Merge branch 'main' into testing

18 files changed, 366 insertions, 74 deletions

diff --git a/.github/workflows/build-live-installer.yml b/.github/workflows/build-installer-iso.yml
index 0965c33..f7897b9 100644
--- a/.github/workflows/build-live-installer.yml
+++ b/.github/workflows/build-installer-iso.yml
@@ -1,4 +1,4 @@
-name: Build live installer
+name: Build installer ISO
 
 on:
   workflow_dispatch:
@@ -9,13 +9,6 @@ on:
         default: latest
         type: string
   workflow_call:
-  workflow_run:
-    workflows:
-      - Build container image
-    types:
-      - completed
-    branches:
-      - main
 
 permissions: {}
 
@@ -24,9 +17,8 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  build-live-installer:
-    name: Build KDE live installer
-    if: github.event_name != 'workflow_run' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push')
+  build-installer-iso:
+    name: Build KDE installer ISO
     runs-on: ubuntu-24.04
     permissions:
       contents: read
@@ -77,24 +69,24 @@ jobs:
         run: |
           sudo podman pull "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}"
 
-      - name: Build live installer payload
+      - name: Build installer ISO payload
         run: |
           mkdir -p output
           sudo podman tag \
             "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}" \
-            localhost/aerocore-live-payload:latest
+            localhost/aerocore-os-installer:latest
           sudo podman save \
             --format oci-archive \
             --output output/install-payload.oci \
-            localhost/aerocore-live-payload:latest
+            localhost/aerocore-os-installer:latest
 
           sudo podman build \
             --cap-add sys_admin \
             --security-opt label=disable \
             --build-arg "BASE_IMAGE=${LIVE_BASE_IMAGE}" \
-            --build-arg "INSTALL_IMAGE_PAYLOAD=localhost/aerocore-live-payload:latest" \
+            --build-arg "INSTALL_IMAGE_PAYLOAD=localhost/aerocore-os-installer:latest" \
             --build-arg "INSTALL_IMAGE_PAYLOAD_ARCHIVE=/install-payload.oci" \
-            --tag localhost/aerocore-live-payload:latest \
+            --tag localhost/aerocore-os-installer:latest \
             --file installer/Containerfile \
             .
 
@@ -102,7 +94,7 @@ jobs:
         id: build
         uses: Zeglius/titanoboa@7737f4748458252ac827dca14b3d6dd09298472a # revamp-pr
         with:
-          image-ref: localhost/aerocore-live-payload:latest
+          image-ref: localhost/aerocore-os-installer:latest
           iso-dest: ${{ github.workspace }}/output/aerocore-os-${{ env.ISO_FILE_TAG }}-amd64.iso
 
       - name: Normalize ISO output path
@@ -157,7 +149,7 @@ jobs:
         if: github.ref_name == 'testing'
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
-          name: aerocore-os-live-installer-${{ env.ISO_FILE_TAG }}-checksum
+          name: aerocore-os-installer-iso-${{ env.ISO_FILE_TAG }}-checksum
           path: ${{ steps.upload-directory.outputs.iso-upload-dir }}/*-CHECKSUM
           if-no-files-found: error
           retention-days: 1
diff --git a/.github/workflows/validate-live-installer.yml b/.github/workflows/validate-installer-iso.yml
index 3d35a5d..37f5496 100644
--- a/.github/workflows/validate-live-installer.yml
+++ b/.github/workflows/validate-installer-iso.yml
@@ -1,20 +1,20 @@
-name: Validate live installer
+name: Validate installer ISO
 
 on:
   pull_request:
     paths:
       - "Justfile"
       - "installer/**"
-      - "just_scripts/build-live-installer.sh"
-      - ".github/workflows/build-live-installer.yml"
-      - ".github/workflows/validate-live-installer.yml"
+      - "just_scripts/build-installer-iso.sh"
+      - ".github/workflows/build-installer-iso.yml"
+      - ".github/workflows/validate-installer-iso.yml"
 
 permissions:
   contents: read
 
 jobs:
-  validate-live-installer:
-    name: Validate live installer inputs
+  validate-installer-iso:
+    name: Validate installer ISO inputs
     runs-on: ubuntu-24.04
 
     steps:
diff --git a/.gitignore b/.gitignore
index 9eee28b..d4fa7cf 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,4 @@ cosign.key
 _build_*
 output
 _build-*/**
+.DS_Store
diff --git a/Justfile b/Justfile
index 6bc9957..d3252c6 100644
--- a/Justfile
+++ b/Justfile
@@ -25,20 +25,25 @@ export INSTRUMENTS_RELEASE_API_BASE := env_var_or_default("INSTRUMENTS_RELEASE_A
 alias build-vm := build-qcow2
 alias rebuild-vm := rebuild-qcow2
 alias run-vm := run-vm-qcow2
-alias build-live-iso := build-live-installer
-alias run-live-iso := run-live-installer
+alias build-installer := build-installer-iso
+alias run-installer := run-installer-iso
+# Backward-compatible aliases; these refer to the installer ISO, not a Live OS.
+alias build-live-iso := build-installer-iso
+alias run-live-iso := run-installer-iso
+alias build-live-installer := build-installer-iso
+alias run-live-installer := run-installer-iso
 
