diff --git a/ansible/handlers/main.yml b/ansible/handlers/main.yml
new file mode 100644
index 0000000000..17f566650f
--- /dev/null
+++ b/ansible/handlers/main.yml
@@ -0,0 +1,2 @@
+- name: Regenerate grub configuration
+  ansible.builtin.import_tasks: update-grub.yml
diff --git a/ansible/handlers/update-grub.yml b/ansible/handlers/update-grub.yml
new file mode 100644
index 0000000000..cf0baca97a
--- /dev/null
+++ b/ansible/handlers/update-grub.yml
@@ -0,0 +1,4 @@
+- name: Regenerate grub configuration
+  ansible.builtin.command:
+    cmd: 'update-grub'
+  changed_when: true
diff --git a/ansible/playbook.yml b/ansible/playbook.yml
index 9edb75307e..93bc178060 100644
--- a/ansible/playbook.yml
+++ b/ansible/playbook.yml
@@ -205,3 +205,7 @@
       when: stage2 and not qemu
       become: yes
       import_tasks: tasks/stage2/setup-swap.yml
+
+  handlers:
+    - name: Import handlers
+      import_tasks: handlers/main.yml
diff --git a/ansible/tasks/setup-system.yml b/ansible/tasks/setup-system.yml
index e753046dde..d590280782 100644
--- a/ansible/tasks/setup-system.yml
+++ b/ansible/tasks/setup-system.yml
@@ -109,6 +109,16 @@
         owner: 'root'
         group: 'root'
 
+    - name: Disable kexec handover # Saves ~128 MiB of RAM on a nano.
+      ansible.builtin.copy:
+        content:
+          GRUB_CMDLINE_LINUX_DEFAULT="${GRUB_CMDLINE_LINUX_DEFAULT} kho=off"
+        dest: /etc/default/grub.d/51-disable-kho.cfg
+        owner: root
+        group: root
+      notify:
+        - Regenerate grub configuration
+
 - name: Disable algif_aead module autoload for Copy Fail mitigation
   ansible.builtin.copy:
     content: |