diff --git a/.github/renovate.json5 b/.github/renovate.json5
index 557a458e..a792d1cc 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -8,25 +8,8 @@
 
   // Do not rebase when the default branch is updated
   "rebaseWhen": "never",
-    customManagers: [
-    {
-      customType: 'regex',
-      managerFilePatterns: [
-        '/^Justfile$/',
-      ],
-      matchStrings: [
-        '(?<justName>.+?)\\s:=\\s"(?<packageName>\\S+):(?<currentValue>\\S+)@(?<currentDigest>sha256:[a-f0-9]+?)"',
-      ],
-      datasourceTemplate: 'docker',
-    },
-    ],
 
   "packageRules": [
-    {
-      "description": "Use merge commits when automerging into stable branches to match branch ruleset restrictions",
-      "matchBaseBranches": ["/^stable-f[0-9][0-9]$/"],
-      "automergeStrategy": "merge-commit"
-    },
     {
       "automerge": true,
       "matchUpdateTypes": ["pin", "pinDigest"]
@@ -36,13 +19,6 @@
       "matchManagers": ["dockerfile"],
       "matchUpdateTypes": ["digest"]
     },
-    {
-      // We always want to trigger a fresh build when we have a new base image on every branch
-      // so we get package and security updates
-      "matchDepNames": ["quay.io/fedora-ostree-desktops/kinoite"],
-      "automerge": true,
-      "matchUpdateTypes": ["digest"]
-    },
     {
       "matchDepNames": ["quay.io/fedora-ostree-desktops/kinoite"],
       "matchUpdateTypes": ["major"],
@@ -72,9 +48,27 @@
       "matchDepNames": [
         "!oras-project/setup-oras",
         "!sigstore/cosign-installer",
+        "!sigstore/cosign",
+        "!zizmorcore/zizmor-action",
         "!anchore/sbom-action"
       ],
       "schedule": ["on sunday"]
+    },
+    // these two are needed because we don't really run images based on a schedule
+    // :testing/main branch must be defined first or else it overwrites rules for stable
+    {
+      "description": "Automerge kinoite digest updates on main with default merge strategy",
+      "matchDepNames": ["quay.io/fedora-ostree-desktops/kinoite"],
+      "matchUpdateTypes": ["digest"],
+      "automerge": true
+    },
+    {
+      "description": "Use merge commits when automerging into stable branches to match branch ruleset restrictions",
+      "matchDepNames": ["quay.io/fedora-ostree-desktops/kinoite"],
+      "matchUpdateTypes": ["digest"],
+      "matchBaseBranches": ["/^stable-f[0-9][0-9]$/"],
+      "automergeStrategy": "merge-commit",
+      "automerge": true
     }
   ]
 }
diff --git a/.github/workflows/build-image-latest-main.yml b/.github/workflows/build-image-latest-main.yml
index 774c6846..2c8127e1 100644
--- a/.github/workflows/build-image-latest-main.yml
+++ b/.github/workflows/build-image-latest-main.yml
@@ -25,7 +25,7 @@ permissions: {}
 jobs:
   build-image-latest:
     name: Build Latest Images
-    uses: ./.github/workflows/reusable-build.yml
+    uses: $/.github/workflows/reusable-build.yml
     permissions:
       contents: read
       packages: write
@@ -48,6 +48,6 @@ jobs:
     needs: [build-image-latest]
     permissions:
       contents: write
-    uses: ./.github/workflows/generate-release.yml
+    uses: $/.github/workflows/generate-release.yml
     with:
       stream_name: '["latest"]'
diff --git a/.github/workflows/build-image-stable.yml b/.github/workflows/build-image-stable.yml
index b02d1bd6..13f4553e 100644
--- a/.github/workflows/build-image-stable.yml
+++ b/.github/workflows/build-image-stable.yml
@@ -19,7 +19,7 @@ permissions: {}
 jobs:
   build-image-stable:
     name: Build Stable Images
-    uses: ./.github/workflows/reusable-build.yml
+    uses: $/.github/workflows/reusable-build.yml
     permissions:
       contents: read
       packages: write
@@ -40,6 +40,6 @@ jobs:
     needs: [build-image-stable]
     permissions:
       contents: write
-    uses: ./.github/workflows/generate-release.yml
+    uses: $/.github/workflows/generate-release.yml
     with:
       stream_name: '["stable"]'
diff --git a/.github/workflows/build-image-testing.yml b/.github/workflows/build-image-testing.yml
index 5a353d54..86342554 100644
--- a/.github/workflows/build-image-testing.yml
+++ b/.github/workflows/build-image-testing.yml
@@ -16,7 +16,7 @@ permissions: {}
 jobs:
   build-image-testing:
     name: Build Testing Images
-    uses: ./.github/workflows/reusable-build.yml
+    uses: $/.github/workflows/reusable-build.yml
     permissions:
       contents: read
       packages: write
@@ -39,6 +39,6 @@ jobs:
     needs: [build-image-testing]
     permissions:
       contents: write
-    uses: ./.github/workflows/generate-release.yml
+    uses: $/.github/workflows/generate-release.yml
     with:
       stream_name: '["testing"]'
diff --git a/.github/workflows/cherry-pick-to-stable.yml b/.github/workflows/cherry-pick-to-stable.yml
index a9349185..e4548f05 100644
--- a/.github/workflows/cherry-pick-to-stable.yml
+++ b/.github/workflows/cherry-pick-to-stable.yml
@@ -18,10 +18,13 @@ jobs:
     steps:
       - name: Generate a GitHub App Token
         id: generate-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3
         with:
           client-id: ${{ secrets.AURORABOT_APP_ID }}
           private-key: ${{ secrets.AURORABOT_PRIVATE_KEY }}
+          repositories: ${{ github.event.repository.name }}
+          permission-contents: write
+          permission-pull-requests: write
 
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -43,7 +46,7 @@ jobs:
 
       - name: Create Backport Pull Requests
         id: backport
-        uses: korthout/backport-action@6b65649031ac6d18ffdfd0c0820e9436f3fde22b # v4.6.1
+        uses: korthout/backport-action@8560fb503c275d433c56f05a2f64850093baa9f7 # v4.7.0
         with:
           # Use the dynamically generated GitHub App token here too
           github_token: ${{ steps.generate-token.outputs.token }}
diff --git a/.github/workflows/generate-release.yml b/.github/workflows/generate-release.yml
index 492f2f18..4e483290 100644
--- a/.github/workflows/generate-release.yml
+++ b/.github/workflows/generate-release.yml
@@ -48,7 +48,7 @@ jobs:
           just check
 
       - name: Install ORAS
-        uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1
+        uses: oras-project/setup-oras@5e2f2482b30b0cb3e14e67f89a80c88c659a7c63 # v2.0.3
 