 [private]
 default:
     @just --list
 
-# Build a Bazzite-style live installer ISO
-build-live-installer $target_image=("localhost/" + image_name) $tag=default_tag:
-    @IMAGE_NAME="{{ target_image }}" IMAGE_TAG="{{ tag }}" ./just_scripts/build-live-installer.sh
+# Build a Bazzite-style installer ISO
+build-installer-iso $target_image=("localhost/" + image_name) $tag=default_tag:
+    @IMAGE_NAME="{{ target_image }}" IMAGE_TAG="{{ tag }}" ./just_scripts/build-installer-iso.sh
 
-# Boot the live installer ISO with QEMU
-run-live-installer:
-    @./just_scripts/run-live-installer.sh
+# Boot the installer ISO with QEMU
+run-installer-iso:
+    @./just_scripts/run-installer-iso.sh
 
 # Check Just Syntax
 [group('Just')]
diff --git a/README.md b/README.md
index 3fc11c5..de33959 100644
--- a/README.md
+++ b/README.md
@@ -55,15 +55,15 @@ BASE_IMAGE=ghcr.io/ublue-os/bazzite-deck:testing just build
 
 ```
 
-To build the Bazzite-style live installer locally, first build the AeroCore
+To build the Bazzite-style installer ISO locally, first build the AeroCore
 image and then run:
 
