 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 
-[Config]
-InitrdInclude=initrd/
-
 [Output]
 @Format=directory
 
diff --git a/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.conf b/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.conf
index e9aa4080da..92d58292f4 100644
--- a/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.conf
+++ b/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.conf
@@ -4,9 +4,12 @@
 Distribution=arch
 
 [Content]
-Environment=
-        SYSTEMD_PACKAGES="systemd systemd-ukify systemd-sysvcompat systemd-resolvconf systemd-tests"
-        INITRD_PACKAGES="systemd systemd-sysvcompat"
+VolatilePackages=
+        systemd
+        systemd-ukify
+        systemd-sysvcompat
+        systemd-resolvconf
+        systemd-tests
 
 Packages=
         bpf
@@ -39,3 +42,7 @@ Packages=
 InitrdPackages=
         btrfs-progs
         tpm2-tools
+
+InitrdVolatilePackages=
+        systemd
+        systemd-sysvcompat
diff --git a/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf b/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf
index 277d17d25c..cc9f3e9d11 100644
--- a/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf
+++ b/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf
@@ -5,21 +5,20 @@ Distribution=|centos
 Distribution=|fedora
 
 [Content]
-Environment=
-        SYSTEMD_PACKAGES="systemd
-                          systemd-udev
-                          systemd-container
-                          systemd-repart
-                          systemd-resolved
-                          systemd-networkd
-                          systemd-boot
-                          systemd-tests
-                          systemd-ukify
-                          systemd-pam
-                          systemd-oomd-defaults
-                          systemd-journal-remote
-                          systemd-networkd-defaults"
-        INITRD_PACKAGES="systemd systemd-udev"
+VolatilePackages=
+        systemd
+        systemd-udev
+        systemd-container
+        systemd-repart
+        systemd-resolved
+        systemd-networkd
+        systemd-boot
+        systemd-tests
+        systemd-ukify
+        systemd-pam
+        systemd-oomd-defaults
+        systemd-journal-remote
+        systemd-networkd-defaults
 
 Packages=
         bpftool
@@ -57,3 +56,7 @@ Packages=
 
 InitrdPackages=
         tpm2-tools
+
+InitrdVolatilePackages=
+        systemd
+        systemd-udev
diff --git a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf b/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf
index b6f7fdd926..7ece67705a 100644
--- a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf
+++ b/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf
@@ -5,22 +5,21 @@ Distribution=|debian
 Distribution=|ubuntu
 
 [Content]
-Environment=
-        SYSTEMD_PACKAGES="systemd
-                          systemd-userdbd
-                          systemd-oomd
-                          systemd-sysv
-                          systemd-tests
-                          systemd-timesyncd
-                          systemd-resolved
-                          systemd-homed
-                          systemd-coredump
-                          systemd-journal-remote
-                          systemd-container
-                          systemd-boot
-                          systemd-ukify
-                          udev"
-        INITRD_PACKAGES="systemd udev"
+VolatilePackages=
+        systemd
+        systemd-userdbd
+        systemd-oomd
+        systemd-sysv
+        systemd-tests
+        systemd-timesyncd
+        systemd-resolved
+        systemd-homed
+        systemd-coredump
+        systemd-journal-remote
+        systemd-container
+        systemd-boot
+        systemd-ukify
+        udev
 
 Packages=
         ^libasan[0-9]+$
@@ -57,3 +56,7 @@ Packages=
 InitrdPackages=
         btrfs-progs
         tpm2-tools
+
+InitrdVolatilePackages=
+        systemd
+        udev
diff --git a/mkosi.images/system/initrd/mkosi.postinst b/mkosi.images/system/mkosi.conf.d/10-opensuse/initrd/mkosi.postinst
similarity index 82%
rename from mkosi.images/system/initrd/mkosi.postinst
rename to mkosi.images/system/mkosi.conf.d/10-opensuse/initrd/mkosi.postinst
index b92bb8ae29..417132f3dd 100755
--- a/mkosi.images/system/initrd/mkosi.postinst
+++ b/mkosi.images/system/mkosi.conf.d/10-opensuse/initrd/mkosi.postinst
@@ -2,9 +2,6 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 set -e
 
-# shellcheck disable=SC2086
-mkosi-install $INITRD_PACKAGES
-
 # OpenSUSE insists on blacklisting erofs by default because its supposedly a legacy filesystem.
 # See https://github.com/openSUSE/suse-module-tools/pull/71
 rm -f "$BUILDROOT/usr/lib/modprobe.d/60-blacklist_fs-erofs.conf"
diff --git a/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.conf b/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.conf
index 5d04718ef5..24d69ccc27 100644
--- a/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.conf
+++ b/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.conf
@@ -3,19 +3,21 @@
 [Match]
 Distribution=opensuse
 
+[Config]
+InitrdInclude=initrd/
+
 [Content]
-Environment=
-        SYSTEMD_PACKAGES="systemd
-                          udev
-                          systemd-experimental
-                          systemd-boot
-                          systemd-container
-                          systemd-homed
-                          systemd-network
-                          systemd-portable
-                          systemd-sysvcompat
-                          systemd-testsuite"
-        INITRD_PACKAGES="systemd udev systemd-experimental"
+VolatilePackages=
+        systemd
+        udev
+        systemd-experimental
+        systemd-boot
+        systemd-container
+        systemd-homed
+        systemd-network
+        systemd-portable
+        systemd-sysvcompat
+        systemd-testsuite
 
 # We install gawk, gzip, grep, xz, sed, rsync and docbook-xsl-stylesheets here explicitly so that the busybox
 # versions don't get installed instead.
@@ -57,3 +59,8 @@ InitrdPackages=
         kmod
         libkmod2
         tpm2.0-tools
+
+InitrdVolatilePackages=
+        systemd
+        udev
+        systemd-experimental
diff --git a/mkosi.images/system/mkosi.postinst b/mkosi.images/system/mkosi.postinst
deleted file mode 100755
index caaf253ef6..0000000000
--- a/mkosi.images/system/mkosi.postinst
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/bin/bash
-# SPDX-License-Identifier: LGPL-2.1-or-later
-set -e
-
-# shellcheck disable=SC2086
-mkosi-install $SYSTEMD_PACKAGES