       - name: Generate Release Text
         id: generate-release-text
diff --git a/.github/workflows/needinfo-close.yml b/.github/workflows/needinfo-close.yml
new file mode 100644
index 00000000..f9aace63
--- /dev/null
+++ b/.github/workflows/needinfo-close.yml
@@ -0,0 +1,37 @@
+name: Close Inactive Tagged Issues
+
+on:
+  schedule:
+    - cron: '0 0 * * *' # Runs daily at midnight UTC
+  workflow_dispatch:     # Allows manual testing via the Actions tab
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  close-issues-without-info:
+    name: Close issues without info
+    runs-on: ubuntu-slim
+    if: github.repository == 'ublue-os/aurora'
+    permissions:
+      issues: write # posts comments on issues
+    steps:
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
+        with:
+          # Only process issues that carry this specific label
+          only-issue-labels: 'NEEDSINFO'
+
+          # By treating your tag as the stale marker, it closes after X days of inactivity
+          stale-issue-label: 'NEEDSINFO'
+          days-before-issue-stale: -1 # Prevents adding any other stale label
+          days-before-issue-close: 14  # Closes 14 day after the label was added with no activity
+
+          # Prevents PRs from being processed or closed
+          days-before-pr-stale: -1
+          days-before-pr-close: -1
+
+          close-issue-message: 'This issue was closed because requested info was not provided.'
+          close-issue-reason: 'not_planned'
diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml
index 26c2e4ae..c9cedbc0 100644
--- a/.github/workflows/reusable-build.yml
+++ b/.github/workflows/reusable-build.yml
@@ -31,6 +31,7 @@ on:
 
 env:
   IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
+  GITHUB_REPOSITORY_OWNER: ${{ github.repository_owner }}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }}
@@ -89,10 +90,10 @@ jobs:
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         # be careful when upgrading major versions
         with:
-          cosign-release: 'v3.1.3'
+          cosign-release: 'v3.1.4'
 
       - name: Install ORAS
-        uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1
+        uses: oras-project/setup-oras@5e2f2482b30b0cb3e14e67f89a80c88c659a7c63 # v2.0.3
 
       - name: Check Just Syntax
         shell: bash
@@ -142,7 +143,7 @@ jobs:
           MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }}
         run: |
           $(command -v just) \
-            repo_organization="${{ github.repository_owner }}" \
+            repo_organization="${GITHUB_REPOSITORY_OWNER}" \
             build \
             --image "${MATRIX_BASE_NAME}" \
             --tag "${MATRIX_STREAM_NAME}" \
@@ -186,7 +187,7 @@ jobs:
       - name: Setup Syft
         id: setup-syft
         if: inputs.publish
-        uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+        uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
 
       - name: Generate SBOM
         if: inputs.publish
@@ -231,7 +232,7 @@ jobs:
 
       - name: Upload OCI Archive as Artifact
         if: github.event_name == 'pull_request'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ env.IMAGE_NAME }}-${{ matrix.architecture }}.oci
           path: ${{ env.IMAGE_NAME }}-${{ matrix.architecture }}.oci
@@ -404,25 +405,25 @@ jobs:
         run: |
           just login-registry oras ghcr.io
 
-      - name: Upload SBOM
+      - name: Attach SBOM
         if: inputs.publish
-        id: upload-sbom
+        id: attach-sbom
         env:
-          IMAGE: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}
+          MATRIX_BASE_NAME: "${{ matrix.base_name }}"
+          MATRIX_STREAM_NAME: "${{ matrix.stream_name }}"
+          MATRIX_IMAGE_FLAVOR: "${{ matrix.image_flavor }}"
           DIGEST: ${{ steps.pre-push.outputs.digest }}
-          IMAGE_NAME: ${{ env.IMAGE_NAME }}
         run: |
-          SBOM="sbom_out/${IMAGE_NAME}/sbom.json"
+          set -euox pipefail
 
-          cd "$(dirname "${SBOM}")"
-          oras attach \
-          --artifact-type application/vnd.spdx+json \
-          --annotation filename=$(basename "$SBOM") \
-          "${IMAGE}@${DIGEST}" \
-          "$(basename ${SBOM})"
-
-          sbom_digest=$(oras discover --format json "${IMAGE}@${DIGEST}" | jq -r '.referrers[] | select(.artifactType == "application/vnd.spdx+json") | .digest')
+          $(command -v just) attach-sbom \
+            --image "${MATRIX_BASE_NAME}" \
+            --tag "${MATRIX_STREAM_NAME}" \
+            --flavor "${MATRIX_IMAGE_FLAVOR}" \
+            --registry "${IMAGE_REGISTRY}" \
+            --digest "${DIGEST}"
 
+          sbom_digest=$(< /tmp/sbom-digestfile)
           echo "sbom_digest=${sbom_digest}" >> $GITHUB_OUTPUT
 
       - name: Sign SBOM OCI Artifact
@@ -431,7 +432,7 @@ jobs:
           COSIGN_EXPERIMENTAL: false
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
           IMAGE_NAME: ${{ env.IMAGE_NAME }}
-          SBOM_DIGEST: ${{ steps.upload-sbom.outputs.sbom_digest }}
+          SBOM_DIGEST: ${{ steps.attach-sbom.outputs.sbom_digest }}
         run: |
           cosign sign -y --use-signing-config=false --key env://COSIGN_PRIVATE_KEY ${IMAGE_REGISTRY}/${IMAGE_NAME}@${SBOM_DIGEST}
 
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index efd33282..0a9df197 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -37,7 +37,7 @@ jobs:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+        uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0
         with:
           results_file: results.sarif
           results_format: sarif
@@ -62,7 +62,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: SARIF file
           path: results.sarif
@@ -71,6 +71,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/trigger-schedule-stable-image.yml b/.github/workflows/trigger-schedule-stable-image.yml
index f5aebe5b..e88e7b34 100644
--- a/.github/workflows/trigger-schedule-stable-image.yml
+++ b/.github/workflows/trigger-schedule-stable-image.yml
@@ -10,6 +10,7 @@ permissions: {}
 jobs:
   trigger-stable-build:
     runs-on: ubuntu-slim
+    if: github.repository == 'ublue-os/aurora'
     permissions:
       contents: read
       actions: write
diff --git a/.github/workflows/validate-renovate.yml b/.github/workflows/validate-renovate.yml
index 945e0bd7..be0d4636 100644
--- a/.github/workflows/validate-renovate.yml
+++ b/.github/workflows/validate-renovate.yml
@@ -24,7 +24,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: latest
 
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 092bbfa5..324a4114 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -29,6 +29,6 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
         with:
           persona: auditor
diff --git a/Containerfile.in b/Containerfile.in
index f378cf2e..5441968a 100644
--- a/Containerfile.in
+++ b/Containerfile.in
@@ -94,7 +94,7 @@ RUN --network=none \
     /ctx/build_scripts/base/18-image-info.sh && \
     /ctx/build_scripts/base/19-initramfs.sh && \
     /ctx/build_scripts/shared/clean-stage.sh && \
-    /ctx/build_scripts/shared/chunkah-xattr.sh && \
+    /ctx/build_scripts/shared/unpackaged.sh && \
     /ctx/build_scripts/base/20-tests.sh
 