 ```bash
 sudo just build
-just build-live-installer
-just run-live-installer
+just build-installer-iso
+just run-installer-iso
 ```
 
 This requires privileged Podman, a rootful Podman API socket, and roughly
-70 GiB of free space. The live installer workflow consumes the published
+70 GiB of free space. The installer ISO workflow consumes the published
 `latest` AeroCore image and uploads the ISO as a GitHub Actions artifact.
diff --git a/build_files/image-info b/build_files/image-info
index a52d666..bd66383 100755
--- a/build_files/image-info
+++ b/build_files/image-info
@@ -49,7 +49,7 @@ sed -i "s|^DOCUMENTATION_URL=.*|DOCUMENTATION_URL=\"$DOCUMENTATION_URL\"|" /usr/
 sed -i "s|^SUPPORT_URL=.*|SUPPORT_URL=\"$SUPPORT_URL\"|" /usr/lib/os-release
 sed -i "s|^BUG_REPORT_URL=.*|BUG_REPORT_URL=\"$BUG_SUPPORT_URL\"|" /usr/lib/os-release
 sed -i "s|^CPE_NAME=.*|CPE_NAME=\"cpe:/o:universal-blue:$IMAGE_ID\"|" /usr/lib/os-release
-sed -i "s/^DEFAULT_HOSTNAME=.*/DEFAULT_HOSTNAME=\"$IMAGE_ID\"/" /usr/lib/os-release
+sed -i "s/^DEFAULT_HOSTNAME=.*/DEFAULT_HOSTNAME=\"$IMAGE_NAME\"/" /usr/lib/os-release
 sed -i "s/^ID=fedora/ID=$IMAGE_ID\nID_LIKE=\"$IMAGE_LIKE\"/" /usr/lib/os-release
 sed -i "s/^LOGO=.*/LOGO=$LOGO_ICON/" /usr/lib/os-release
 sed -i "s/^ANSI_COLOR=.*/ANSI_COLOR=\"$LOGO_COLOR\"/" /usr/lib/os-release
diff --git a/build_files/patch-bazzite-deck-identity.sh b/build_files/patch-bazzite-deck-identity.sh
index 078b76c..ea561e4 100755
--- a/build_files/patch-bazzite-deck-identity.sh
+++ b/build_files/patch-bazzite-deck-identity.sh
@@ -2,34 +2,148 @@
 
 set -euo pipefail
 
-hardware_setup="${1:-/usr/libexec/bazzite-hardware-setup}"
-# These are literal source lines; variable expansion must happen at boot time.
-# shellcheck disable=SC2016
-old_condition='if [[ "$IMAGE_NAME" != *deck* && "$IMAGE_NAME" != *dx* ]]; then'
-# shellcheck disable=SC2016
-new_condition='if [[ "$IMAGE_NAME" != aerocore-os && "$IMAGE_NAME" != *deck* && "$IMAGE_NAME" != *dx* ]]; then'
+root="${AEROCORE_DECK_COMPAT_ROOT:-}"
+root="${root%/}"
+
+target_path() {
+  printf '%s%s\n' "$root" "$1"
+}
+
+patch_condition() {
+  local file="$1"
+  local old_condition="$2"
+  local new_condition="$3"
+  local expected_count="$4"
+  local old_count new_count patched_file
+
+  if [[ ! -f "$file" ]]; then
+    echo "Unable to locate expected Bazzite Deck file: $file" >&2
+    exit 1
+  fi
+
+  new_count="$(grep -Foc "$new_condition" "$file" || true)"
+  if [[ "$new_count" -eq "$expected_count" ]]; then
+    return 0
+  fi
+
+  old_count="$(grep -Foc "$old_condition" "$file" || true)"
+  if [[ "$old_count" -ne "$expected_count" ]]; then
+    echo "Unable to locate the expected Bazzite Deck image check in $file" >&2
+    echo "Expected $expected_count occurrence(s), found old=$old_count new=$new_count" >&2
+    exit 1
+  fi
+
+  patched_file="$(mktemp)"
+  awk \
+    -v old_condition="$old_condition" \
+    -v new_condition="$new_condition" \
+    ' {
+      position = index($0, old_condition)
+      if (position) {
+        $0 = substr($0, 1, position - 1) new_condition substr($0, position + length(old_condition))
+      }
+      print
+    }' "$file" > "$patched_file"
+
+  cp "$patched_file" "$file"
+  rm -f "$patched_file"
+
+  new_count="$(grep -Foc "$new_condition" "$file" || true)"
+  if [[ "$new_count" -ne "$expected_count" ]]; then
+    echo "Failed to patch the Bazzite Deck image check in $file" >&2
+    exit 1
+  fi
+}
 
-if grep -Fqx "$new_condition" "$hardware_setup"; then
-  exit 0
-fi
+patch_steam_state_migration() {
+  local file="$1"
+  # shellcheck disable=SC2016
+  local condition='if [[ $IMAGE_NAME =~ "deck" || $IMAGE_NAME == aerocore-os ]]; then'
+  local marker='AeroCore Steam state migration'
+  local patched_file
 
-if [[ "$(grep -Fxc "$old_condition" "$hardware_setup")" -ne 1 ]]; then
-  echo "Unable to locate the Bazzite Deck image check in $hardware_setup" >&2
-  exit 1
-fi
+  if [[ ! -f "$file" ]]; then
+    echo "Unable to locate expected Bazzite Deck file: $file" >&2
+    exit 1
+  fi
 
-patched_file=$(mktemp)
-trap 'rm -f "$patched_file"' EXIT
+  if grep -Fq "$marker" "$file"; then
+    return 0
+  fi
 
-awk \
-  -v old_condition="$old_condition" \
-  -v new_condition="$new_condition" \
-  '$0 == old_condition {
-    print new_condition
-    next
-  }
-  { print }' "$hardware_setup" > "$patched_file"
