diff --git a/embed.ipxe b/embed.ipxe
index 4044d8e..b96f1e2 100644
--- a/embed.ipxe
+++ b/embed.ipxe
@@ -198,6 +198,9 @@ goto static_ip_boot_setup
 # However, note that imgverify will fail if you refer to it as "/squashfs"
 #   instead of "squashfs".
 
+imgfetch https://images2.sysdeploy.org/${ubuntu-variant}/${arch-info}/squashfs /squashfs || goto try_next_card				
+imgverify --signer images.sysdeploy.org squashfs https://images2.sysdeploy.org/${ubuntu-variant}/${arch-info}/squashfs.sig || goto error_handler
+
 # "--signer" validates against the subject common name field of the signing
 #   certificate. That signing cert must have both the digital signature key
 #   usage set and the code-signing key usage extension set.
@@ -206,11 +209,11 @@ goto static_ip_boot_setup
 #   make sure you pick a common name with a FQDN you control, even if you're
 #   using a custom CA that you import during build.
 
-initrd http://images.sysdeploy.org/${ubuntu-variant}/${arch-info}/initrd.cpio || goto try_next_card
-imgverify --signer images.sysdeploy.org initrd.cpio http://images.sysdeploy.org/${ubuntu-variant}/${arch-info}/initrd.cpio.sig || goto error_handler
+initrd https://images2.sysdeploy.org/${ubuntu-variant}/${arch-info}/boot-initrd || goto try_next_card
+imgverify --signer images.sysdeploy.org boot-initrd https://images2.sysdeploy.org/${ubuntu-variant}/${arch-info}/boot-initrd.sig || goto error_handler
 
-kernel http://images.sysdeploy.org/${ubuntu-variant}/${arch-info}/boot-kernel || goto try_next_card
-imgverify --signer images.sysdeploy.org boot-kernel http://images.sysdeploy.org/${ubuntu-variant}/${arch-info}/boot-kernel.sig || goto error_handler
+kernel https://images2.sysdeploy.org/${ubuntu-variant}/${arch-info}/boot-kernel || goto try_next_card
+imgverify --signer images.sysdeploy.org boot-kernel https://images2.sysdeploy.org/${ubuntu-variant}/${arch-info}/boot-kernel.sig || goto error_handler
 
 
 # Get accurate time so we can set the clock in kernel boot cmdline
@@ -220,7 +223,7 @@ echo ip-info ${ip-info}
 
 sleep 1
 
-boot boot-kernel initrd=initrd.cpio rootfstype=squashfs root=/squashfs ip=${ip-info} overlayroot=tmpfs:recurse=0 systemd.clock-usec=${unixtime:int32}000000 ds=nocloud-net;s=https://cloud-init.sysdeploy.org/apiv2?uuid=${uuid}&filetype= || goto error_handler
+boot boot-kernel initrd=initrd.cpio initrd=squashfs rootfstype=squashfs root=/squashfs ip=${ip-info} overlayroot=tmpfs:recurse=0 systemd.clock-usec=${unixtime:int32}000000 ds=nocloud-net;s=https://cloud-init.sysdeploy.org/apiv2?uuid=${uuid}&filetype= || goto error_handler
 
 # unixtime variable must be used with int32, because that's the only way it
 #   will display as decimal digits. unit32 and string both display as hex.