 CMD ["/sbin/init"]
diff --git a/Justfile b/Justfile
index f9ccfda8..25bf1415 100644
--- a/Justfile
+++ b/Justfile
@@ -24,7 +24,7 @@ tags := '(
 )'
 
 default_image := "aurora"
-default_tag := "latest"
+default_tag := "testing"
 default_flavor := "main"
 
 # Build Containers
@@ -345,70 +345,6 @@ rechunk $image=default_image $tag=default_tag $flavor=default_flavor:
     CHUNKED_IMAGE="$(podman pull "oci:${CHUNKAH_OUTPUT_DIR}/chunked")"
     podman tag "${CHUNKED_IMAGE}" "${image_name}:${tag}"
 
-# build-chunked-oci
-[arg("flavor", long="flavor", short="f")]
-[arg("ghcr", long="ghcr", value="true")]
-[arg("image", long="image", short="i")]
-[arg("previous_build", long="previous-build", value="true")]
-[arg("tag", long="tag", short="t")]
-[group('Image')]
-ostree-rechunk $image=default_image $tag=default_tag $flavor=default_flavor $ghcr="false" $previous_build="false":
-    #!/usr/bin/env bash
-    set -eoux pipefail
-
-    {{ just }} validate --image "${image}" --tag "${tag}" --flavor "${flavor}"
-    image_name=$({{ just }} image_name --image "${image}" --tag "${tag}" --flavor "${flavor}")
-    fedora_version=$({{ just }} fedora_version --image "${image}" --tag "${tag}" --flavor "${flavor}")
-
-    if [[ "{{ ghcr }}" == "false" ]]; then
-      {{ just }} load-rootful --image "${image}" --tag "${tag}" --flavor "${flavor}"
-    fi
-
-    # TODO: Redo everything here with --previous-build in rpm-ostree 2026.1+
-    # so we don't have to pull an old image + rename it
-    if [[ "${previous_build}" == "true" ]]; then
-      PREVIOUS_IMAGE=ghcr.io/{{ repo_organization }}/"${image_name}":"${tag}"
-
-      # https://github.com/coreos/rpm-ostree/blob/7e2f2065a4aa4d5965b4537bb7d74e0b2898650e/rust/src/compose.rs#L522-L529
-      if skopeo inspect docker://"${PREVIOUS_IMAGE}" | jq -e '.LayersData[1:] | all(.Annotations?["ostree.components"]?)'; then
-        ${SUDOIF} ${PODMAN} pull ${PREVIOUS_IMAGE}
-      else
-        echo "${PREVIOUS_IMAGE} doesn't exist. Making a fresh layer Plan instead."
-      fi
-    fi
-
-    if [[ "${ghcr}" == "true" ]]; then
-      CHUNKED_IMAGE="${image_name}:${tag}"
-        if [[ "${previous_build}" == "true" ]]; then
-          CHUNKED_IMAGE="${PREVIOUS_IMAGE}"
-        fi
-    else
-      # keep the original unrechunked image for local builds
-      CHUNKED_IMAGE="${image_name}:${tag}-chunked"
-    fi
-
-    # 96 layers, conservative default, same what ci-test is using
-    # one layer is secretly being added for the ostree export
-    # 499 is podman run limit
-    # 128 is docker pull limit
-    ${SUDOIF} ${PODMAN} run --rm \
-        --privileged \
-        -v "/var/lib/containers:/var/lib/containers" \
-        --entrypoint /usr/bin/rpm-ostree \
-        "${base_image_org}/${base_image_name}:${fedora_version}" \
-        compose build-chunked-oci \
-        --max-layers 127 \
-        --format-version=2 \
-        --bootc \
-        --from "localhost/${image_name}:${tag}" \
-        --output containers-storage:${CHUNKED_IMAGE}
-
-        # rename the image to localhost
-        if [[ "${ghcr}" == "true" && "${previous_build}" == "true" ]]; then
-          ${SUDOIF} ${PODMAN} tag ${CHUNKED_IMAGE} "${image_name}:${tag}"
-          ${SUDOIF} ${PODMAN} image rm -f ${CHUNKED_IMAGE}
-        fi
-
 # For Privileged operations
 [arg("flavor", long="flavor", short="f")]
 [arg("image", long="image", short="i")]
@@ -463,7 +399,7 @@ run $image=default_image $tag=default_tag $flavor=default_flavor:
     fi
 
     # Run Container
-    ${PODMAN} run -it --rm "${image_name}:${tag}" bash
+    ${PODMAN} run -it --rm "${image_name}:${tag}" bash -l
 
 # Test Changelogs
 [group('Changelogs')]
@@ -739,6 +675,43 @@ gen-sbom $image=default_image $tag=default_tag $flavor=default_flavor $syft_cmd=
 
     rm -rf "${ROOTFS}"
 
+# Attach sbom to exisitng image
+[arg("digest", long="digest")]
+[arg("flavor", long="flavor", short="f")]
+[arg("image", long="image", short="i")]
+[arg("registry", long="registry")]
+[arg("tag", long="tag", short="t")]
+[group('Utility')]
+attach-sbom $image=default_image $tag=default_tag $flavor=default_flavor $registry="" $digest="":
+    #!/usr/bin/env bash
+    set -eoux pipefail
+
+    {{ just }} validate --image "${image}" --tag "${tag}" --flavor "${flavor}"
+    image_name=$({{ just }} image_name --image "${image}" --tag "${tag}" --flavor "${flavor}")
+
+    OUT_DIR="sbom_out/${image_name}"
+    SBOM="sbom.json"
+    FULL_SBOM_PATH="${OUT_DIR}/${SBOM}"
+    IMAGE="${registry}/${image_name}:${tag}@${digest}"
+
+    # we need to be in the directory of the sbom json file or else we end up having the directories in the oci artifact
+    pushd "${OUT_DIR}"
+
+    oras attach \
+      --artifact-type application/vnd.spdx+json \
+      --annotation filename="${SBOM}" \
+      "${IMAGE}" \
+      "${SBOM}"
+
+    popd
+
+    SBOM_DIGEST="$(oras discover --format json "${IMAGE}" | jq -r '.referrers[] | select(.artifactType == "application/vnd.spdx+json") | .digest')"
+
+    echo "${SBOM_DIGEST}" > /tmp/sbom-digestfile
+
+    # debugging
+    echo "oras pull ${registry}/${image_name}:${tag}@${SBOM_DIGEST}"
+
 # We are not using https://github.com/actions/cache because of:
 # https://github.com/ublue-os/aurora/issues/2351
 # https://github.com/actions/cache/issues/1537
@@ -756,7 +729,7 @@ gen-sbom $image=default_image $tag=default_tag $flavor=default_flavor $syft_cmd=
 [private]
 setup-cache $image=default_image $tag=default_tag $flavor=default_flavor $ghcr="false" $pull="false" $push="false" $registry="" $github_event="":
     #!/usr/bin/env bash
-    set -eou pipefail
+    set -eoux pipefail
 
     image_name=$({{ just }} image_name --image "${image}" --tag "${tag}" --flavor "${flavor}")
 