+  if [[ "$(grep -Foc "$condition" "$file" || true)" -ne 1 ]]; then
+    echo "Unable to locate the AeroCore Steam bootstrap condition in $file" >&2
+    exit 1
+  fi
 
-cp "$patched_file" "$hardware_setup"
+  patched_file="$(mktemp)"
+  awk -v condition="$condition" '
+    !inserted && $0 == condition {
+      print
+      print "  # AeroCore Steam state migration"
+      print "  # Older AeroCore images could leave ~/.steam/steam as a directory."
+      print "  # Preserve it before restoring the symlink expected by Steam."
+      print "  STEAM_DATA_HOME=\"$HOME/.local/share/Steam\""
+      print "  STEAM_DATA_LINK=\"$HOME/.steam/steam\""
+      print "  if [[ -d \"$STEAM_DATA_LINK\" && ! -L \"$STEAM_DATA_LINK\" && -x \"$STEAM_DATA_HOME/steam.sh\" ]]; then"
+      print "    STEAM_DATA_BACKUP=\"${STEAM_DATA_LINK}.aerocore-backup-$(date +%s)-$$\""
+      print "    STEAM_DATA_TEMP=\"${STEAM_DATA_LINK}.aerocore-link-$$\""
+      print "    if ln -s \"$STEAM_DATA_HOME\" \"$STEAM_DATA_TEMP\" && mv -- \"$STEAM_DATA_LINK\" \"$STEAM_DATA_BACKUP\" && mv -- \"$STEAM_DATA_TEMP\" \"$STEAM_DATA_LINK\"; then"
+      print "      :"
+      print "    else"
+      print "      rm -f -- \"$STEAM_DATA_TEMP\""
+      print "    fi"
+      print "  fi"
+      inserted=1
+      next
+    }
+    { print }
+    END { if (!inserted) exit 1 }
+  ' "$file" > "$patched_file"
 
-grep -Fqx "$new_condition" "$hardware_setup"
+  cp "$patched_file" "$file"
+  rm -f "$patched_file"
+
+  if ! grep -Fq "$marker" "$file"; then
+    echo "Failed to add the AeroCore Steam state migration to $file" >&2
+    exit 1
+  fi
+}
+
+# Keep AeroCore's public image-name, while restoring the Deck capability checks
+# used by Bazzite's runtime scripts. These are literal source lines; variable
+# expansion must happen later, when the scripts run on the installed system.
+# shellcheck disable=SC2016
+patch_condition \
+  "${1:-$(target_path /usr/libexec/bazzite-hardware-setup)}" \
+  'if [[ "$IMAGE_NAME" != *deck* && "$IMAGE_NAME" != *dx* ]]; then' \
+  'if [[ "$IMAGE_NAME" != aerocore-os && "$IMAGE_NAME" != *deck* && "$IMAGE_NAME" != *dx* ]]; then' \
+  1
+
+# The hardware setup has a second Deck-only block after the top-level image
+# guard. Keep it active for AeroCore as well.
+# shellcheck disable=SC2016
+patch_condition \
+  "${1:-$(target_path /usr/libexec/bazzite-hardware-setup)}" \
+  'if [[ $IMAGE_NAME =~ "deck" || $IMAGE_NAME =~ "ally" ]]; then' \
+  'if [[ $IMAGE_NAME =~ "deck" || $IMAGE_NAME =~ "ally" || $IMAGE_NAME == aerocore-os ]]; then' \
+  1
+
+# bazzite-steam gates the Steam bootstrap archive and -steamdeck flag on the
+# image name. The user setup script has the same Deck-only gating in three
+# places.
+# shellcheck disable=SC2016
+patch_condition \
+  "$(target_path /usr/bin/bazzite-steam)" \
+  'if [[ $IMAGE_NAME =~ "deck" ]]; then' \
+  'if [[ $IMAGE_NAME =~ "deck" || $IMAGE_NAME == aerocore-os ]]; then' \
+  1
+
+patch_steam_state_migration "$(target_path /usr/bin/bazzite-steam)"
+
+# shellcheck disable=SC2016
+patch_condition \
+  "$(target_path /usr/libexec/bazzite-user-setup)" \
+  'if [[ $IMAGE_NAME =~ "deck" || $IMAGE_NAME =~ "ally" ]]; then' \
+  'if [[ $IMAGE_NAME =~ "deck" || $IMAGE_NAME =~ "ally" || $IMAGE_NAME == aerocore-os ]]; then' \
+  3
diff --git a/installer/Containerfile b/installer/Containerfile
index 50579e6..fa5d731 100644
--- a/installer/Containerfile
+++ b/installer/Containerfile
@@ -1,8 +1,8 @@
-# Build the live installer payload from a desktop Bazzite runtime.
+# Build the installer ISO payload from a desktop Bazzite runtime.
 # The image installed to disk is supplied separately as INSTALL_IMAGE_PAYLOAD.
 
 ARG BASE_IMAGE=ghcr.io/ublue-os/bazzite:stable
-ARG INSTALL_IMAGE_PAYLOAD=ghcr.io/AeroCore-IO/aerocore-bazzite-image:stable
+ARG INSTALL_IMAGE_PAYLOAD=ghcr.io/AeroCore-IO/aerocore-os:stable
 ARG INSTALL_IMAGE_PAYLOAD_ARCHIVE=/install-payload.oci
 
 FROM ${BASE_IMAGE}
diff --git a/installer/branding/sidebar-bg.png b/installer/branding/sidebar-bg.png
new file mode 100644
index 0000000..f957fec
--- /dev/null
+++ b/installer/branding/sidebar-bg.png
diff --git a/installer/branding/sidebar-logo.png b/installer/branding/sidebar-logo.png
new file mode 100644
index 0000000..0f47606
--- /dev/null
+++ b/installer/branding/sidebar-logo.png
