diff --git a/man/kernel-install.xml b/man/kernel-install.xml
index e50aeee949..a57e3e3759 100644
--- a/man/kernel-install.xml
+++ b/man/kernel-install.xml
@@ -111,7 +111,7 @@
 
             <listitem><para><filename>90-uki-copy.install</filename> copies a file
             <filename>uki.efi</filename> from <varname>$KERNEL_INSTALL_STAGING_AREA</varname> or if it does
-            not exist the <replaceable>KERNEL-IMAGE</replaceable> argument, iff it has a
+            not exist the <replaceable>KERNEL-IMAGE</replaceable> argument, only if it has a
             <literal>.efi</literal> extension, to
             <filename>$BOOT/EFI/Linux/<replaceable>ENTRY-TOKEN</replaceable>-<replaceable>KERNEL-VERSION</replaceable>.efi</filename>.</para>
 
@@ -224,10 +224,8 @@
       (EFI System Partition) are mounted, and also conceptually referred to as <varname>$BOOT</varname>. Can
       be overridden by setting <varname>$BOOT_ROOT</varname> (see below).</para>
 
-      <para><varname>$KERNEL_INSTALL_LAYOUT=bls|uki|other|...</varname> is set for the plugins to specify the
-      installation layout. Defaults to <option>bls</option> if
-      <filename>$BOOT/<replaceable>ENTRY-TOKEN</replaceable></filename> exists, or <option>other</option>
-      otherwise. Additional layout names may be defined by convention. If a plugin uses a special layout,
+      <para><varname>$KERNEL_INSTALL_LAYOUT=auto|bls|uki|other|...</varname> is set for the plugins to specify the
+      installation layout. Additional layout names may be defined by convention. If a plugin uses a special layout,
       it's encouraged to declare its own layout name and configure <varname>layout=</varname> in
       <filename>install.conf</filename> upon initial installation. The following values are currently
       understood:</para>
@@ -264,6 +262,17 @@
             <para>Some other layout not understood natively by <command>kernel-install</command>.</para>
           </listitem>
         </varlistentry>
+        <varlistentry>
+          <term>auto</term>
+          <listitem>
+            <para>Pick the layout automatically. If the kernel is a UKI set layout to
+            <option>uki</option>. If not default to <option>bls</option> if
+            <filename>$BOOT/loader/entries.srel</filename> with content <literal>type1</literal> or
+            <filename>$BOOT/<replaceable>ENTRY-TOKEN</replaceable></filename> exists, or
+            <option>other</option> otherwise.</para>
+            <para>Leaving layout blank has the same effect. This is the default.</para>
+          </listitem>
+        </varlistentry>
       </variablelist>
 
       <para><varname>$KERNEL_INSTALL_INITRD_GENERATOR</varname> is set for plugins to select the initrd
diff --git a/src/boot/bootctl-uki.c b/src/boot/bootctl-uki.c
index e304cad06a..261e687e3f 100644
--- a/src/boot/bootctl-uki.c
+++ b/src/boot/bootctl-uki.c
@@ -31,11 +31,16 @@ static int pe_sections(FILE *uki, struct PeSectionHeader **ret, size_t *ret_n) {
         assert(ret_n);
 
         items = fread(&dos, 1, sizeof(dos), uki);
-        if (items != sizeof(dos))
-                return log_error_errno(SYNTHETIC_ERRNO(EIO), "DOS header read error");
+        if (items < sizeof(dos.Magic))
+                return log_error_errno(SYNTHETIC_ERRNO(EIO), "File is smaller than DOS magic (got %"PRIu64" of %zu bytes)",
+                                       items, sizeof(dos.Magic));
         if (memcmp(dos.Magic, dos_file_magic, sizeof(dos_file_magic)) != 0)
                 goto no_sections;
 
+        if (items != sizeof(dos))
+                return log_error_errno(SYNTHETIC_ERRNO(EIO), "File is smaller than DOS header (got %"PRIu64" of %zu bytes)",
+                                       items, sizeof(dos));
+
         if (fseek(uki, le32toh(dos.ExeHeader), SEEK_SET) < 0)
                 return log_error_errno(errno, "seek to PE header");
 
diff --git a/src/kernel-install/90-uki-copy.install b/src/kernel-install/90-uki-copy.install
index d6e3deb723..6c71b211d7 100755
--- a/src/kernel-install/90-uki-copy.install
+++ b/src/kernel-install/90-uki-copy.install
@@ -49,8 +49,8 @@ case "$COMMAND" in
 esac
 
 if ! [ -d "$UKI_DIR" ]; then
-    echo "Error: entry directory '$UKI_DIR' does not exist" >&2
-    exit 1
+    [ "$KERNEL_INSTALL_VERBOSE" -gt 0 ] && echo "creating $UKI_DIR"
+    mkdir -p "$UKI_DIR"
 fi
 
 TRIES_FILE="${KERNEL_INSTALL_CONF_ROOT:-/etc/kernel}/tries"
diff --git a/src/kernel-install/kernel-install.in b/src/kernel-install/kernel-install.in
index c722dc0f77..2c59648afc 100755
--- a/src/kernel-install/kernel-install.in
+++ b/src/kernel-install/kernel-install.in
@@ -268,10 +268,18 @@ if [ -z "$ENTRY_TOKEN" ]; then
     log_verbose "No entry-token candidate matched, using \"$ENTRY_TOKEN\" from machine-id"
 fi
 
-if [ -z "$layout" ]; then
+export KERNEL_INSTALL_IMAGE_TYPE=""
+if [ -f "$1" ]; then
+    KERNEL_INSTALL_IMAGE_TYPE="$(bootctl kernel-identify "$1" 2>/dev/null || echo "unknown")"
+fi
+
+if [ "$layout" = "auto" ] || [ -z "$layout" ]; then
     # No layout configured by the administrator. Let's try to figure it out
     # automatically from metadata already contained in $BOOT_ROOT.
-    if [ -e "$BOOT_ROOT/loader/entries.srel" ]; then
+    if [ "$KERNEL_INSTALL_IMAGE_TYPE" = "uki" ]; then
+        layout="uki"
+        log_verbose "Kernel image is UKI, using layout=$layout"
+    elif [ -e "$BOOT_ROOT/loader/entries.srel" ]; then
         read -r ENTRIES_SREL <"$BOOT_ROOT/loader/entries.srel"
         if [ "$ENTRIES_SREL" = "type1" ]; then
             # The loader/entries.srel file clearly indicates that the installed