@@ -777,7 +750,7 @@ setup-cache $image=default_image $tag=default_tag $flavor=default_flavor $ghcr="
     BLESSED_DAY="Sunday"
 
     # Always attempt to pull cache, but don't on the first run that will publish the build on Sundays
-    if [[ "${CURRENT_DAY}" == "${BLESSED_DAY}" && "$POINT" == "1" && "${ghcr}" == "true" && ( "${github_event}" == "workflow_dispatch" || "${github_event}" == "merge_queue" ) ]]; then
+    if [[ "${CURRENT_DAY}" == "${BLESSED_DAY}" && "$POINT" == "1" && "${ghcr}" == "true" && ( "${github_event}" == "workflow_dispatch" || "${github_event}" == "merge_group" ) ]]; then
       echo "Not pulling build cache. Uploading fresh cache later."
     elif [[ "${pull}" == "true" ]]; then
       # We want to avoid using --allow-path-traversal
@@ -792,7 +765,7 @@ setup-cache $image=default_image $tag=default_tag $flavor=default_flavor $ghcr="
        [[ "${ghcr}" == "true" ]] && \
        [[ "${CURRENT_DAY}" == "${BLESSED_DAY}" ]] && \
        [[ "${POINT}" == "1" ]] && \
-       [[ ( "${github_event}" == "workflow_dispatch" || "${github_event}" == "merge_queue" ) ]]; then
+       [[ ( "${github_event}" == "workflow_dispatch" || "${github_event}" == "merge_group" ) ]]; then
 
       {{ just }} login-registry oras ghcr.io
       pushd "${BUILDAH_CACHE_DIR}"
diff --git a/build_files/dx/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:karmab:kcli.repo b/build_files/dx/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:karmab:kcli.repo
index 55810d39..d23e3d84 100644
--- a/build_files/dx/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:karmab:kcli.repo
+++ b/build_files/dx/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:karmab:kcli.repo
@@ -8,3 +8,4 @@ gpgkey=https://download.copr.fedorainfracloud.org/results/karmab/kcli/pubkey.gpg
 repo_gpgcheck=0
 enabled=0
 enabled_metadata=1
+includepkgs=kcli
diff --git a/build_files/dx/usr/share/dnf5/repos.d/docker-ce.repo b/build_files/dx/usr/share/dnf5/repos.d/docker-ce.repo
index 27bea4ee..e370362a 100644
--- a/build_files/dx/usr/share/dnf5/repos.d/docker-ce.repo
+++ b/build_files/dx/usr/share/dnf5/repos.d/docker-ce.repo
@@ -1,9 +1,15 @@
+# update includepkgs, remove docker-model-plugin
+# podman run --rm -ti quay.io/fedora/fedora:45
+# dnf config-manager addrepo --from-repofile https://download.docker.com/linux/fedora/docker-ce.repo
+# dnf list --available --repo=docker-ce-stable | grep "docker-ce-stable" | grep -vE "(debug|devel|\.src)" | cut -f1 -d\ | sed 's/\.x86_64//' | sed 's/\.noarch//' | paste -sd " " -
+
 [docker-ce-stable]
 name=Docker CE Stable - $basearch
 baseurl=https://download.docker.com/linux/fedora/$releasever/$basearch/stable
 enabled=0
 gpgcheck=1
 gpgkey=https://download.docker.com/linux/fedora/gpg
+includepkgs=containerd.io docker-buildx-plugin docker-ce docker-ce-cli docker-ce-rootless-extras docker-compose-plugin
 
 [docker-ce-stable-source]
 name=Docker CE Stable - Sources
diff --git a/build_files/dx/usr/share/dnf5/repos.d/vscode.repo b/build_files/dx/usr/share/dnf5/repos.d/vscode.repo
index 3159383c..86e03f82 100644
--- a/build_files/dx/usr/share/dnf5/repos.d/vscode.repo
+++ b/build_files/dx/usr/share/dnf5/repos.d/vscode.repo
@@ -4,3 +4,4 @@ baseurl=https://packages.microsoft.com/yumrepos/vscode
 enabled=0
 gpgcheck=1
 gpgkey=https://packages.microsoft.com/keys/microsoft.asc
+includepkgs=code
diff --git a/build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:ledif:kairpods.repo b/build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:ledif:kairpods.repo
index 3ddb325a..bc84b829 100644
--- a/build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:ledif:kairpods.repo
+++ b/build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:ledif:kairpods.repo
@@ -8,3 +8,4 @@ gpgkey=https://download.copr.fedorainfracloud.org/results/ledif/kairpods/pubkey.
 repo_gpgcheck=0
 enabled=0
 enabled_metadata=1
+includepkgs=kairpods
diff --git a/build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:lizardbyte:stable.repo b/build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:lizardbyte:stable.repo
index 22ae23ab..1eedbd1d 100644
--- a/build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:lizardbyte:stable.repo
+++ b/build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:lizardbyte:stable.repo
@@ -9,3 +9,4 @@ repo_gpgcheck=0
 enabled=0
 enabled_metadata=1
 priority=1
+includepkgs=Sunshine
diff --git a/build_files/shared/usr/share/dnf5/repos.d/tailscale.repo b/build_files/shared/usr/share/dnf5/repos.d/tailscale.repo
index 791f20a1..1b2ef49a 100644
--- a/build_files/shared/usr/share/dnf5/repos.d/tailscale.repo
+++ b/build_files/shared/usr/share/dnf5/repos.d/tailscale.repo
@@ -6,3 +6,4 @@ type=rpm
 repo_gpgcheck=1
 gpgcheck=1
 gpgkey=https://pkgs.tailscale.com/stable/fedora/repo.gpg
+includepkgs=tailscale
diff --git a/build_files/shared/usr/share/dnf5/repos.d/terra.repo b/build_files/shared/usr/share/dnf5/repos.d/terra.repo
new file mode 100644
index 00000000..c2b290ec
--- /dev/null
+++ b/build_files/shared/usr/share/dnf5/repos.d/terra.repo
@@ -0,0 +1,25 @@
+[terra]
+name=Terra $releasever
+# disable mirrors because they are very flakey
+baseurl=https://repos.fyralabs.com/terra$releasever
+# metalink=https://tetsudou.fyralabs.com/metalink?repo=terra$releasever&arch=$basearch
+metadata_expire=6h
+type=rpm
+gpgcheck=1
+gpgkey=https://repos.fyralabs.com/terra$releasever/key.asc
+repo_gpgcheck=1
+enabled=0
+enabled_metadata=1
+countme=1
+
+[terra-source]
+name=Terra $releasever - Source
+baseurl=https://repos.fyralabs.com/terra$releasever-source
+# metalink=https://tetsudou.fyralabs.com/metalink?repo=terra$releasever-source&arch=$basearch
+metadata_expire=6h
+type=rpm
+gpgcheck=1
+gpgkey=https://repos.fyralabs.com/terra$releasever/key.asc
+repo_gpgcheck=1
+enabled=0
+enabled_metadata=0
diff --git a/build_scripts/base/01-packages.sh b/build_scripts/base/01-packages.sh
index 804dc538..c1500ce7 100755
--- a/build_scripts/base/01-packages.sh
+++ b/build_scripts/base/01-packages.sh
@@ -21,6 +21,7 @@ OVERRIDES=(
     "mesa-libEGL"
     "mesa-libGL"
     "mesa-libgbm"
+    "mesa-libOpenCL"
     "mesa-vulkan-drivers"
     "openh264"
 )
@@ -60,10 +61,12 @@ FEDORA_PACKAGES=(
     ifuse
     igt-gpu-tools
     input-remapper
+    intel-compute-runtime
     iwd
     just
-    kate
+    kate{-krunner-plugin,-plugins}
     kcm-fcitx5
+    fzf # for just
     krb5-workstation
     ksystemlog
     libcamera-gstreamer
@@ -82,7 +85,10 @@ FEDORA_PACKAGES=(
     plasma-firewall-"${PLASMA_VERS}"
     plasma-oxygen
     plasma-union-"${PLASMA_VERS}"
-    plasma-wallpapers-dynamic
+    # TODO: look into removing this, plasma supports the transition feature of this natively
+    plasma-wallpapers-dynamic-builder
+    plasma-wallpapers-dynamic-builder{-bash,-fish,-zsh}-completion
+    pocl
     powertop
     rclone
     restic
@@ -98,6 +104,7 @@ FEDORA_PACKAGES=(
     tmux
     traceroute
     vim
+    xdg-native-messaging-proxy
     yubikey-manager
     zsh
 )
@@ -125,10 +132,9 @@ if [[ $(arch) == x86_64 ]]; then
   PACKAGES+=( "${FEDORA_PACKAGES_AMD64[@]}" "${NEGATIVO_PACKAGES_AMD64[@]}" )
 fi
 
