diff --git a/Source/Core/Core/Boot/Boot.cpp b/Source/Core/Core/Boot/Boot.cpp
index a03b9642af..06d234f220 100644
--- a/Source/Core/Core/Boot/Boot.cpp
+++ b/Source/Core/Core/Boot/Boot.cpp
@@ -39,7 +39,10 @@
 #include "Core/HW/Memmap.h"
 #include "Core/HW/VideoInterface.h"
 #include "Core/Host.h"
+#include "Core/IOS/ES/ES.h"
+#include "Core/IOS/FS/FileSystem.h"
 #include "Core/IOS/IOS.h"
+#include "Core/IOS/Uids.h"
 #include "Core/PatchEngine.h"
 #include "Core/PowerPC/PPCAnalyst.h"
 #include "Core/PowerPC/PPCSymbolDB.h"
@@ -470,26 +473,28 @@ void StateFlags::UpdateChecksum()
 
 void UpdateStateFlags(std::function<void(StateFlags*)> update_function)
 {
-  const std::string file_path =
-      Common::GetTitleDataPath(Titles::SYSTEM_MENU, Common::FROM_SESSION_ROOT) + "/" WII_STATE;
+  CreateSystemMenuTitleDirs();
+  const std::string file_path = Common::GetTitleDataPath(Titles::SYSTEM_MENU) + "/" WII_STATE;
+  const auto fs = IOS::HLE::GetIOS()->GetFS();
+  constexpr IOS::HLE::FS::Mode rw_mode = IOS::HLE::FS::Mode::ReadWrite;
+  const auto file = fs->CreateAndOpenFile(IOS::SYSMENU_UID, IOS::SYSMENU_GID, file_path, rw_mode,
+                                          rw_mode, rw_mode);
+  if (!file)
+    return;
 
-  File::IOFile file;
-  StateFlags state;
-  if (File::Exists(file_path))
-  {
-    file.Open(file_path, "r+b");
-    file.ReadBytes(&state, sizeof(state));
-  }
-  else
-  {
-    File::CreateFullPath(file_path);
-    file.Open(file_path, "a+b");
-    memset(&state, 0, sizeof(state));
-  }
+  StateFlags state{};
+  if (file->GetStatus()->size == sizeof(StateFlags))
+    file->Read(&state, 1);
 
   update_function(&state);
   state.UpdateChecksum();
 
-  file.Seek(0, SEEK_SET);
-  file.WriteBytes(&state, sizeof(state));
+  file->Seek(0, IOS::HLE::FS::SeekMode::Set);
+  file->Write(&state, 1);
+}
+
+void CreateSystemMenuTitleDirs()
+{
+  const auto es = IOS::HLE::GetIOS()->GetES();
+  es->CreateTitleDirectories(Titles::SYSTEM_MENU, IOS::SYSMENU_GID);
 }
diff --git a/Source/Core/Core/Boot/Boot.h b/Source/Core/Core/Boot/Boot.h
index a6b7391b44..b1b5ad3c07 100644
--- a/Source/Core/Core/Boot/Boot.h
+++ b/Source/Core/Core/Boot/Boot.h
@@ -151,3 +151,9 @@ struct StateFlags
 // Reads the state file from the NAND, then calls the passed update function to update the struct,
 // and finally writes the updated state file to the NAND.
 void UpdateStateFlags(std::function<void(StateFlags*)> update_function);
+
+/// Create title directories for the system menu (if needed).
+///
+/// Normally, this is automatically done by ES when the System Menu is installed,
+/// but we cannot rely on this because we don't require any system titles to be installed.
+void CreateSystemMenuTitleDirs();
diff --git a/Source/Core/Core/Boot/Boot_BS2Emu.cpp b/Source/Core/Core/Boot/Boot_BS2Emu.cpp
index 9aa077a9c3..f406c47e5b 100644
--- a/Source/Core/Core/Boot/Boot_BS2Emu.cpp
+++ b/Source/Core/Core/Boot/Boot_BS2Emu.cpp
@@ -9,8 +9,6 @@
 
 #include "Common/CommonPaths.h"
 #include "Common/CommonTypes.h"
-#include "Common/File.h"
-#include "Common/FileUtil.h"
 #include "Common/Logging/Log.h"
 #include "Common/MsgHandler.h"
 #include "Common/NandPaths.h"
@@ -227,6 +225,7 @@ bool CBoot::SetupWiiMemory()
 
   SettingsHandler gen;
   std::string serno;
+  CreateSystemMenuTitleDirs();
   const std::string settings_file_path(Common::GetTitleDataPath(Titles::SYSTEM_MENU) +
                                        "/" WII_SETTING);
 
@@ -338,11 +337,16 @@ bool CBoot::SetupWiiMemory()
 
 static void WriteEmptyPlayRecord()
 {
-  const std::string file_path =
-      Common::GetTitleDataPath(Titles::SYSTEM_MENU, Common::FROM_SESSION_ROOT) + "/play_rec.dat";
-  File::IOFile playrec_file(file_path, "r+b");
+  CreateSystemMenuTitleDirs();
+  const std::string file_path = Common::GetTitleDataPath(Titles::SYSTEM_MENU) + "/play_rec.dat";
+  const auto fs = IOS::HLE::GetIOS()->GetFS();
+  constexpr IOS::HLE::FS::Mode rw_mode = IOS::HLE::FS::Mode::ReadWrite;
+  const auto playrec_file = fs->CreateAndOpenFile(IOS::SYSMENU_UID, IOS::SYSMENU_GID, file_path,
+                                                  rw_mode, rw_mode, rw_mode);
+  if (!playrec_file)
+    return;
   std::vector<u8> empty_record(0x80);
-  playrec_file.WriteBytes(empty_record.data(), empty_record.size());
+  playrec_file->Write(empty_record.data(), empty_record.size());
 }
 
 // __________________________________________________________________________________________________