diff --git a/t/mockbuild-all.t b/t/mockbuild-all.t
index c08e900..674acf7 100644
--- a/t/mockbuild-all.t
+++ b/t/mockbuild-all.t
@@ -433,6 +433,10 @@ is(rpm_release(tempdir(CLEANUP => 1), 'nonexistent-pkg'), undef, 'rpm_release is
     cmp_ok(scalar(@targets), '>=', 1, 'packages-manifest.conf has at least one target section');
     ok(!grep({ $_ eq 'common' } @targets), 'the shared-repo section is not treated as a build target');
     my @missing = grep { !exists $m{$_}{'conserver-xcat'} } @targets;
+    # The upstream iPXE loaders ship beside xnba-undi, so a target that publishes one publishes both.
+    my @no_ipxe_xcat = grep { exists $m{$_}{'xnba-undi'} && !exists $m{$_}{'ipxe-xcat'} } @targets;
+    is_deeply(\@no_ipxe_xcat, [], 'every target that lists xnba-undi also lists ipxe-xcat')
+        or diag("missing ipxe-xcat in: @no_ipxe_xcat");
     is_deeply(\@missing, [], 'conserver-xcat is present in every manifest target section')
         or diag("missing conserver-xcat in: @missing");
 
@@ -440,7 +444,7 @@ is(rpm_release(tempdir(CLEANUP => 1), 'nonexistent-pkg'), undef, 'rpm_release is
     # carries, at the same pins: a riscv64 MN serves the x86 nodes of a mixed cluster too.
     my ($ppc) = grep { /^[a-z+]+-10-ppc64le$/ } @targets;
     ok(defined $ppc, 'an EL10 ppc64le target section exists to compare against') or $ppc = '';
-    for my $boot (qw(elilo-xcat grub2-xcat syslinux-xcat xnba-undi)) {
+    for my $boot (qw(elilo-xcat grub2-xcat ipxe-xcat syslinux-xcat xnba-undi)) {
         is($m{'rocky-10-riscv64-xcat'}{$boot}, $m{$ppc}{$boot},
             "$boot pinned in the riscv64 target as in the EL10 ppc64le target");
     }
diff --git a/t/sbuild-all.t b/t/sbuild-all.t
index c6c800c..099933f 100644
--- a/t/sbuild-all.t
+++ b/t/sbuild-all.t
@@ -302,14 +302,15 @@ SKIP: {
     is_deeply(\@miss_go, [], 'goconserver present in every manifest target')
         or diag("missing goconserver in: @miss_go");
 
-    # The noarch boot components (syslinux-xcat, grub2-xcat, elilo-xcat, xnba-undi) are Architecture:all
-    # single-producer (built ONCE on amd64) but REQUIRED-PRESENT on EVERY target incl. ppc64el and
-    # riscv64, so the gate verifies those repos actually carry them (matches the EL manifest + the 2.16
-    # ppc dep repo; a ppc or riscv64 MN serves the x86 nodes of a mixed cluster). It is the BUILD PHASE
-    # -- not the manifest -- that avoids rebuilding them off amd64 (build_one_codename skips an
-    # Architecture:all package on non-amd64; see the control_binary_arch test below).
+    # The noarch boot components (syslinux-xcat, grub2-xcat, elilo-xcat, xnba-undi, ipxe-xcat) are
+    # Architecture:all single-producer (built ONCE on amd64) but REQUIRED-PRESENT on EVERY target
+    # incl. ppc64el and riscv64, so the gate verifies those repos actually carry them (matches the
+    # EL manifest + the 2.16 ppc dep repo; a ppc or riscv64 MN serves the x86 nodes of a mixed
+    # cluster). It is the BUILD PHASE -- not the manifest -- that avoids rebuilding them off amd64
+    # (build_one_codename skips an Architecture:all package on non-amd64; see the
+    # control_binary_arch test below).
     for my $t (@targets) {
-        for my $boot (qw(syslinux-xcat grub2-xcat elilo-xcat xnba-undi)) {
+        for my $boot (qw(syslinux-xcat grub2-xcat elilo-xcat xnba-undi ipxe-xcat)) {
             ok(exists $m{$t}{$boot}, "$boot required-present on $t (arch:all, verified on every arch)");
         }
     }
@@ -372,6 +373,17 @@ SKIP: {
     ok(!index_has_native_arch(undef, 'amd64'), 'undef index text -> not built (no crash)');
 }
 
+# ipxe-xcat is built once on amd64 like the other boot components. Its control file must declare
+# Architecture: all, or every other arch would rebuild it.
+{
+    open my $fh, '<', "$FindBin::Bin/../ipxe-xcat/debian/control" or die "ipxe-xcat/debian/control: $!";
+    my $ctl = do { local $/; <$fh> };
+    close $fh;
+    is(control_binary_arch($ctl, 'ipxe-xcat'), 'all', 'ipxe-xcat is Architecture:all');
+    ok(!skip_arch_all_on($ctl, 'ipxe-xcat', 'amd64'), 'ipxe-xcat is built on amd64');
+    ok(skip_arch_all_on($ctl, 'ipxe-xcat', $_), "ipxe-xcat is not rebuilt on $_") for qw(ppc64el riscv64);
+}
+
 # ---- control_binary_arch: PURE Architecture lookup for a specific BINARY package in debian/control --
 # Drives build_one_codename's "skip arch:all on non-amd64" (single-producer) decision. Must pick the
 # right binary paragraph -- e.g. the syslinux SOURCE is 'any' but the syslinux-xcat subpackage is 'all'.
@@ -706,6 +718,7 @@ STUB
         'grub2-xcat'     => 'grub2-xcat',
         'elilo-xcat'     => 'elilo',
         'xnba-undi'      => 'xnba',
+        'ipxe-xcat'      => 'ipxe-xcat',
     );
     my %manifest = read_manifest("$root/debs-manifest.conf");
     my %seen;