diff --git a/.github/workflows/mkosi.yml b/.github/workflows/mkosi.yml
index a394e121cf..020f763852 100644
--- a/.github/workflows/mkosi.yml
+++ b/.github/workflows/mkosi.yml
@@ -140,6 +140,7 @@ jobs:
                 SANITIZERS=${{ matrix.sanitizers }}
                 MESON_OPTIONS=--werror
                 LLVM=${{ matrix.llvm }}
+                SYSEXT=1
 
         [Host]
         QemuMem=4G
diff --git a/mkosi.clean b/mkosi.clean
index 64810b7957..bcd1ae42c8 100755
--- a/mkosi.clean
+++ b/mkosi.clean
@@ -2,4 +2,4 @@
 set -e
 set -o nounset
 
-rm -f "$OUTPUTDIR"/*.{rpm,deb,pkg.tar}
+rm -f "$OUTPUTDIR"/*.{rpm,deb,pkg.tar} "$OUTPUTDIR"/systemd.raw
diff --git a/mkosi.conf b/mkosi.conf
index c90f5bfc77..907d69e0aa 100644
--- a/mkosi.conf
+++ b/mkosi.conf
@@ -83,6 +83,7 @@ Packages=
         dnsmasq
         dosfstools
         e2fsprogs
+        erofs-utils
         findutils
         gdb
         grep
diff --git a/mkosi.conf.d/10-centos-fedora/mkosi.build.chroot b/mkosi.conf.d/10-centos-fedora/mkosi.build.chroot
index 2b3341ccbd..dcb90c31cc 100755
--- a/mkosi.conf.d/10-centos-fedora/mkosi.build.chroot
+++ b/mkosi.conf.d/10-centos-fedora/mkosi.build.chroot
@@ -2,6 +2,8 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 set -e
 
+. mkosi.functions
+
 if ((NO_BUILD)); then
     exit 0
 fi
@@ -120,3 +122,5 @@ CXX_LD="$( ((LLVM)) && echo lld)" \
 
 cp "$OUTPUTDIR"/*.rpm "$PACKAGEDIR"
 cp "$OUTPUTDIR"/*.rpm "$BUILDDIR"
+
+make_sysext_unsigned /var/tmp/BUILD/*/BUILDROOT
diff --git a/mkosi.conf.d/10-opensuse/mkosi.build.chroot b/mkosi.conf.d/10-opensuse/mkosi.build.chroot
index 286fd582a6..0c598eae56 100755
--- a/mkosi.conf.d/10-opensuse/mkosi.build.chroot
+++ b/mkosi.conf.d/10-opensuse/mkosi.build.chroot
@@ -2,6 +2,8 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 set -e
 
+. mkosi.functions
+
 if ((NO_BUILD)); then
     exit 0
 fi
@@ -139,3 +141,5 @@ fi
 
 cp "$OUTPUTDIR"/*.rpm "$PACKAGEDIR"
 cp "$OUTPUTDIR"/*.rpm "$BUILDDIR"
+
+make_sysext_unsigned /var/tmp/BUILD/*/BUILDROOT
diff --git a/mkosi.functions b/mkosi.functions
new file mode 100644
index 0000000000..c19c1aa643
--- /dev/null
+++ b/mkosi.functions
@@ -0,0 +1,49 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+make_sysext_unsigned() {
+    if ! ((SYSEXT)); then
+        return
+    fi
+
+    mkdir -p /usr/lib/systemd/repart/definitions/sysext-unsigned.repart.d
+    cat >/usr/lib/systemd/repart/definitions/sysext-unsigned.repart.d/10-root.conf <<EOF
+[Partition]
+Type=root
+Format=erofs
+CopyFiles=/usr/
+Minimize=best
+EOF
+
+    . /usr/lib/os-release
+
+    mkdir -p "$1"/usr/lib/extension-release.d
+    cat >"$1"/usr/lib/extension-release.d/extension-release.systemd <<EOF
+ID=$ID
+SYSEXT_ID=systemd
+SYSEXT_SCOPE=system
+ARCHITECTURE=$ARCHITECTURE
+EOF
+
+    if [[ -n "$VERSION_ID" ]]; then
+        cat >>"$1"/usr/lib/extension-release.d/extension-release.systemd <<EOF
+VERSION_ID=$VERSION_ID
+EOF
+    fi
+
+    if [[ -n "$SYSEXT_LEVEL" ]]; then
+        cat >>"$1"/usr/lib/extension-release.d/extension-release.systemd <<EOF
+SYSEXT_LEVEL=$SYSEXT_LEVEL
+EOF
+    fi
+
+    rm -f "$BUILDDIR"/systemd.raw
+
+    env --unset=SYSTEMD_REPART_OVERRIDE_FSTYPE_ROOT \
+    "$BUILDDIR"/systemd-repart \
+        --make-ddi=sysext-unsigned \
+        --copy-source="$1" \
+        --pretty=no \
+        "$BUILDDIR"/systemd.raw
+
+    cp "$BUILDDIR"/systemd.raw "$OUTPUTDIR"
+}