diff --git a/apparmor.d/profiles-m-r/initramfs-hooks b/apparmor.d/profiles-m-r/initramfs-hooks
new file mode 100644
index 000000000..b4f3ac2f4
--- /dev/null
+++ b/apparmor.d/profiles-m-r/initramfs-hooks
@@ -0,0 +1,86 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = /usr/share/initramfs-tools/hooks/** /etc/initramfs-tools/hooks/**
+profile initramfs-hooks @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/nameservice-strict>
+
+  @{exec_path} mr,
+
+  @{sh_path}                               rix,
+  @{coreutils_path}                        rix,
+  @{bin}/ischroot                           Px,
+  @{bin}/ldd                                Cx -> ldd,
+  @{bin}/plymouth                           Px,
+  @{bin}/update-alternatives                Px,
+  @{sbin}/blkid                             Px,
+  @{lib}/dracut/dracut-install              Px,
+  @{lib}/initramfs-tools/bin/busybox        ix,
+  @{lib}/klibc/bin/fstype                   ix,
+  /usr/share/mdadm/mkconf                   Px,
+
+  @{bin}/* r,
+  @{sbin}/* r,
+  @{lib}/ r,
+  @{lib}/** r,
+
+  /usr/share/initramfs-tools/{,**} r,
+  /usr/share/plymouth/{,**} r,
+  /usr/share/cryptsetup/initramfs/{,**} r,
+
+  /etc/console-setup/{,**} r,
+  /etc/cryptsetup-initramfs/{,**} r,
+  /etc/crypttab r,
+  /etc/default/* r,
+  /etc/fstab r,
+  /etc/iscsi/*.iscsi r,
+  /etc/lvm/{,**} r,
+  /etc/mdadm/mdadm.conf r,
+  /etc/systemd/network/{,**} r,
+  /etc/udev/{,**} r,
+
+  / r,
+  @{efi}/config-* r,
+
+        /var/tmp/ r,
+        /var/tmp/modules_@{rand6} rw,
+  owner /var/tmp/mkinitramfs_@{rand6} rw,
+  owner /var/tmp/mkinitramfs_@{rand6}/ rw,
+  owner /var/tmp/mkinitramfs_@{rand6}/** rwl -> /var/tmp/mkinitramfs_@{rand6}/**,
+  owner /var/tmp/mkinitramfs-@{rand6} rw,
+  owner /var/tmp/mkinitramfs-*_@{rand6} rw,
+
+  owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6} rw,
+  owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/ rw,
+  owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/** rwl -> /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/**,
+  owner /tmp/tmp.@{rand10}/mkinitramfs-@{rand6} rw,
+  owner /tmp/tmp.@{rand10}/mkinitramfs-*_@{rand6} rw,
+
+  @{sys}/firmware/efi/efivars/ r,
+
+  @{PROC}/@{pid}/mounts r,
+  @{PROC}/cmdline r,
+  @{PROC}/swaps r,
+
+  profile ldd {
+    include <abstractions/base>
+    include <abstractions/nameservice-strict>
+
+    @{bin}/ldd mr,
+    @{bin}/* mr,
+    @{lib}/@{multiarch}/ld-linux-*so* mrix,
+    @{lib}/ld-linux.so* mr,
+
+    include if exists <local/initramfs-hooks_ldd>
+  }
+
+  include if exists <local/initramfs-hooks>
+}
+
+# vim:syntax=apparmor
diff --git a/apparmor.d/profiles-m-r/initramfs-scripts b/apparmor.d/profiles-m-r/initramfs-scripts
new file mode 100644
index 000000000..85437017b
--- /dev/null
+++ b/apparmor.d/profiles-m-r/initramfs-scripts
@@ -0,0 +1,55 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = /usr/share/initramfs-tools/scripts/** /etc/initramfs-tools/scripts/**
+profile initramfs-scripts @{exec_path} {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  @{sh_path}                         rix,
+  @{coreutils_path}                  rix,
+  @{sbin}/blkid                       Px,
+  @{bin}/dd                           ix,
+  @{bin}/debconf-escape               Px,
+  @{bin}/ischroot                     Px,
+  @{bin}/ldd                          Cx -> ldd,
+  @{bin}/plymouth                     Px,
+  @{bin}/update-alternatives          Px,
+  @{lib}/dracut/dracut-install        Px,
+  @{lib}/initramfs-tools/bin/busybox  Px,
+  /usr/share/mdadm/mkconf             Px,
+
+  /usr/share/initramfs-tools/{,**} r,
+
+  /etc/cryptsetup-initramfs/{,**} r,
+  /etc/crypttab r,
+  /etc/default/console-setup r,
+  /etc/fstab r,
+  /etc/initramfs-tools/{,**} r,
+  /etc/mdadm/mdadm.conf r,
+  /etc/udev/rules.d/{,**} r,
+
+        /var/tmp/modules_@{rand6} rw,
+  owner /var/tmp/mkinitramfs_@{rand6}/** rwl -> /var/tmp/mkinitramfs_@{rand6}/**,
+
+  profile ldd {
+    include <abstractions/base>
+    include <abstractions/nameservice-strict>
+
+    @{bin}/ldd mr,
+    @{lib}/@{multiarch}/ld-linux-*so* mrix,
+    @{lib}/ld-linux.so* mr,
+
+    include if exists <local/initramfs-scripts_ldd>
+  }
+
+  include if exists <local/initramfs-scripts>
+}
+
+# vim:syntax=apparmor
diff --git a/apparmor.d/profiles-m-r/mkinitramfs b/apparmor.d/profiles-m-r/mkinitramfs
index eaf5645f3..f37029627 100644
--- a/apparmor.d/profiles-m-r/mkinitramfs
+++ b/apparmor.d/profiles-m-r/mkinitramfs
@@ -66,11 +66,10 @@ profile mkinitramfs @{exec_path} {
   @{bin}/dpkg          rPx -> child-dpkg,
   @{bin}/linux-version rPx,
 
-  # What to do with it? (#FIXME#)
-  /usr/share/initramfs-tools/hooks/*     rPUx,
-  /usr/share/initramfs-tools/scripts/*/* rPUx,
-  /etc/initramfs-tools/hooks/*           rPUx,
-  /etc/initramfs-tools/scripts/*/*       rPUx,
+  /usr/share/initramfs-tools/hooks/**     rPx,
+  /usr/share/initramfs-tools/scripts/**   rPx,
+  /etc/initramfs-tools/hooks/**           rPx,
+  /etc/initramfs-tools/scripts/**         rPx,
 
   /usr/share/initramfs-tools/{,**} r,
   /etc/initramfs-tools/{,**} r,
@@ -106,6 +105,7 @@ profile mkinitramfs @{exec_path} {
   @{sys}/devices/platform/**/ r,
   @{sys}/devices/platform/**/modalias r,
   @{sys}/module/compression r,
+  @{sys}/module/firmware_class/parameters/path r,
 
         @{PROC}/cmdline r,
         @{PROC}/modules r,