diff --git a/.gitignore b/.gitignore
index 1b35fa9..ee652d6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -30,6 +30,10 @@ boot-tools/
 
 # WinPE boot files (wimboot, boot.wim, BCD, ipxe.efi, etc.)
 boot-files/
+# Exception: track undionly.kpxe (open-source iPXE BIOS-mode NBP for
+# legacy PXE clients, ~70KB, from boot.ipxe.org). Makes air-gapped USB
+# build self-contained without a separate fetch step.
+!boot-files/undionly.kpxe
 
 # Python wheels for offline install (built by download-packages.sh)
 pip-wheels/
@@ -77,6 +81,6 @@ secrets.yml
 *_secret
 *_secrets
 credentials.json
-
-# Pre-staged binary (142 MB) - track via LFS or stage on PXE server, not in regular git
-playbook/shopfloor-setup/Shopfloor/PrinterInstallerMap.exe
+
+# Pre-staged binary (142 MB) - track via LFS or stage on PXE server, not in regular git
+playbook/shopfloor-setup/Shopfloor/PrinterInstallerMap.exe
diff --git a/boot-files/undionly.kpxe b/boot-files/undionly.kpxe
new file mode 100644
index 0000000..dd8c479
Binary files /dev/null and b/boot-files/undionly.kpxe differ
diff --git a/playbook/pxe_server_setup.yml b/playbook/pxe_server_setup.yml
index 2d9fb0b..77ac870 100644
--- a/playbook/pxe_server_setup.yml
+++ b/playbook/pxe_server_setup.yml
@@ -163,7 +163,15 @@
           # dhcp-option=6,8.8.8.8
           enable-tftp
           tftp-root={{ tftp_dir }}
-          dhcp-boot=ipxe.efi
+          # Arch-aware NBP: legacy BIOS PXE ROMs (client-arch=0) cannot run
+          # the EFI iPXE binary and report "NBP is too big to fit in free
+          # base memory" because ipxe.efi (~675KB) exceeds the BIOS PXE
+          # NBP cap. Serve undionly.kpxe (~70KB, BIOS-mode iPXE) to them
+          # instead. Everything else (UEFI x86_64 = arch 7 or 9, plus any
+          # future arches) keeps getting ipxe.efi - default-safe.
+          dhcp-match=set:bios,option:client-arch,0
+          dhcp-boot=tag:bios,undionly.kpxe
+          dhcp-boot=tag:!bios,ipxe.efi
           log-dhcp
           # Per-lease state cleanup: flush conntrack + port-445 sockets for
           # the client IP on add/del. Prevents "System error 53" when a PXE
@@ -727,6 +735,7 @@
         mode: '0755'
       loop:
         - ipxe.efi
+        - undionly.kpxe
       ignore_errors: yes
 
     - name: "Copy boot tool files from USB (Clonezilla, Blancco, Memtest)"