diff --git a/installer/build.sh b/installer/build.sh
index 033fe9b..c119dcc 100755
--- a/installer/build.sh
+++ b/installer/build.sh
@@ -19,6 +19,13 @@ dnf --setopt=excludepkgs= install -y \
   libblockdev-lvm \
   dracut-live \
   livesys-scripts \
+  grub2-efi-x64 \
+  grub2-efi-x64-cdboot
+
+# Kinoite can carry the EFI packages in the RPM database without their files
+# materialized in the container filesystem. Restore the files for the ISO.
+dnf --setopt=excludepkgs= reinstall -y \
+  grub2-efi-x64 \
   grub2-efi-x64-cdboot
 
 # Apply the same AeroCore overlay to the live session where possible.
@@ -26,6 +33,51 @@ if [[ -d /src/system_files ]]; then
   cp -a /src/system_files/. /
 fi
 
+BRANDING_DIR="${SCRIPT_DIR}/branding"
+if [[ -d "${BRANDING_DIR}" ]]; then
+  mkdir -p /usr/share/anaconda/pixmaps
+  cp -a "${BRANDING_DIR}/." /usr/share/anaconda/pixmaps/
+fi
+
+# Installer-only overrides, kept separate from the installed AeroCore payload.
+if [[ -d "${SCRIPT_DIR}/system_files/overrides" ]]; then
+  cp -a "${SCRIPT_DIR}/system_files/overrides/." /
+fi
+
+# Plasma's live-session launcher defaults to start-here, and Fedora keeps
+# LOGO=fedora-logo-icon in the base live environment.
+for size in 16x16 22x22 24x24 32x32 36x36 48x48 64x64 96x96 128x128 256x256; do
+  icon_dir="/usr/share/icons/hicolor/${size}"
+  if [[ -f "${icon_dir}/bazzite-logo-icon.png" ]]; then
+    mkdir -p "${icon_dir}/apps" "${icon_dir}/places"
+    cp -f "${icon_dir}/bazzite-logo-icon.png" "${icon_dir}/apps/fedora-logo-icon.png"
+    cp -f "${icon_dir}/bazzite-logo-icon.png" "${icon_dir}/places/start-here.png"
+  fi
+done
+
+if [[ -f /usr/share/icons/hicolor/scalable/places/distributor-logo.svg ]]; then
+  mkdir -p /usr/share/icons/hicolor/scalable/apps /usr/share/icons/hicolor/scalable/places
+  cp -f /usr/share/icons/hicolor/scalable/places/distributor-logo.svg \
+    /usr/share/icons/hicolor/scalable/apps/start-here.svg
+  cp -f /usr/share/icons/hicolor/scalable/places/distributor-logo.svg \
+    /usr/share/icons/hicolor/scalable/places/start-here.svg
+fi
+
+sed -i 's/^LOGO=.*/LOGO=distributor-logo/' /usr/lib/os-release
+
+for desktop_file in \
+  /usr/share/applications/liveinst.desktop \
+  /usr/share/applications/org.fedoraproject.AnacondaInstaller.desktop \
+  /usr/share/applications/anaconda.desktop; do
+  if [[ -f "${desktop_file}" ]]; then
+    sed -i 's/^Icon=.*/Icon=org.fedoraproject.AnacondaInstaller/' "${desktop_file}"
+  fi
+done
+
+if command -v gtk-update-icon-cache >/dev/null 2>&1; then
+  gtk-update-icon-cache -f /usr/share/icons/hicolor || true
+fi
+
 # Make the install payload available to Anaconda.
 if [[ -n "${INSTALL_IMAGE_PAYLOAD_ARCHIVE}" && -f "${INSTALL_IMAGE_PAYLOAD_ARCHIVE}" ]]; then
   podman load --storage-opt additionalimagestore='' < "${INSTALL_IMAGE_PAYLOAD_ARCHIVE}"
@@ -39,7 +91,42 @@ fi
 # Tell Anaconda to install the bootc container that was loaded above.
 mkdir -p /var/lib/rpm-state
 cat >> /usr/share/anaconda/interactive-defaults.ks <<EOF
+%pre-install --log=/tmp/aerocore-var-tmp.log
+set -eux
+target_tmp=
+for root in /mnt/sysimage /mnt/sysroot /var/mnt/sysimage; do
+    if mountpoint -q \${root}; then
+        target_tmp=\${root}/var/tmp
+        break
+    fi
+done
+if [ x\${target_tmp} = x ]; then
+    echo No mounted target system found for /var/tmp bind mount >&2
+    exit 1
+fi
+mkdir -p \${target_tmp}
+chmod 1777 \${target_tmp}
+mount --bind \${target_tmp} /var/tmp
+df -h /var/tmp \${target_tmp}
+%end
+
 ostreecontainer --url=${INSTALL_IMAGE_PAYLOAD} --transport=containers-storage --no-signature-verification
+
+%post --nochroot --log=/tmp/aerocore-hostname.log
+set -eux
+target_root=
+for root in /mnt/sysroot /mnt/sysimage /var/mnt/sysimage; do
+    if mountpoint -q \${root}; then
+        target_root=\${root}
+        break
+    fi
+done
+if [ x\${target_root} = x ]; then
+    echo No mounted target system found for hostname setup >&2
+    exit 1
+fi
+systemd-firstboot --root=\${target_root} --hostname=aerocore-os
+%end
 EOF
 
 mkdir -p /usr/lib/bootc-image-builder
@@ -57,9 +144,23 @@ sed -i 's/^livesys_session=.*/livesys_session=kde/' /etc/sysconfig/livesys
 systemctl enable livesys.service livesys-late.service
 
 mkdir -p /boot/efi
-if compgen -G '/usr/lib/efi/*/*/EFI' >/dev/null; then
-  cp -a /usr/lib/efi/*/*/EFI /boot/efi/
