diff --git a/flake.lock b/flake.lock
index 2d93ec0..bc04ba1 100644
--- a/flake.lock
+++ b/flake.lock
@@ -20,6 +20,26 @@
         "type": "github"
       }
     },
+    "disko": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1781152676,
+        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
+        "owner": "nix-community",
+        "repo": "disko",
+        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "disko",
+        "type": "github"
+      }
+    },
     "flake-compat": {
       "flake": false,
       "locked": {
@@ -119,6 +139,7 @@
     "root": {
       "inputs": {
         "deploy-rs": "deploy-rs",
+        "disko": "disko",
         "flake-parts": "flake-parts",
         "nixpkgs": "nixpkgs_2",
         "process-compose-flake": "process-compose-flake",
diff --git a/flake.nix b/flake.nix
index f96ef32..25b6f77 100644
--- a/flake.nix
+++ b/flake.nix
@@ -7,6 +7,10 @@
     deploy-rs.url = "github:serokell/deploy-rs";
     process-compose-flake.url = "github:Platonic-Systems/process-compose-flake";
     services-flake.url = "github:juspay/services-flake";
+    disko = {
+      url = "github:nix-community/disko";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     sops-nix = {
       url = "github:Mic92/sops-nix";
       inputs.nixpkgs.follows = "nixpkgs";
diff --git a/nix/hosts/common.nix b/nix/hosts/common.nix
index c3a9114..ee694b3 100644
--- a/nix/hosts/common.nix
+++ b/nix/hosts/common.nix
@@ -3,6 +3,16 @@
 {
   system.stateVersion = "26.05";
 
+  # Bootloader. The disko layout (hardware-configurations/disk-config.nix) lays
+  # down both a BIOS-boot (EF02) partition and an ESP mounted at /boot, so grub
+  # works whether the VM firmware is legacy BIOS or UEFI. disko fills in
+  # boot.loader.grub.devices from the EF02 partition; we just enable grub here.
+  boot.loader.grub = {
+    enable = true;
+    efiSupport = true;
+    efiInstallAsRemovable = true;
+  };
+
   nix.settings = {
     experimental-features = [ "nix-command" "flakes" ];
     trusted-users = [ "@wheel" "deploy" ];
diff --git a/nix/hosts/db-host.nix b/nix/hosts/db-host.nix
index 93f95b0..2795476 100644
--- a/nix/hosts/db-host.nix
+++ b/nix/hosts/db-host.nix
@@ -1,14 +1,14 @@
 { config, lib, pkgs, ... }:
 
 {
+  # Postgres data lives on the dedicated second disk (/dev/sdb), not the OS disk.
+  # The shared hardware-configuration.nix + sda disk layout come from ./default.nix.
+  imports = [ ./hardware-configurations/db-data-disk.nix ];
+
   networking.hostName = "db-host";
 
   services.gebos.secrets.postgresAdmin = true;
 
