diff --git a/nix/modules/lanzaboote.nix b/nix/modules/lanzaboote.nix
index ac586c6..287f3b1 100644
--- a/nix/modules/lanzaboote.nix
+++ b/nix/modules/lanzaboote.nix
@@ -103,8 +103,10 @@ in
           ${sbctlWithPki}/bin/sbctl enroll-keys --yes-this-might-brick-my-machine
         ''}
 
+        # Use the system from the kernel's hostPlatform because this should
+        # always, even in the cross compilation case, be the right system.
         ${cfg.package}/bin/lzbt install \
-          --system ${config.nixpkgs.hostPlatform.system or config.boot.kernelPackages.stdenv.hostPlatform.system} \
+          --system ${config.boot.kernelPackages.stdenv.hostPlatform.system} \
           --systemd ${config.systemd.package} \
           --systemd-boot-loader-config ${loaderConfigFile} \
           --public-key ${cfg.publicKeyFile} \
diff --git a/rust/tool/shared/src/architecture.rs b/rust/tool/shared/src/architecture.rs
index 9a55f3b..94b1761 100644
--- a/rust/tool/shared/src/architecture.rs
+++ b/rust/tool/shared/src/architecture.rs
@@ -29,7 +29,7 @@ impl Architecture {
         Ok(match system_double {
             "x86_64-linux" => Self::X86,
             "aarch64-linux" => Self::AArch64,
-            _ => bail!("Unsupported NixOS system double: {}, please open an issue or a PR if you think this should be supported.", system_double)
+            _ => bail!(format!("Unsupported NixOS system: {}.", system_double)),
         })
     }
 }
diff --git a/rust/tool/shared/src/esp.rs b/rust/tool/shared/src/esp.rs
index e09d927..73a1fa6 100644
--- a/rust/tool/shared/src/esp.rs
+++ b/rust/tool/shared/src/esp.rs
@@ -3,7 +3,8 @@ use std::{
     path::{Path, PathBuf},
 };
 
-use anyhow::{Context, Result};
+use anyhow::{bail, Context, Result};
+use indoc::indoc;
 
 use crate::architecture::Architecture;
 use crate::generation::Generation;
@@ -39,10 +40,12 @@ impl EspGenerationPaths {
         let bootspec = &generation.spec.bootspec.bootspec;
         let bootspec_system: Architecture = Architecture::from_nixos_system(&bootspec.system)?;
 
-        assert_eq!(
-            system, bootspec_system,
-            "Bootspec's system differs from provided target system, unsupported usecase!"
-        );
+        if system != bootspec_system {
+            bail!(indoc! {r#"
+                The CPU architecture declared in your module differs from the one declared in the
+                bootspec of the current generation.
+            "#})
+        }
 
         Ok(Self {
             kernel: esp_paths