diff --git a/features/bootloader.nix b/features/bootloader.nix
index 3975cbb..31e6e2b 100644
--- a/features/bootloader.nix
+++ b/features/bootloader.nix
@@ -22,12 +22,16 @@
           ];
           default = "systemd-boot";
         };
+
+        plymouth.enable = lib.mkEnableOption "plymouth boot splash";
       };
 
       config = lib.mkIf cfg.enable (
         lib.mkMerge [
           {
             boot.loader.efi.canTouchEfiVariables = true;
+            # request the largest framebuffer uefi offers; plymouth inherits it
+            boot.loader.systemd-boot.consoleMode = "max";
           }
 
           (lib.mkIf (cfg.mode == "systemd-boot") {
@@ -41,6 +45,28 @@
               pkiBundle = "/var/lib/sbctl";
             };
           })
+
+          (lib.mkIf cfg.plymouth.enable {
+            # plymouth needs systemd-initrd to render the luks prompt cleanly
+            boot.initrd.systemd.enable = true;
+
+            # host is responsible for early-KMS so plymouth lands on the gpu driver,
+            # not simpledrm (e.g. hardware.amdgpu.initrd.enable on amd hosts)
+            boot.plymouth.enable = true;
+            stylix.targets.plymouth.logoAnimated = false;
+
+            boot.kernelParams = [
+              "quiet"
+              "splash"
+              "loglevel=3"
+              "rd.systemd.show_status=false"
+              "rd.udev.log_level=3"
+              "udev.log_priority=3"
+              "plymouth.force-scale=1"
+            ];
+            boot.consoleLogLevel = 0;
+            boot.initrd.verbose = false;
+          })
         ]
       );
     };
diff --git a/hosts/fw16/configuration.nix b/hosts/fw16/configuration.nix
index 88c6c40..395e521 100644
--- a/hosts/fw16/configuration.nix
+++ b/hosts/fw16/configuration.nix
@@ -10,6 +10,7 @@
     inputs.nixos-hardware.nixosModules.framework-16-amd-ai-300-series
   ];
 
+  features.bootloader.plymouth.enable = true;
   features.desktop.bluetooth.enable = true;
   features.gnupg.yubikey.enable = true;
   features.udev = {
diff --git a/hosts/tower/configuration.nix b/hosts/tower/configuration.nix
index 6c8e7b5..3ae111f 100644
--- a/hosts/tower/configuration.nix
+++ b/hosts/tower/configuration.nix
@@ -6,7 +6,10 @@
 
 {
   features.nix-settings.towerCache.enable = false;
-  features.bootloader.mode = "lanzaboote";
+  features.bootloader = {
+    mode = "lanzaboote";
+    plymouth.enable = true;
+  };
   features.desktop.bluetooth.enable = true;
   features.gnupg.yubikey.enable = true;
   features.udev = {
@@ -23,6 +26,8 @@
   nix.settings.secret-key-files = [ config.sops.secrets.nix-signing-key.path ];
 
   boot.kernelParams = [ "btusb.reset=1" ];
+  # early kms so plymouth lands on amdgpu, not simpledrm
+  hardware.amdgpu.initrd.enable = true;
 
   services.udisks2.enable = true;