diff --git a/ecleankernel/file.py b/ecleankernel/file.py
index c552cbd..f10fa01 100644
--- a/ecleankernel/file.py
+++ b/ecleankernel/file.py
@@ -4,6 +4,7 @@
 import contextlib
 import enum
 import errno
+import io
 import importlib
 import logging
 import os
@@ -226,6 +227,17 @@ def read_version_from_efi(self,
             buf = f.read(0x40)
             if len(buf) != 0x40 or buf[:2] != b"MZ":
                 return None
+
+            # handle EFI zboot image
+            # see kernel source code drivers/firmware/efi/libstub/zboot-header.S
+            if buf[4:8] == b"zimg":
+                offset, size = struct.unpack_from("<LL", buf, 8)
+
+                f.seek(offset)
+                image = f.read(size)
+
+                return self.read_version_from_raw(io.BytesIO(image))
+
             coff_offset = struct.unpack_from("<L", buf, 0x3c)[0]
 
             # at offset, we find PE\0\0 signature and COFF file header