+efi_dir="$(find /usr/lib/efi -type d -name EFI -print -quit 2>/dev/null || true)"
+if [[ -n "${efi_dir}" ]]; then
+  cp -a "${efi_dir}" /boot/efi/
+fi
+
+# bootc-image-builder needs the Fedora live ISO fallback EFI loader.
+grubx64="$(find /usr/lib/efi /boot/efi -type f \
+  -path '*/EFI/fedora/grubx64.efi' -print -quit 2>/dev/null || true)"
+if [[ -z "${grubx64}" ]]; then
+  echo "grubx64.efi was not found in the installed EFI tree" >&2
+  find /usr/lib/efi /boot/efi -type f -path '*/EFI/*' -print >&2 || true
+  exit 1
 fi
+mkdir -p /boot/efi/EFI/BOOT
+# UEFI removable-media fallback; keep fbx64.efi for bootc-image-builder.
+cp -v "${grubx64}" /boot/efi/EFI/BOOT/BOOTX64.EFI
+cp -v "${grubx64}" /boot/efi/EFI/BOOT/fbx64.efi
 
-systemd-firstboot --timezone UTC
+systemd-firstboot --hostname aerocore-os --timezone UTC
 dnf clean all
diff --git a/installer/iso.yaml b/installer/iso.yaml
index 8e6bd73..4b9fd2c 100644
--- a/installer/iso.yaml
+++ b/installer/iso.yaml
@@ -1,10 +1,10 @@
-label: "AeroCore-Live"
+label: "AeroCore-Installer"
 grub2:
   timeout: 3
   entries:
     - name: "Launch AeroCore Installer"
-      linux: "/images/pxeboot/vmlinuz quiet rhgb root=live:CDLABEL=AeroCore-Live enforcing=0 rd.live.image"
+      linux: "/images/pxeboot/vmlinuz quiet rhgb root=live:CDLABEL=AeroCore-Installer enforcing=0 rd.live.image"
       initrd: "/images/pxeboot/initrd.img"
     - name: "Launch AeroCore Installer (Basic Graphics Mode)"
-      linux: "/images/pxeboot/vmlinuz quiet rhgb root=live:CDLABEL=AeroCore-Live enforcing=0 rd.live.image nomodeset"
+      linux: "/images/pxeboot/vmlinuz quiet rhgb root=live:CDLABEL=AeroCore-Installer enforcing=0 rd.live.image nomodeset"
       initrd: "/images/pxeboot/initrd.img"
diff --git a/installer/lorax_templates/set_default_user.tmpl b/installer/lorax_templates/set_default_user.tmpl
index b4cf2c8..c20736f 100644
--- a/installer/lorax_templates/set_default_user.tmpl
+++ b/installer/lorax_templates/set_default_user.tmpl
@@ -1 +1 @@
-append usr/share/anaconda/interactive-defaults.ks "\\nuser --name=aerocore --password=aerocore --plaintext --groups=wheel"
+append usr/share/anaconda/interactive-defaults.ks "\\nuser --name=aerocore --lock --groups=wheel"
diff --git a/installer/system_files/overrides/usr/share/icons/hicolor/48x48/apps/org.fedoraproject.AnacondaInstaller.svg b/installer/system_files/overrides/usr/share/icons/hicolor/48x48/apps/org.fedoraproject.AnacondaInstaller.svg
new file mode 100644
index 0000000..04454b7
--- /dev/null
+++ b/installer/system_files/overrides/usr/share/icons/hicolor/48x48/apps/org.fedoraproject.AnacondaInstaller.svg
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg width="104px" height="104px" viewBox="0 0 104 104" version="1.1" xmlns="http://www.w3.org/2000/svg">
+  <title>aerocore-installer</title>
+  <defs>
+    <linearGradient x1="0%" y1="100%" x2="100%" y2="100%" id="window-shadow">
+      <stop stop-color="#ACABAE" offset="0%"/>
+      <stop stop-color="#F7F7F7" offset="3.8%"/>
+      <stop stop-color="#DEDDDA" offset="7.7%"/>
+      <stop stop-color="#B0AFAD" offset="92.3%"/>
+      <stop stop-color="#C0BFBC" offset="96.2%"/>
+      <stop stop-color="#77767B" offset="100%"/>
+    </linearGradient>
+    <linearGradient x1="73.6318768%" y1="26.3681232%" x2="0%" y2="100%" id="aerocore-mark">
+      <stop stop-color="#006F84" offset="0%"/>
+      <stop stop-color="#00B875" offset="100%"/>
+    </linearGradient>
+  </defs>
+  <g fill="none" fill-rule="evenodd">
+    <rect fill="url(#window-shadow)" x="0" y="4" width="104" height="100" rx="8"/>
+    <rect fill="#FFFFFF" x="0" y="0" width="104" height="100" rx="8"/>
+    <g transform="translate(12, 76)">
+      <rect fill="#E1DEDB" x="0" y="0" width="80" height="8" rx="4"/>
+      <rect fill="#006F84" x="0" y="0" width="48.125" height="8" rx="4"/>
+    </g>
+    <g transform="translate(28, 12)">
+      <circle fill="url(#aerocore-mark)" cx="26" cy="26" r="26"/>
+      <path d="M26.0064,10.35 C26.6309,10.3472 27.2474,10.5101 27.7891,10.8208 C28.3120,11.1209 28.7651,11.5588 29.0882,12.1186 L37.6797,27.0006 C37.1939,26.3901 36.4549,26.0229 35.6622,26.0145 L35.6346,26.0144 L28.9472,26.0144 L26.0234,20.9502 L23.0996,26.0144 L16.4121,26.0144 C15.6031,26.0144 14.8474,26.3884 14.3564,27.0143 L22.9416,12.1439 C23.5929,11.0160 24.7911,10.3572 26.0064,10.35 Z" fill="#FFFFFF" opacity="0.4"/>