-dnf -y install --enablerepo='fedora-multimedia' "${PACKAGES[@]}"
-
-# Fedora Tailscale is usually behind
-dnf -y install --from-repo='tailscale-stable' tailscale
+dnf -y install \
+  --setopt=install_weak_deps=False \
+  --enablerepo='fedora-multimedia' "${PACKAGES[@]}"
 
 COPR_UBLUE_OS_PACKAGES=(
     kcm_ublue
@@ -136,14 +142,31 @@ COPR_UBLUE_OS_PACKAGES=(
     oversteer-udev
     # https://github.com/ublue-os/akmods/issues/537
     ublue-os-selinux-workarounds
-    uupd
-  )
+)
+TERRA_PACKAGES=(
+  # our auto-updater
+  uupd
+  # used in motd, in general useful to have
+  nerdfontssymbolsonly-nerd-fonts
+  game-devices-udev
+)
 
-dnf -y install --from-repo='copr:copr.fedorainfracloud.org:ublue-os:packages' "${COPR_UBLUE_OS_PACKAGES[@]}"
+# Fedora Tailscale is usually behind
+TAILSCALE=(tailscale)
 
-dnf -y install --from-repo='copr:copr.fedorainfracloud.org:ledif:kairpods' kairpods
+dnf -y install --from-repo="terra" "${TERRA_PACKAGES[@]}"
 
-dnf -y install --from-repo='copr:copr.fedorainfracloud.org:lizardbyte:stable' sunshine
+COPR_PREFIX="copr:copr.fedorainfracloud.org"
+
+dnf -y install --from-repo="${COPR_PREFIX}:ublue-os:packages" "${COPR_UBLUE_OS_PACKAGES[@]}"
+
+# TODO: figure something out that works well across DX, nvidia with the ublue-os coprs
+# so we can have less transactions, while still not being vulnerable to copr injections
+# shellcheck disable=SC1010
+dnf do -y \
+  --action install --from-repo="${COPR_PREFIX}:ledif:kairpods" kairpods \
+  --action install --from-repo="${COPR_PREFIX}:lizardbyte:stable" Sunshine \
+  --action install --from-repo='tailscale-stable' "${TAILSCALE[@]}"
 
 # Packages to exclude - common to all versions
 EXCLUDED_PACKAGES=(
@@ -158,6 +181,8 @@ EXCLUDED_PACKAGES=(
     krfb{,-libs}
     plasma-discover{,-libs}
     plasma-welcome-fedora
+    # https://github.com/ublue-os/aurora/issues/3066
+    xwaylandvideobridge
 )
 
 dnf -y remove "${EXCLUDED_PACKAGES[@]}"
diff --git a/build_scripts/base/03-fetch.sh b/build_scripts/base/03-fetch.sh
index 0a6877b9..abcb1c5e 100755
--- a/build_scripts/base/03-fetch.sh
+++ b/build_scripts/base/03-fetch.sh
@@ -5,7 +5,7 @@ echo "::group:: ===$(basename "$0")==="
 set -eoux pipefail
 
 # Enable Flathub
-curl --retry 3 -Lo /etc/flatpak/remotes.d/flathub.flatpakrepo https://dl.flathub.org/repo/flathub.flatpakrepo
+curl --retry 3 -Lo /usr/share/flatpak/remotes.d/flathub.flatpakrepo https://dl.flathub.org/repo/flathub.flatpakrepo
 
 # Offline Aurora documentation
 ghcurl "https://github.com/ublue-os/aurora-docs/releases/download/0.1/aurora.pdf" --retry 3 -o /tmp/aurora.pdf
@@ -20,13 +20,6 @@ curl -X 'GET' \
 'https://flathub.org/api/v2/stats/io.github.kolunmi.Bazaar?all=false&days=1' \
 -H 'accept: application/json' | jq -r ".installs_last_7_days" | numfmt --to=si --round=nearest > /usr/share/ublue-os/bazaar-install-count
 
-# Nerdfont symbols
-# to fix motd and prompt atleast temporarily
-ghcurl "https://github.com/ryanoasis/nerd-fonts/releases/latest/download/NerdFontsSymbolsOnly.zip" --retry 3 -o /tmp/nerdfontsymbols.zip
-unzip /tmp/nerdfontsymbols.zip -d /tmp
-mkdir -p /usr/share/fonts/nerd-fonts/NerdFontsSymbolsOnly/
-mv /tmp/SymbolsNerdFont*.ttf /usr/share/fonts/nerd-fonts/NerdFontsSymbolsOnly/
-
 # Bash Preexec v0.6.0
 ghcurl https://raw.githubusercontent.com/rcaloras/bash-preexec/b73ed5f7f953207b958f15b1773721dded697ac3/bash-preexec.sh --retry 3 -Lo /usr/share/bash-preexec
 
diff --git a/build_scripts/base/19-initramfs.sh b/build_scripts/base/19-initramfs.sh
index 10396aa5..3ada1d0c 100755
--- a/build_scripts/base/19-initramfs.sh
+++ b/build_scripts/base/19-initramfs.sh
@@ -5,9 +5,38 @@ echo "::group:: ===$(basename "$0")==="
 set -ouex pipefail
 
 KERNEL_VERSION=$(rpm -q --queryformat="%{evr}.%{arch}" kernel-core)
+INITRAMFS="/usr/lib/modules/${KERNEL_VERSION}/initramfs.img"
 
