diff --git a/.gitignore b/.gitignore
index 9f970225a..606639ec7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
-target/
\ No newline at end of file
+target/
+.flox
diff --git a/crates/bcvk-qemu/src/virtiofsd.rs b/crates/bcvk-qemu/src/virtiofsd.rs
index c993b1f55..a4ff848b0 100644
--- a/crates/bcvk-qemu/src/virtiofsd.rs
+++ b/crates/bcvk-qemu/src/virtiofsd.rs
@@ -21,6 +21,8 @@ pub struct VirtiofsConfig {
     pub readonly: bool,
     /// Optional log file path for virtiofsd output.
     pub log_file: Option<Utf8PathBuf>,
+    /// Optional explicit path to virtiofsd binary (overrides auto-detection).
+    pub virtiofsd_binary: Option<Utf8PathBuf>,
 }
 
 impl Default for VirtiofsConfig {
@@ -32,6 +34,7 @@ impl Default for VirtiofsConfig {
             // We don't need to write to this, there's a transient overlay
             readonly: true,
             log_file: None,
+            virtiofsd_binary: None,
         }
     }
 }
@@ -61,32 +64,42 @@ pub async fn spawn_virtiofsd_async(config: &VirtiofsConfig) -> Result<tokio::pro
     // Validate configuration
     validate_virtiofsd_config(config)?;
 
-    // Try common virtiofsd binary locations
-    let virtiofsd_paths = [
-        "/usr/libexec/virtiofsd",
-        "/usr/bin/virtiofsd",
-        "/usr/local/bin/virtiofsd",
-        "/usr/lib/virtiofsd",
-    ];
-
-    let virtiofsd_binary = virtiofsd_paths
-        .iter()
-        .find(|path| std::path::Path::new(path).exists())
-        .ok_or_else(|| {
-            eyre!(
-                "virtiofsd binary not found. Searched paths: {}. Please install virtiofsd.",
-                virtiofsd_paths.join(", ")
-            )
-        })?;
+    // Resolve virtiofsd binary: explicit override or path search
+    let virtiofsd_binary: String = if let Some(ref path) = config.virtiofsd_binary {
+        if !path.exists() {
+            return Err(eyre!("Explicit virtiofsd binary not found at: {}", path));
+        }
+        camino::absolute_utf8(path)?.to_string()
+    } else {
+        // Try common virtiofsd binary locations
+        let virtiofsd_paths = [
+            "/usr/libexec/virtiofsd",
+            "/usr/bin/virtiofsd",
+            "/usr/local/bin/virtiofsd",
+            "/usr/lib/virtiofsd",
+        ];
+
+        virtiofsd_paths
+            .iter()
+            .find(|path| std::path::Path::new(path).exists())
+            .ok_or_else(|| {
+                eyre!(
+                    "virtiofsd binary not found. Searched paths: {}. \
+                     Set --virtiofsd or VIRTIOFSD_BIN to specify the path explicitly.",
+                    virtiofsd_paths.join(", ")
+                )
+            })?
+            .to_string()
+    };
 
     // Check if virtiofsd supports --readonly flag
-    let supports_readonly = virtiofsd_supports_readonly(virtiofsd_binary).await;
+    let supports_readonly = virtiofsd_supports_readonly(&virtiofsd_binary).await;
     debug!(
         "virtiofsd at {} supports --readonly: {}",
         virtiofsd_binary, supports_readonly
     );
 
-    let mut cmd = tokio::process::Command::new(virtiofsd_binary);
+    let mut cmd = tokio::process::Command::new(&virtiofsd_binary);
     // SAFETY: This API is safe to call in a forked child.
     #[allow(unsafe_code)]
     unsafe {
@@ -148,13 +161,13 @@ pub async fn spawn_virtiofsd_async(config: &VirtiofsConfig) -> Result<tokio::pro
     let child = cmd.spawn().with_context(|| {
         format!(
             "Failed to spawn virtiofsd. Binary: {}, Socket: {}, Shared dir: {}",
-            virtiofsd_binary, config.socket_path, config.shared_dir
+            &virtiofsd_binary, config.socket_path, config.shared_dir
         )
     })?;
 
     debug!(
         "Spawned virtiofsd: binary={}, socket={}, shared_dir={}, debug={}, log_file={:?}",
-        virtiofsd_binary, config.socket_path, config.shared_dir, config.debug, config.log_file
+        &virtiofsd_binary, config.socket_path, config.shared_dir, config.debug, config.log_file
     );
 
     Ok(child)
diff --git a/crates/kit/Cargo.toml b/crates/kit/Cargo.toml
index 2bdd1fe7c..a5ef6afdc 100644
--- a/crates/kit/Cargo.toml
+++ b/crates/kit/Cargo.toml
@@ -9,7 +9,7 @@ base64 = "0.22"
 chrono = { version = "0.4", features = ["serde"] }
 const_format = { workspace = true }
 color-eyre = { workspace = true }
-clap = { version = "4.4", features = ["derive"] }
+clap = { version = "4.4", features = ["derive", "env"] }
 clap_mangen = { version = "0.2.20", optional = true }
 data-encoding = { version = "2.9" }
 dirs = "5.0"
diff --git a/crates/kit/src/run_ephemeral.rs b/crates/kit/src/run_ephemeral.rs
index 0d0fdf3b8..0b872f936 100644
--- a/crates/kit/src/run_ephemeral.rs
+++ b/crates/kit/src/run_ephemeral.rs
@@ -218,6 +218,13 @@ pub struct CommonVmOpts {
         help = "Generate SSH keypair and inject via systemd credentials"
     )]
     pub ssh_keygen: bool,
+
+    #[clap(
+        long = "virtiofsd",
+        env = "VIRTIOFSD_BIN",
+        help = "Path to virtiofsd binary (overrides auto-detection)"
+    )]
+    pub virtiofsd_binary: Option<String>,
 }
 
 impl CommonVmOpts {
@@ -1171,6 +1178,7 @@ pub(crate) async fn run_impl(opts: RunEphemeralOpts) -> Result<()> {
                 debug: false,
                 readonly: is_readonly,
                 log_file: Some(format!("/run/virtiofsd-{}.log", mount_name_str).into()),
+                virtiofsd_binary: opts.common.virtiofsd_binary.as_deref().map(Into::into),
             };
             additional_mounts.push((virtiofsd_config, tag.clone()));
 
@@ -1329,6 +1337,7 @@ StandardOutput=file:/dev/virtio-ports/executestatus
     main_virtiofsd_config.debug = std::env::var("DEBUG_MODE").is_ok();
     // Always log virtiofsd output for debugging
     main_virtiofsd_config.log_file = Some("/run/virtiofsd.log".into());
+    main_virtiofsd_config.virtiofsd_binary = opts.common.virtiofsd_binary.as_deref().map(Into::into);
 
     std::fs::create_dir_all(CONTAINER_STATEDIR)?;