+      <path d="M37.8863,27.3274 L43.1174,36.3879 C44.0975,38.0854 43.5159,40.2559 41.8184,41.2360 C40.1209,42.2160 37.9504,41.6344 36.9704,39.9369 L33.8933,34.6074 L18.1534,34.6074 L15.0764,39.9369 C14.0964,41.6344 11.9259,42.2160 10.2284,41.2360 C8.5309,40.2559 7.9493,38.0854 8.9294,36.3879 L14.1605,27.3274 C14.6249,26.5229 15.4832,26.0274 16.4121,26.0274 L35.6346,26.0274 C36.5635,26.0274 37.4219,26.5229 37.8863,27.3274 Z" fill="#FFFFFF" opacity="0.8"/>
+      <path d="M34.3566,29.5309 L32.9896,29.5309 C32.6142,29.5309 32.3091,29.8363 32.3091,30.2134 C32.3091,30.5929 32.6138,30.8959 32.9896,30.8959 L34.3566,30.8959 L34.3566,32.2629 C34.3566,32.6383 34.6620,32.9434 35.0391,32.9434 C35.4186,32.9434 35.7216,32.6387 35.7216,32.2629 L35.7216,30.8959 L37.0886,30.8959 C37.4640,30.8959 37.7691,30.5905 37.7691,30.2134 C37.7691,29.8339 37.4644,29.5309 37.0886,29.5309 L35.7216,29.5309 L35.7216,28.1639 C35.7216,27.7885 35.4162,27.4834 35.0391,27.4834 C34.6596,27.4834 34.3566,27.7881 34.3566,28.1639 L34.3566,29.5309 Z" fill="#FFFFFF"/>
+      <path d="M17.0991,32.9434 C15.5913,32.9434 14.3691,31.7211 14.3691,30.2134 C14.3691,28.7057 15.5914,27.4834 17.0991,27.4834 C18.6069,27.4834 19.8291,28.7057 19.8291,30.2134 C19.8291,31.7212 18.6068,32.9434 17.0991,32.9434 Z" fill="#FFFFFF"/>
+    </g>
+  </g>
+</svg>
diff --git a/installer/system_files/overrides/usr/share/icons/hicolor/scalable/apps/org.fedoraproject.AnacondaInstaller.svg b/installer/system_files/overrides/usr/share/icons/hicolor/scalable/apps/org.fedoraproject.AnacondaInstaller.svg
new file mode 100644
index 0000000..04454b7
--- /dev/null
+++ b/installer/system_files/overrides/usr/share/icons/hicolor/scalable/apps/org.fedoraproject.AnacondaInstaller.svg
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg width="104px" height="104px" viewBox="0 0 104 104" version="1.1" xmlns="http://www.w3.org/2000/svg">
+  <title>aerocore-installer</title>
+  <defs>
+    <linearGradient x1="0%" y1="100%" x2="100%" y2="100%" id="window-shadow">
+      <stop stop-color="#ACABAE" offset="0%"/>
+      <stop stop-color="#F7F7F7" offset="3.8%"/>
+      <stop stop-color="#DEDDDA" offset="7.7%"/>
+      <stop stop-color="#B0AFAD" offset="92.3%"/>
+      <stop stop-color="#C0BFBC" offset="96.2%"/>
+      <stop stop-color="#77767B" offset="100%"/>
+    </linearGradient>
+    <linearGradient x1="73.6318768%" y1="26.3681232%" x2="0%" y2="100%" id="aerocore-mark">
+      <stop stop-color="#006F84" offset="0%"/>
+      <stop stop-color="#00B875" offset="100%"/>
+    </linearGradient>
+  </defs>
+  <g fill="none" fill-rule="evenodd">
+    <rect fill="url(#window-shadow)" x="0" y="4" width="104" height="100" rx="8"/>
+    <rect fill="#FFFFFF" x="0" y="0" width="104" height="100" rx="8"/>
+    <g transform="translate(12, 76)">
+      <rect fill="#E1DEDB" x="0" y="0" width="80" height="8" rx="4"/>
+      <rect fill="#006F84" x="0" y="0" width="48.125" height="8" rx="4"/>
+    </g>
+    <g transform="translate(28, 12)">
+      <circle fill="url(#aerocore-mark)" cx="26" cy="26" r="26"/>
+      <path d="M26.0064,10.35 C26.6309,10.3472 27.2474,10.5101 27.7891,10.8208 C28.3120,11.1209 28.7651,11.5588 29.0882,12.1186 L37.6797,27.0006 C37.1939,26.3901 36.4549,26.0229 35.6622,26.0145 L35.6346,26.0144 L28.9472,26.0144 L26.0234,20.9502 L23.0996,26.0144 L16.4121,26.0144 C15.6031,26.0144 14.8474,26.3884 14.3564,27.0143 L22.9416,12.1439 C23.5929,11.0160 24.7911,10.3572 26.0064,10.35 Z" fill="#FFFFFF" opacity="0.4"/>
+      <path d="M37.8863,27.3274 L43.1174,36.3879 C44.0975,38.0854 43.5159,40.2559 41.8184,41.2360 C40.1209,42.2160 37.9504,41.6344 36.9704,39.9369 L33.8933,34.6074 L18.1534,34.6074 L15.0764,39.9369 C14.0964,41.6344 11.9259,42.2160 10.2284,41.2360 C8.5309,40.2559 7.9493,38.0854 8.9294,36.3879 L14.1605,27.3274 C14.6249,26.5229 15.4832,26.0274 16.4121,26.0274 L35.6346,26.0274 C36.5635,26.0274 37.4219,26.5229 37.8863,27.3274 Z" fill="#FFFFFF" opacity="0.8"/>
+      <path d="M34.3566,29.5309 L32.9896,29.5309 C32.6142,29.5309 32.3091,29.8363 32.3091,30.2134 C32.3091,30.5929 32.6138,30.8959 32.9896,30.8959 L34.3566,30.8959 L34.3566,32.2629 C34.3566,32.6383 34.6620,32.9434 35.0391,32.9434 C35.4186,32.9434 35.7216,32.6387 35.7216,32.2629 L35.7216,30.8959 L37.0886,30.8959 C37.4640,30.8959 37.7691,30.5905 37.7691,30.2134 C37.7691,29.8339 37.4644,29.5309 37.0886,29.5309 L35.7216,29.5309 L35.7216,28.1639 C35.7216,27.7885 35.4162,27.4834 35.0391,27.4834 C34.6596,27.4834 34.3566,27.7881 34.3566,28.1639 L34.3566,29.5309 Z" fill="#FFFFFF"/>
