Editing Openai/695158d7-1b68-800b-a02f-4817bf1f6d25 (section)

==== This is the key error. The installer is telling you the EFI System Partition (ESP) is currently set to be inside LUKS (encrypted), or you flagged the ESP to be encrypted — that’s invalid. The firmware (UEFI) needs an unencrypted FAT32 partition to read the bootloader. ====

===== You must create a separate unencrypted EFI partition (FAT32, ~512 MiB) and not put it inside LUKS. Example partition scheme: =====
# Partition 1 — EFI System Partition - Size: 512 MiB - Type: EFI System Partition - Filesystem: vfat/FAT32 - Do not encrypt this.
# Partition 2 — LUKS container for Qubes - Size: 150 GiB (or your chosen system size) - Type: physical volume (LVM) or leave as partition that you will encrypt - Enable LUKS encryption on this partition (the installer will wrap it and then create LVM inside it).
# Partition 3 — Unencrypted media - Size: ~700 GiB - Filesystem: ext4 OR leave unformatted and format later (exFAT if you need Windows compatibility) - Not encrypted.
# (Optional) Partition 4 — small exchange - Size: ~54 GiB - Filesystem: exFAT (if available) or unformatted and format later.

Important: Ensure the ESP is flagged properly and that when you choose LUKS for the main system you do not select the ESP to be inside LUKS. The GUI sometimes lets you accidentally apply LUKS to the whole disk; instead assign LUKS only to the partition you intend for the system.

===== Boot the installer live and open a terminal: =====

<syntaxhighlight lang="bash">lsblk -f

</syntaxhighlight>

Check which partitions exist and whether any FAT32 partition is present for EFI. Also check you booted in UEFI.

===== If you accidentally encrypted the whole disk (including ESP), you need to: =====
* Recreate partitions: make a small unencrypted FAT32 ESP first, then the LUKS partition after it. This may require wiping/repartitioning the disk.

Quick fix: Create a 512 MiB vfat EFI partition (unformatted as EFI System Partition in GUI), then a separate LUKS partition for Qubes. Don’t wrap the EFI partition in LUKS.