diff --git a/mkosi.images/base/mkosi.extra/usr/lib/systemd/system/systemd-sysext.service.d/10_run_sysusers.conf b/mkosi.images/base/mkosi.extra/usr/lib/systemd/system/systemd-sysext.service.d/10_run_sysusers.conf
new file mode 100644
index 000000000..4530a5c12
--- /dev/null
+++ b/mkosi.images/base/mkosi.extra/usr/lib/systemd/system/systemd-sysext.service.d/10_run_sysusers.conf
@@ -0,0 +1,5 @@
+# systemd-sysusers.service runs before local file systems are mounted, so it never
+# gets sysusers.d files shipped in extensions. Run it again once they are merged.
+[Service]
+ExecStartPost=systemd-sysusers
+ExecReload=systemd-sysusers
diff --git a/mkosi.images/ext-virt/mkosi.conf b/mkosi.images/ext-virt/mkosi.conf
index 1d1cd75fa..582bb5fe5 100644
--- a/mkosi.images/ext-virt/mkosi.conf
+++ b/mkosi.images/ext-virt/mkosi.conf
@@ -11,11 +11,25 @@ CompressOutput=zstd
 [Content]
 Bootable=no
 BaseTrees=%O/base_%v
+WithRecommends=yes
+RemovePackages=
+    virt-manager
 Packages=
+    qemu-system-gui
     qemu-system-x86
     qemu-system-arm
+    qemu-system-riscv
+    qemu-system-modules-opengl
+    qemu-system-modules-spice
+    qemu-system-misc
+    qemu-utils
     libvirt-daemon-system
     libvirt-clients
-    virt-manager
+    libspice-server1
+    libvirglrenderer1
+    virgl-server
+    spice-html5
     bridge-utils
+    ovmf
+    qemu-efi-aarch64
     virtinst
diff --git a/mkosi.images/ext-virt/mkosi.extra/usr/lib/systemd/system/libvirt-guests.service.d/10_libvirtd.conf b/mkosi.images/ext-virt/mkosi.extra/usr/lib/systemd/system/libvirt-guests.service.d/10_libvirtd.conf
new file mode 100644
index 000000000..2419c4694
--- /dev/null
+++ b/mkosi.images/ext-virt/mkosi.extra/usr/lib/systemd/system/libvirt-guests.service.d/10_libvirtd.conf
@@ -0,0 +1,6 @@
+# Start libvirtd once at boot so autostart networks and guests come up. Upholding
+# libvirtd.service directly would restart it whenever it exits idle. After= also
+# shuts guests down before libvirtd stops.
+[Unit]
+Wants=libvirtd.service
+After=libvirtd.service
diff --git a/mkosi.images/ext-virt/mkosi.extra/usr/lib/systemd/system/multi-user.target.d/10_libvirtd.conf b/mkosi.images/ext-virt/mkosi.extra/usr/lib/systemd/system/multi-user.target.d/10_libvirtd.conf
new file mode 100644
index 000000000..1e2fd4595
--- /dev/null
+++ b/mkosi.images/ext-virt/mkosi.extra/usr/lib/systemd/system/multi-user.target.d/10_libvirtd.conf
@@ -0,0 +1,4 @@
+# Extensions are merged after the boot transaction is built, so a .wants symlink
+# never starts these. Upholds= is re-checked after the service manager reloads.
+[Unit]
+Upholds=libvirtd.socket libvirtd-ro.socket libvirtd-admin.socket libvirt-guests.service
diff --git a/mkosi.images/ext-virt/mkosi.extra/usr/lib/sysusers.d/libvirt-dnsmasq.conf b/mkosi.images/ext-virt/mkosi.extra/usr/lib/sysusers.d/libvirt-dnsmasq.conf
new file mode 100644
index 000000000..4f40a4b18
--- /dev/null
+++ b/mkosi.images/ext-virt/mkosi.extra/usr/lib/sysusers.d/libvirt-dnsmasq.conf
@@ -0,0 +1,4 @@
+# Ubuntu creates this user in libvirt-daemon-config-network's postinst rather than
+# sysusers.d, and maintainer scripts don't run for extensions.
+# Type  Name             ID  GECOS              Home directory
+u       libvirt-dnsmasq  -   "Libvirt Dnsmasq"  /var/lib/libvirt/dnsmasq
diff --git a/mkosi.images/ext-virt/mkosi.extra/usr/lib/tmpfiles.d/libvirt.conf b/mkosi.images/ext-virt/mkosi.extra/usr/lib/tmpfiles.d/libvirt.conf
new file mode 100644
index 000000000..c54b61888
--- /dev/null
+++ b/mkosi.images/ext-virt/mkosi.extra/usr/lib/tmpfiles.d/libvirt.conf
@@ -0,0 +1,9 @@
+# Type  Path                         Mode  User          Group         Age  Argument
+d       /var/lib/libvirt/images      0711  root          root          -    -
+d       /var/lib/libvirt/qemu        0750  libvirt-qemu  kvm           -    -
+d       /var/cache/libvirt/qemu      0750  libvirt-qemu  kvm           -    -
+d       /var/log/libvirt/qemu        0750  root          libvirt-qemu  -    -
+d       /etc/mdevctl.d/              0750  root          root          -    -
+# Enable default NAT network
+C       /etc/libvirt/qemu/networks/default.xml - - - - /usr/share/libvirt/networks/default.xml
+L       /etc/libvirt/qemu/networks/autostart/default.xml - - - - /etc/libvirt/qemu/networks/default.xml
diff --git a/mkosi.images/ext-virt/mkosi.finalize b/mkosi.images/ext-virt/mkosi.finalize
new file mode 100755
index 000000000..5e6e13789
--- /dev/null
+++ b/mkosi.images/ext-virt/mkosi.finalize
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Reload the service manager once this extension is merged so the units it ships
+# get loaded. mkosi names the file after the image version, hence the glob.
+release=("$BUILDROOT"/usr/lib/extension-release.d/extension-release.*)
+if [[ ${#release[@]} -ne 1 || ! -f ${release[0]} ]]; then
+    echo "Expected one extension-release file, found: ${release[*]}" >&2
+    exit 1
+fi
+echo "EXTENSION_RELOAD_MANAGER=1" >> "${release[0]}"
+
+# mkosi removes empty directories from extensions, but mdevctl won't run without
+# its callout and notifier directories.
+mkdir -p "$BUILDROOT"/usr/lib/mdevctl/scripts.d/{callouts,notifiers}
diff --git a/mkosi.images/ext-virt/mkosi.postinst.chroot b/mkosi.images/ext-virt/mkosi.postinst.chroot
deleted file mode 100755
index b80be8d33..000000000
--- a/mkosi.images/ext-virt/mkosi.postinst.chroot
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/bash
-set -xeuo pipefail
-
-glib-compile-schemas /usr/share/glib-2.0/schemas/