+      <path d="M17.0991,32.9434 C15.5913,32.9434 14.3691,31.7211 14.3691,30.2134 C14.3691,28.7057 15.5914,27.4834 17.0991,27.4834 C18.6069,27.4834 19.8291,28.7057 19.8291,30.2134 C19.8291,31.7212 18.6068,32.9434 17.0991,32.9434 Z" fill="#FFFFFF"/>
+    </g>
+  </g>
+</svg>
diff --git a/installer/system_files/overrides/usr/share/icons/hicolor/symbolic/apps/org.fedoraproject.AnacondaInstaller-symbolic.svg b/installer/system_files/overrides/usr/share/icons/hicolor/symbolic/apps/org.fedoraproject.AnacondaInstaller-symbolic.svg
new file mode 100644
index 0000000..f8dedad
--- /dev/null
+++ b/installer/system_files/overrides/usr/share/icons/hicolor/symbolic/apps/org.fedoraproject.AnacondaInstaller-symbolic.svg
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg width="14px" height="16px" viewBox="0 0 14 16" version="1.1" xmlns="http://www.w3.org/2000/svg">
+  <title>aerocore-installer-symbolic</title>
+  <g transform="translate(1, 1)" fill="#000000" fill-rule="nonzero">
+    <g transform="translate(0, 13)">
+      <rect opacity="0.257" x="0" y="0" width="11.9892" height="1.6" rx="0.8"/>
+      <rect x="0" y="0" width="7.625" height="1.6" rx="0.8"/>
+    </g>
+    <path d="M6,0 C9.3137,0 12,2.6863 12,6 C12,9.3137 9.3137,12 6,12 C2.6863,12 0,9.3137 0,6 C0,2.6863 2.6863,0 6,0 Z M8.2194,6 L3.7835,6 C3.5691,6 3.3710,6.1144 3.2639,6.3 L2.0567,8.3909 C1.8305,8.7826 1.9647,9.2835 2.3565,9.5097 C2.7482,9.7358 3.2491,9.6016 3.4752,9.2099 L4.1853,7.98 L7.8176,7.98 L8.5277,9.2099 C8.7538,9.6016 9.2547,9.7358 9.6465,9.5097 C10.0382,9.2835 10.1724,8.7826 9.9462,8.3909 L8.7390,6.3 C8.6319,6.1144 8.4338,6 8.2194,6 Z M5.9929,2.388 C5.7126,2.3897 5.4406,2.5358 5.2903,2.7961 L3.4885,5.917 C3.5802,5.8774 3.6803,5.856 3.7835,5.856 L5.4081,5.856 L6.0015,4.8283 L6.5948,5.856 L8.2194,5.856 C8.3226,5.856 8.4228,5.8774 8.5145,5.917 L6.7126,2.7961 C6.6378,2.6666 6.5329,2.5653 6.4108,2.4961 C6.2850,2.4247 6.1410,2.3873 5.9929,2.388 Z"/>
+    <path d="M7.9245,6.8085 L7.6090,6.8085 C7.5224,6.8085 7.452,6.8790 7.452,6.966 C7.452,7.0536 7.5223,7.1235 7.6090,7.1235 L7.9245,7.1235 L7.9245,7.439 C7.9245,7.5256 7.9950,7.596 8.082,7.596 C8.1696,7.596 8.2395,7.5257 8.2395,7.439 L8.2395,7.1235 L8.5550,7.1235 C8.6416,7.1235 8.712,7.0530 8.712,6.966 C8.712,6.8784 8.6417,6.8085 8.5550,6.8085 L8.2395,6.8085 L8.2395,6.4930 C8.2395,6.4064 8.1690,6.336 8.082,6.336 C7.9944,6.336 7.9245,6.4063 7.9245,6.4930 L7.9245,6.8085 Z"/>
+    <path d="M3.942,7.596 C3.5941,7.596 3.312,7.3139 3.312,6.966 C3.312,6.6181 3.5941,6.336 3.942,6.336 C4.2899,6.336 4.572,6.6181 4.572,6.966 C4.572,7.3139 4.2899,7.596 3.942,7.596 Z"/>
+  </g>
+</svg>
diff --git a/just_scripts/build-live-installer.sh b/just_scripts/build-installer-iso.sh
index 45335cb..38e1718 100755
--- a/just_scripts/build-live-installer.sh
+++ b/just_scripts/build-installer-iso.sh
@@ -10,7 +10,7 @@ image_tag="${IMAGE_TAG:-$(just generate-default-tag)}"
 live_base_image="${LIVE_BASE_IMAGE:-quay.io/fedora/fedora-kinoite:43}"
 installer_builder_image="${INSTALLER_BUILDER_IMAGE:-ghcr.io/jasonn3/build-container-installer:v1.5.0}"
 source_image="${image_name}:${image_tag}"
-payload="localhost/aerocore-live-payload:latest"
+payload="localhost/aerocore-os-installer:latest"
 output_dir="${project_root}/output"
 payload_archive="${output_dir}/install-payload.oci"
 iso="${output_dir}/aerocore-os-${image_tag}-amd64.iso"
@@ -102,7 +102,7 @@ fi
   ENABLE_CACHE_DNF="false" \
   ENABLE_CACHE_SKOPEO="false" \
   ENABLE_FLATPAK_DEPENDENCIES="false" \
-  IMAGE_NAME="aerocore-live-payload" \
+  IMAGE_NAME="aerocore-os-installer" \
   IMAGE_REPO="localhost" \
   IMAGE_SRC="containers-storage:${payload}" \
   IMAGE_TAG="latest" \
diff --git a/just_scripts/run-live-installer.sh b/just_scripts/run-installer-iso.sh
index 2723aae..2c49164 100755
--- a/just_scripts/run-live-installer.sh
+++ b/just_scripts/run-installer-iso.sh
@@ -9,7 +9,7 @@ image_tag="${IMAGE_TAG:-$(just generate-default-tag)}"
 iso="${project_root}/output/aerocore-os-${image_tag}-amd64.iso"
 
 if [[ ! -f "${iso}" ]]; then
-  just build-live-installer
+  just build-installer-iso
 fi
 
 podman run --rm --cap-add NET_ADMIN \