-  # Skeleton: real hardware-configuration.nix + boot/fs lives next to this file
-  # once we have the actual box. Marked here so the structure is visible.
-  # imports = [ ./db-host.hardware.nix ];
-
   services.gebos.postgres = {
     enable = true;
     listenAddresses = [ "0.0.0.0" ];
diff --git a/nix/hosts/default.nix b/nix/hosts/default.nix
index 73296a2..998a73d 100644
--- a/nix/hosts/default.nix
+++ b/nix/hosts/default.nix
@@ -9,8 +9,15 @@ let
       specialArgs = { inherit inputs; };
       modules = [
         ./common.nix
-        ./placeholder-hardware.nix
         inputs.sops-nix.nixosModules.sops
+        inputs.disko.nixosModules.disko
+        # All three boxes are identical qemu guests, so they share one
+        # hardware-configuration.nix and one disko disk layout (single
+        # /dev/sda → GPT → LVM → ext4 root). disko derives fileSystems +
+        # bootloader devices from disk-config.nix. db-host additionally
+        # imports the /dev/sdb data disk from ./db-host.nix.
+        ./hardware-configurations/hardware-configuration.nix
+        ./hardware-configurations/disk-config.nix
         modules.gebos-secrets
         modules.gebos-postgres
         modules.gebos-supabase
diff --git a/nix/hosts/hardware-configurations/db-data-disk.nix b/nix/hosts/hardware-configurations/db-data-disk.nix
new file mode 100644
index 0000000..5c32232
--- /dev/null
+++ b/nix/hosts/hardware-configurations/db-data-disk.nix
@@ -0,0 +1,28 @@
+{ lib, ... }:
+
+# Second disk for db-host: the Postgres data directory lives on /dev/sdb, kept
+# separate from the OS disk (/dev/sda). The whole disk is one GPT partition,
+# ext4, mounted at /var/lib/postgresql — so the cluster data dir
+# (/var/lib/postgresql/17, the upstream NixOS default) sits on this drive and
+# survives an OS-disk rebuild.
+{
+  disko.devices.disk.disk2 = {
+    device = lib.mkDefault "/dev/sdb";
+    type = "disk";
+    content = {
+      type = "gpt";
+      partitions = {
+        data = {
+          name = "data";
+          size = "100%";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/var/lib/postgresql";
+            mountOptions = [ "defaults" ];
+          };
+        };
+      };
+    };
+  };
+}
diff --git a/nix/hosts/hardware-configurations/disk-config.nix b/nix/hosts/hardware-configurations/disk-config.nix
new file mode 100644
index 0000000..5745a5f
--- /dev/null
+++ b/nix/hosts/hardware-configurations/disk-config.nix
@@ -0,0 +1,55 @@
+{ lib, ... }:
+{
+  disko.devices = {
+    disk.disk1 = {
+      device = lib.mkDefault "/dev/sda";
+      type = "disk";
+      content = {
+        type = "gpt";
+        partitions = {
+          boot = {
+            name = "boot";
+            size = "1M";
+            type = "EF02";
+          };
+          esp = {
+            name = "ESP";
+            size = "500M";
+            type = "EF00";
+            content = {
+              type = "filesystem";
+              format = "vfat";
+              mountpoint = "/boot";
+            };
+          };
+          root = {
+            name = "root";
+            size = "100%";
+            content = {
+              type = "lvm_pv";
+              vg = "pool";
+            };
+          };
+        };
+      };
+    };
+    lvm_vg = {
+      pool = {
+        type = "lvm_vg";
+        lvs = {
+          root = {
+            size = "100%FREE";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/";
+              mountOptions = [
+                "defaults"
+              ];
+            };
+          };
+        };
+      };
+    };
+  };
+}
\ No newline at end of file
diff --git a/nix/hosts/hardware-configurations/hardware-configuration.nix b/nix/hosts/hardware-configurations/hardware-configuration.nix
new file mode 100644
index 0000000..c03ec1f
--- /dev/null
+++ b/nix/hosts/hardware-configurations/hardware-configuration.nix
@@ -0,0 +1,14 @@
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ "dm-snapshot" ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}
\ No newline at end of file
diff --git a/nix/hosts/placeholder-hardware.nix b/nix/hosts/placeholder-hardware.nix
deleted file mode 100644
index ed19402..0000000
--- a/nix/hosts/placeholder-hardware.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-{ lib, ... }:
-
-# SKELETON PLACEHOLDER — not a real machine description.
-#
-# The three hosts don't have actual boxes yet, but `nix flake check` evaluates
-# `system.build.toplevel` for every nixosConfiguration, which asserts a root
-# filesystem and a boot device exist. This stub satisfies those assertions so
-# the structure type-checks in CI.
-#
-# When a real machine is provisioned, generate its hardware-configuration.nix
-# (`nixos-generate-config`) and import that from the host file instead of this
-# placeholder (see the commented import in db-host.nix). Do NOT deploy a host
-# that still relies on this file — the device paths below are fictional.
-{
-  fileSystems."/" = {
-    device = "/dev/disk/by-label/nixos";
-    fsType = "ext4";
-  };
-
-  boot.loader.grub = {
-    enable = true;
-    devices = [ "/dev/sda" ];
-  };
-}