-export DRACUT_NO_XATTR=1
-/usr/bin/dracut --kver "${KERNEL_VERSION}" --reproducible -v -f "/usr/lib/modules/${KERNEL_VERSION}/initramfs.img"
-chmod 0600 "/usr/lib/modules/${KERNEL_VERSION}/initramfs.img"
+V4L2_PATH="$(rpm -ql kmod-v4l2loopback)"
+
+DRACUT_REMOVE=(
+  # makes no difference if in initramfs or not
+  # this is a hack FIXME in ublue-os/akmods
+  ${V4L2_PATH} # ko.kz file has build id's changing -> non-reproducible
+)
+
+# https://github.com/ublue-os/aurora/issues/2568
+# these strings change with every build
+TMP_OS_RELEASE=$(mktemp --tmpdir 'os-release-XXXXXXXXXX')
+OS_RELEASE="/usr/lib/os-release"
+cp "${OS_RELEASE}" "${TMP_OS_RELEASE}"
+sed -Ei -e '/^((OSTREE_)?(IMAGE_)?VERSION|PRETTY_NAME|BUILD_ID)=/d' "${OS_RELEASE}"
+
+DRACUT_NO_XATTR=1 /usr/bin/dracut \
+  --kver "${KERNEL_VERSION}" \
+  --reproducible \
+  --verbose \
+  --force \
+  --remove "${DRACUT_REMOVE[@]}" \
+  "${INITRAMFS}"
+
+# mv causes permissions to change
+cp "${TMP_OS_RELEASE}" "${OS_RELEASE}"
+rm "${TMP_OS_RELEASE}"
+
+chmod 0600 "${INITRAMFS}"
+
+# for debugging
+sha256sum "${INITRAMFS}"
 
 echo "::endgroup::"
diff --git a/build_scripts/base/20-tests.sh b/build_scripts/base/20-tests.sh
index 526f5fa2..4cfaafaa 100755
--- a/build_scripts/base/20-tests.sh
+++ b/build_scripts/base/20-tests.sh
@@ -43,7 +43,7 @@ test -f /usr/share/flatpak/preinstall.d/bazaar.preinstall
 test -f /usr/lib/systemd/system/flatpak-add-fedora-repos.service && false
 
 # Is flathub enabled by default?
-test -f /etc/flatpak/remotes.d/flathub.flatpakrepo
+test -f /usr/share/flatpak/remotes.d/flathub.flatpakrepo
 
 # Make sure to not pull in the bazzite one
 rpm -q plasma-setup --qf "%{RELEASE}" | grep -q aurora
@@ -129,6 +129,7 @@ UNWANTED_PACKAGES=(
     fedora-third-party
     firefox
     plasma-discover
+    xwaylandvideobridge
 )
 
 for package in "${UNWANTED_PACKAGES[@]}"; do
diff --git a/build_scripts/dx/00-dx.sh b/build_scripts/dx/00-dx.sh
index 089d0f2d..634e9549 100755
--- a/build_scripts/dx/00-dx.sh
+++ b/build_scripts/dx/00-dx.sh
@@ -61,39 +61,26 @@ if [[ ! "${IMAGE_NAME}" =~ nvidia ]]; then
   FEDORA_PACKAGES+=("rocm-hip" "rocm-opencl" "rocm-smi")
 fi
 
-echo "Installing ${#FEDORA_PACKAGES[@]} DX packages from Fedora repos..."
 dnf5 -y install "${FEDORA_PACKAGES[@]}"
 
-# docker is not available for f45 yet
-# https://github.com/docker/docker-ce-packaging/issues/1353
-# TODO: get it from docker again once it's available
-if [[ $(rpm -E %fedora) == "44" ]]; then
-  # Docker packages from their repo
-  dnf -y install --from-repo=docker-ce-stable \
-      containerd.io \
-      docker-buildx-plugin \
-      docker-ce \
-      docker-ce-cli \
-      docker-compose-plugin
-else
-  # we get this from common, the fedora package provides the exact same one
-  rm -f /usr/lib/sysusers.d/docker.conf
+# We could use Fedora's moby packages, these are "official"
+DOCKER_CE=(
+  containerd.io
+  docker-buildx-plugin
+  docker-ce
+  docker-ce-cli
+  docker-compose-plugin
+)
 
-  dnf -y install \
-    containerd \
-    docker-buildx \
-    moby-engine \
-    docker-cli \
-    docker-compose
-fi
+COPR_PREFIX="copr:copr.fedorainfracloud.org"
 
-# VSCode package from Microsoft repo
-dnf -y install --from-repo=code \
-    code
+# shellcheck disable=SC1010
+dnf do -y \
+  --action install --from-repo=code code \
+  --action install --from-repo=docker-ce-stable "${DOCKER_CE[@]}" \
+  --action install --from-repo="${COPR_PREFIX}:karmab:kcli" kcli
 
-dnf -y install --from-repo='copr:copr.fedorainfracloud.org:karmab:kcli' kcli
-
-dnf -y install --from-repo='copr:copr.fedorainfracloud.org:ublue-os:packages' ublue-os-libvirt-workarounds
+dnf -y install --from-repo="${COPR_PREFIX}:ublue-os:packages" ublue-os-libvirt-workarounds
 
 rsync -rvK /ctx/system_files/dx/ /
 
diff --git a/build_scripts/dx/10-tests-dx.sh b/build_scripts/dx/10-tests-dx.sh
index 0436fe58..8d4a9e0c 100755
--- a/build_scripts/dx/10-tests-dx.sh
+++ b/build_scripts/dx/10-tests-dx.sh
@@ -6,11 +6,10 @@ set -eoux pipefail
 
 IMPORTANT_PACKAGES_DX=(
     code
-    # containerd.io
-    containerd
-    # docker-ce
-    # docker-buildx-plugin
-    # docker-compose-plugin
+    containerd.io
+    docker-ce
+    docker-buildx-plugin
+    docker-compose-plugin
     flatpak-builder
     libvirt
     qemu
diff --git a/build_scripts/shared/build-prep.sh b/build_scripts/shared/build-prep.sh
index a20ef344..0e00be92 100755
--- a/build_scripts/shared/build-prep.sh
+++ b/build_scripts/shared/build-prep.sh
@@ -1,10 +1,9 @@
-# This script should generally set up the build so we can move on to start installing packages
-
 #!/usr/bin/bash
+# This script should generally set up the build so we can move on to start installing packages
 
 set -eoux pipefail
 
-# Speeds up local builds and workaround network flakes, mainly for COPR and negativo
+# Speeds up local builds and workaround network flakes, mainly for COPR, negativo and terra
 cp /etc/dnf/dnf.conf /etc/dnf/dnf.conf.bak
 dnf config-manager setopt keepcache=1 timeout=60
 
