diff --git a/docs/ENVIRONMENT.md b/docs/ENVIRONMENT.md
index fb35300419..2b751d9d53 100644
--- a/docs/ENVIRONMENT.md
+++ b/docs/ENVIRONMENT.md
@@ -256,6 +256,9 @@ All tools:
   `--path=` switch only very superficial validation of the specified path is
   done when this environment variable is used.
 
+* `$KERNEL_INSTALL_CONF_ROOT=…` — override the built in default configuration
+  directory /etc/kernel/ to read files like entry-token and install.conf from.
+
 `systemd` itself:
 
 * `$SYSTEMD_ACTIVATION_UNIT` — set for all NSS and PAM module invocations that
diff --git a/src/basic/path-util.h b/src/basic/path-util.h
index 22d3632e6e..e40899284c 100644
--- a/src/basic/path-util.h
+++ b/src/basic/path-util.h
@@ -130,6 +130,7 @@ int fsck_exists_for_fstype(const char *fstype);
 
 /* Similar to path_join(), but only works for two components, and only the first one may be NULL and returns
  * an alloca() buffer, or possibly a const pointer into the path parameter. */
+/* DEPRECATED: use path_join() instead */
 #define prefix_roota(root, path)                                        \
         ({                                                              \
                 const char* _path = (path), *_root = (root), *_ret;     \
diff --git a/src/boot/bootctl-install.c b/src/boot/bootctl-install.c
index 31c2050a4a..1dee592d77 100644
--- a/src/boot/bootctl-install.c
+++ b/src/boot/bootctl-install.c
@@ -77,15 +77,18 @@ static int load_etc_machine_info(void) {
 }
 
 static int load_etc_kernel_install_conf(void) {
-        _cleanup_free_ char *layout = NULL;
+        _cleanup_free_ char *layout = NULL, *p = NULL;
         int r;
 
-        r = parse_env_file(NULL, "/etc/kernel/install.conf",
-                           "layout", &layout);
+        p = path_join(etc_kernel(), "install.conf");
+        if (!p)
+                return log_oom();
+
+        r = parse_env_file(NULL, p, "layout", &layout);
         if (r == -ENOENT)
                 return 0;
         if (r < 0)
-                return log_error_errno(r, "Failed to parse /etc/kernel/install.conf: %m");
+                return log_error_errno(r, "Failed to parse %s: %m", p);
 
         if (!isempty(layout)) {
                 log_debug("layout=%s is specified in /etc/machine-info.", layout);
@@ -488,6 +491,7 @@ static int install_entry_directory(const char *root) {
 }
 
 static int install_entry_token(void) {
+        _cleanup_free_ char* p = NULL;
         int r;
 
         assert(arg_make_entry_directory >= 0);
@@ -499,9 +503,13 @@ static int install_entry_token(void) {
         if (!arg_make_entry_directory && arg_entry_token_type == ARG_ENTRY_TOKEN_MACHINE_ID)
                 return 0;
 
-        r = write_string_file("/etc/kernel/entry-token", arg_entry_token, WRITE_STRING_FILE_CREATE|WRITE_STRING_FILE_ATOMIC|WRITE_STRING_FILE_MKDIR_0755);
+        p = path_join(etc_kernel(), "entry-token");
+        if (!p)
+                return log_oom();
+
+        r = write_string_file(p, arg_entry_token, WRITE_STRING_FILE_CREATE|WRITE_STRING_FILE_ATOMIC|WRITE_STRING_FILE_MKDIR_0755);
         if (r < 0)
-                return log_error_errno(r, "Failed to write entry token '%s' to /etc/kernel/entry-token", arg_entry_token);
+                return log_error_errno(r, "Failed to write entry token '%s' to %s", arg_entry_token, p);
 
         return 0;
 }
diff --git a/src/boot/bootctl-util.c b/src/boot/bootctl-util.c
index b11742a7ae..859742a126 100644
--- a/src/boot/bootctl-util.c
+++ b/src/boot/bootctl-util.c
@@ -6,6 +6,7 @@
 #include "bootctl-util.h"
 #include "fileio.h"
 #include "os-util.h"
+#include "path-util.h"
 #include "stat-util.h"
 #include "sync-util.h"
 #include "utf8.h"
@@ -118,10 +119,13 @@ int settle_entry_token(void) {
         switch (arg_entry_token_type) {
 
         case ARG_ENTRY_TOKEN_AUTO: {
-                _cleanup_free_ char *buf = NULL;
-                r = read_one_line_file("/etc/kernel/entry-token", &buf);
+                _cleanup_free_ char *buf = NULL, *p = NULL;
+                p = path_join(etc_kernel(), "entry-token");
+                if (!p)
+                        return log_oom();
+                r = read_one_line_file(p, &buf);
                 if (r < 0 && r != -ENOENT)
-                        return log_error_errno(r, "Failed to read /etc/kernel/entry-token: %m");
+                        return log_error_errno(r, "Failed to read %s: %m", p);
 
                 if (!isempty(buf)) {
                         free_and_replace(arg_entry_token, buf);
diff --git a/src/boot/bootctl-util.h b/src/boot/bootctl-util.h
index 6f2c1630de..147455e241 100644
--- a/src/boot/bootctl-util.h
+++ b/src/boot/bootctl-util.h
@@ -8,3 +8,7 @@ const char *get_efi_arch(void);
 int get_file_version(int fd, char **ret);
 
 int settle_entry_token(void);
+
+static inline const char* etc_kernel(void) {
+        return getenv("KERNEL_INSTALL_CONF_ROOT") ?: "/etc/kernel/";
+}