diff --git a/live-image/mkosi.postinst b/live-image/mkosi.postinst
index 46a991c..e301a0e 100755
--- a/live-image/mkosi.postinst
+++ b/live-image/mkosi.postinst
@@ -15,3 +15,10 @@ ln -sf /etc/systemd/system/vetting-agent.service \
 # Makefile's cp of live-image/build/initrd.img has something to copy.
 kver=$(ls "$BUILDROOT/lib/modules/" | head -n1)
 chroot "$BUILDROOT" update-initramfs -c -k "$kver"
+
+# linux-image-amd64 creates /vmlinuz -> boot/vmlinuz-<kver>, but the
+# corresponding /initrd.img symlink only gets created by an
+# initramfs-tools postinst hook that relies on the kernel package's
+# "postinst_hook" infrastructure — which doesn't fire when we invoke
+# update-initramfs ourselves. Create it to mirror /vmlinuz.
+ln -sf "boot/initrd.img-${kver}" "$BUILDROOT/initrd.img"