@@ -24,7 +23,7 @@ dnf config-manager setopt fedora-multimedia.priority=90
 
 # https://fedoraproject.org/wiki/OpenH264
 # this would be fine to use as well, negativo just has it, one less repo
-dnf config-manager setopt fedora-cisco-openh264.enabled=0
+dnf config-manager disable fedora-cisco-openh264
 
 mkdir -p /tmp/scripts/helpers
 install -Dm0755 /ctx/build_scripts/shared/utils/ghcurl /tmp/scripts/helpers/ghcurl
diff --git a/build_scripts/shared/chunkah-xattr.sh b/build_scripts/shared/chunkah-xattr.sh
deleted file mode 100755
index 2fd36e11..00000000
--- a/build_scripts/shared/chunkah-xattr.sh
+++ /dev/null
@@ -1,26 +0,0 @@
-# See: https://github.com/coreos/chunkah#customizing-the-layers
-#!/usr/bin/env bash
-
-set -eoux pipefail
-
-setfattr -n user.component -v "aurora-wallpapers" /usr/share/backgrounds/aurora
-setfattr -n user.update-interval -v "monthly" /usr/share/backgrounds/aurora
-
-setfattr -n user.component -v "aurora-assets" /usr/share/plasma/avatars/{echo,lumina,scope,tina,vincent}.png
-setfattr -n user.component -v "aurora-assets" /etc/bazaar/*.jxl
-setfattr -n user.update-interval -v "quarterly" /etc/bazaar/*.jxl
-
-setfattr -n user.component -v "aurora-plasma-theme" /usr/share/plasma/look-and-feel/dev.getaurora.aurora{,light}.desktop
-setfattr -n user.update-interval -v "quarterly" /usr/share/plasma/look-and-feel/dev.getaurora.aurora{,light}.desktop
-
-setfattr -n user.component -v "aurora-config" /usr/share/ublue-os
-setfattr -n user.component -v "homebrew" /usr/share/homebrew.tar.zst
-
-setfattr -n user.component -v "aurora-offline-docs" /usr/share/doc/aurora/aurora.pdf
-
-setfattr -n user.component -v "nerdfonts" /usr/share/fonts/nerd-fonts/NerdFontsSymbolsOnly
-setfattr -n user.update-interval -v "yearly" /usr/share/fonts/nerd-fonts/NerdFontsSymbolsOnly
-
-setfattr -n user.component -v "aurora-config" /usr/lib/systemd/system-generators/coreos-sulogin-force-generator
-
-setfattr -n user.component -v "aurora-config" /usr/share/bash-preexec
diff --git a/build_scripts/shared/unpackaged.sh b/build_scripts/shared/unpackaged.sh
new file mode 100755
index 00000000..85666d58
--- /dev/null
+++ b/build_scripts/shared/unpackaged.sh
@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# See: https://github.com/coreos/chunkah#customizing-the-layers
+echo "::group:: ===$(basename "$0")==="
+
+set -eoux pipefail
+
+HOMEBREW_TARBALL=/usr/share/homebrew.tar.zst
+setfattr -n user.component -v "homebrew" "${HOMEBREW_TARBALL}"
+
+# rpm-ostree creates tmpfiles from packages having owned files in /{var,run}
+RPM_OSTREE_TMPFILES=/usr/lib/rpm-ostree/tmpfiles.d
+setfattr -n user.component -v "rpm-ostree-tmpfiles.d" "${RPM_OSTREE_TMPFILES}"
+# vibes, shouldn't change super often
+setfattr -n user.update-interval -v "quarterly" "${RPM_OSTREE_TMPFILES}"
+
+FONTCONFIG_CACHE=/usr/lib/fontconfig/cache
+setfattr -n user.component -v "fontconfig-cache" "${FONTCONFIG_CACHE}"
+# also vibes, no idea how often this changes, but it seems to change often
+setfattr -n user.update-interval -v "daily" "${FONTCONFIG_CACHE}"
+
+WALLPAPERS=/usr/share/backgrounds/aurora
+setfattr -n user.component -v "aurora-wallpapers" "${WALLPAPERS}"
+setfattr -n user.update-interval -v "monthly" "${WALLPAPERS}"
+
+AURORA_CHARS=(/usr/share/plasma/avatars/{echo,lumina,scope,tina,vincent}.png)
+setfattr -n user.component -v "aurora-assets" "${AURORA_CHARS[@]}"
+
+BAZAAR=(/etc/bazaar/*.jxl)
+setfattr -n user.component -v "aurora-assets" "${BAZAAR[@]}"
+setfattr -n user.update-interval -v "quarterly" "${BAZAAR[@]}"
+
+AURORA_DOCS_PDF="/usr/share/doc/aurora/aurora.pdf"
+setfattr -n user.component -v "aurora-offline-docs" "${AURORA_DOCS_PDF}"
+
+# TODO: everything else we can probably add here
+FRAMEWORK_ICC=(/usr/share/color/icc/colord/framework1{3,6}.icc)
+setfattr -n user.component -v "never-change" "${FRAMEWORK_ICC[@]}"
+setfattr -n user.update-interval -v "yearly" "${FRAMEWORK_ICC[@]}"
+
+# This is absolutely nasty, ideally we'd use SOURCE_DATE_EPOCH=0 on chunkah
+# instead of all the touch invocations but this (potentially) affects the layer
+# plan negatively See: https://github.com/coreos/chunkah/issues/160
+#
+# on the composefs backend this also makes it so that bootc inconsistently gets
+# the image creation date across backends (uupd will send a notification) this
+# doesn't happen on ostree, but is an issue on composefs
+# https://github.com/bootc-dev/bootc/issues/2227
+
+# EPOCH=1 or else we may lose some of our changes due to native overay diff being set to false
+# https://github.com/ublue-os/aurora/issues/3093
+find /usr /etc /opt -newermt '1970-01-01T00:00:00Z' -exec touch -h -a -m -d '1970-01-01T00:00:01Z' {} +
+
+# getfattr -R -d /usr 2> /dev/null || true
+# getfattr -R -d /etc 2> /dev/null || true
+
+echo "::endgroup::"
diff --git a/image-versions.yml b/image-versions.yml
index f7dc8118..2d5a797c 100644
--- a/image-versions.yml
+++ b/image-versions.yml
@@ -3,22 +3,22 @@ images:
   - name: kinoite
     image: quay.io/fedora-ostree-desktops/kinoite
     tag: 45
-    digest: sha256:3f180f9445a00fc278397755b49bc038d51dbf9a64feecff9dc8a0e9fb0d9533
+    digest: sha256:2a1fea9adbd27dd87935508115d88ab5c7b335114e32994e7c2c615545ea5cac
 
   # https://github.com/get-aurora-dev/common
   - name: common
     image: ghcr.io/get-aurora-dev/common
     tag: latest
-    digest: sha256:06278789114c4138d7dda9cf259f938e2a15d6ce834ff121ac8e0dbe8cf19cbe
+    digest: sha256:2888e957bd72e1656c8de374bbfa3a933c19aad82dccd0994bd1766e03973ff1
 
