diff --git a/roles/gitlab_runner/files/libvirt-executor b/roles/gitlab_runner/files/libvirt-executor
index c1aacd69184d70967bc9fbc9f9563f98b6be2ba1..9a5bd1a39c64fde173a62f7425c6604cf7f31349 100755
--- a/roles/gitlab_runner/files/libvirt-executor
+++ b/roles/gitlab_runner/files/libvirt-executor
@@ -89,7 +89,7 @@ run() {
 cleanup() {
   rm /run/libvirt-executor/id_ed25519_$(vm_name){,.pub}
   virsh destroy "$(vm_name)" || true
-  virsh undefine --remove-all-storage "$(vm_name)"
+  virsh undefine --nvram --remove-all-storage "$(vm_name)"
 }
 
 case "${1:-}" in
diff --git a/roles/gitlab_runner/templates/domain_template.xml.j2 b/roles/gitlab_runner/templates/domain_template.xml.j2
index 131d4922e71d85896c476e82fa599a9c4cf49541..a7f6b7bacbd848c64f800a029c5a27a11df0f8ef 100644
--- a/roles/gitlab_runner/templates/domain_template.xml.j2
+++ b/roles/gitlab_runner/templates/domain_template.xml.j2
@@ -8,7 +8,7 @@
       <entry>io.systemd.credential.binary:ssh.authorized_keys.root=$ssh_authorized_keys_root</entry>
     </oemStrings>
   </sysinfo>
-  <os>
+  <os firmware='efi'>
     <type arch='x86_64' machine='q35'>hvm</type>
     <smbios mode='sysinfo'/>
   </os>