   # https://github.com/ublue-os/brew
   - name: brew
     image: ghcr.io/ublue-os/brew
     tag: latest
-    digest: sha256:cf6388d6edb3a6fad699f06c0ceb3807f8f1368f942b08f8cc6d45ac4fd1cd92
+    digest: sha256:0c9703f1a49faa89a44d9458a68c0ca03270e8bdd32018285dad8b14ddd7cdc3
 
   # https://github.com/coreos/chunkah
   - name: chunkah
     image: quay.io/coreos/chunkah
     tag: latest
-    digest: sha256:ff8b8b466a942ec6000445d4001fc661e2fc5a952ad9ee29b4de9ab09d1d1708
+    digest: sha256:71e593421c5de7dcc7c8c5c50e98d3bac572055a76f399f61a491d123c20a523
diff --git a/system_files/shared/usr/bin/aurora-iwd-deprecation-notifier b/system_files/shared/usr/bin/aurora-iwd-deprecation-notifier
new file mode 100755
index 00000000..3e847acf
--- /dev/null
+++ b/system_files/shared/usr/bin/aurora-iwd-deprecation-notifier
@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+TITLE="IWD Wi-Fi backend is deprecated"
+MESSAGE="Intel has discontinued IWD development. Please move back to wpa_supplicant.
+
+Note: Reverting will require reconnecting to your Wi-Fi networks (saved passwords must be re-entered).
+
+To switch now, run: 'ujust toggle-iwd'"
+
+URL="https://docs.getaurora.dev/blog/deprecating-iwd"
+
+USERS="$(loginctl list-users --no-legend | awk '$1 != 0 {print $2}')"
+
+for username in ${USERS}; do
+  machinectl shell "${username}@.host" /usr/bin/bash -c '
+    ACTION=$(notify-send \
+      --app-name=Aurora \
+      --icon=network-wireless \
+      --urgency=critical \
+      "$1" \
+      "$2" \
+      --action="open=More Info")
+
+    if [ "$ACTION" = "open" ]; then
+      systemd-run --user /usr/bin/xdg-open "$3"
+    fi
+  ' _ "$TITLE" "$MESSAGE" "$URL"
+done
diff --git a/system_files/shared/usr/lib/bootc/install/20-aurora.toml b/system_files/shared/usr/lib/bootc/install/20-aurora.toml
index 55cc5088..0906b168 100644
--- a/system_files/shared/usr/lib/bootc/install/20-aurora.toml
+++ b/system_files/shared/usr/lib/bootc/install/20-aurora.toml
@@ -1,2 +1,5 @@
 [install]
 root-fs-type = "btrfs"
+
+# do not remove this, this is used during the installation for signed images
+enforce-container-sigpolicy = true
diff --git a/system_files/shared/usr/lib/systemd/system-preset/89-aurora.preset b/system_files/shared/usr/lib/systemd/system-preset/89-aurora.preset
index e84b6fb1..9abc2cc7 100644
--- a/system_files/shared/usr/lib/systemd/system-preset/89-aurora.preset
+++ b/system_files/shared/usr/lib/systemd/system-preset/89-aurora.preset
@@ -1,8 +1,11 @@
 enable aurora-groups.service
+enable bootc-update-ca-trust.service
+enable bootc-update-crypto-policies.service
 enable brew-setup.service
 enable dconf-update.service
 enable flatpak-preinstall.service
 enable input-remapper.service
+enable aurora-iwd-deprecation-notifier.timer
 # DO NOT REMOVE THIS
 # see /usr/bin/rechunker-group-fix
 enable rechunker-group-fix.service
diff --git a/system_files/shared/usr/lib/systemd/system/aurora-iwd-deprecation-notifier.service b/system_files/shared/usr/lib/systemd/system/aurora-iwd-deprecation-notifier.service
new file mode 100644
index 00000000..6824db80
--- /dev/null
+++ b/system_files/shared/usr/lib/systemd/system/aurora-iwd-deprecation-notifier.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=Aurora IWD Deprecation Notifier
+Documentation=https://docs.getaurora.dev/blog/deprecating-iwd
+After=network.target
+
+[Service]
+Type=oneshot
+ExecCondition=/usr/bin/bash -c "/usr/bin/NetworkManager --print-config | /usr/bin/grep -q '^wifi.backend=iwd'"
+ExecStart=/usr/bin/aurora-iwd-deprecation-notifier
+
+[Install]
+WantedBy=graphical.target
diff --git a/system_files/shared/usr/lib/systemd/system/aurora-iwd-deprecation-notifier.timer b/system_files/shared/usr/lib/systemd/system/aurora-iwd-deprecation-notifier.timer
new file mode 100644
index 00000000..77012215
--- /dev/null
+++ b/system_files/shared/usr/lib/systemd/system/aurora-iwd-deprecation-notifier.timer
@@ -0,0 +1,12 @@
+[Unit]
+Description=Run aurora-iwd-deprecation-notifier 20 mins after boot
+Documentation=https://docs.getaurora.dev/blog/deprecating-iwd
+
+[Timer]
+OnBootSec=20min
+Unit=aurora-iwd-deprecation-notifier.service
+OnUnitActiveSec=1w
+Persistent=true
+
+[Install]
+WantedBy=timers.target
diff --git a/system_files/shared/usr/lib/systemd/system/bootc-update-ca-trust.service b/system_files/shared/usr/lib/systemd/system/bootc-update-ca-trust.service
new file mode 100644
index 00000000..4b4eb641
--- /dev/null
+++ b/system_files/shared/usr/lib/systemd/system/bootc-update-ca-trust.service
@@ -0,0 +1,18 @@
+# Regenerate files preserved by the /etc three-way merge after image upgrades.
+[Unit]
+Description=Regenerate CA certificate trust store
+Documentation=https://gitlab.com/fedora/bootc/base-images/-/merge_requests/663
+ConditionPathIsMountPoint=/sysroot
+ConditionPathExists=/usr/bin/update-ca-trust
+DefaultDependencies=no
+Requires=local-fs.target
+After=local-fs.target
+Before=sysinit.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/bin/update-ca-trust extract
+
+[Install]
+WantedBy=sysinit.target
diff --git a/system_files/shared/usr/lib/systemd/system/bootc-update-crypto-policies.service b/system_files/shared/usr/lib/systemd/system/bootc-update-crypto-policies.service
new file mode 100644
index 00000000..f77a4a3b
--- /dev/null
+++ b/system_files/shared/usr/lib/systemd/system/bootc-update-crypto-policies.service
@@ -0,0 +1,18 @@
+# Regenerate backend files preserved by the /etc three-way merge after image upgrades.
+[Unit]
+Description=Regenerate crypto-policies backend configuration
+Documentation=https://gitlab.com/fedora/bootc/base-images/-/merge_requests/663
+ConditionPathIsMountPoint=/sysroot
+ConditionPathExists=/usr/bin/update-crypto-policies
+DefaultDependencies=no
+Requires=local-fs.target
+After=local-fs.target
+Before=sysinit.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/bin/bash -ec 'policy=$(/usr/bin/update-crypto-policies --show); exec /usr/bin/update-crypto-policies --set "$$policy"'
+
+[Install]
+WantedBy=sysinit.target