diff --git a/Containerfile.in b/Containerfile.in
index 3e09af39..f378cf2e 100644
--- a/Containerfile.in
+++ b/Containerfile.in
@@ -84,14 +84,15 @@ RUN --mount=type=tmpfs,dst=/boot \
 #endif
 
 # /* Everything that can be done offline after things are in place should be done here */
+# /* dracut freaks out if /var is a different filesystem */
 RUN --network=none \
     --mount=type=tmpfs,dst=/boot \
+    --mount=type=tmpfs,dst=/var/log \
     --mount=type=bind,from=ctx,source=/,target=/ctx \
     /ctx/build_scripts/base/16-override-install.sh && \
-    /ctx/build_scripts/base/17-cleanup.sh && \
+    /ctx/build_scripts/base/17-services.sh && \
     /ctx/build_scripts/base/18-image-info.sh && \
     /ctx/build_scripts/base/19-initramfs.sh && \
-    /ctx/build_scripts/shared/validate-repos.sh && \
     /ctx/build_scripts/shared/clean-stage.sh && \
     /ctx/build_scripts/shared/chunkah-xattr.sh && \
     /ctx/build_scripts/base/20-tests.sh
diff --git a/build_scripts/base/01-packages.sh b/build_scripts/base/01-packages.sh
index 94ac9186..804dc538 100755
--- a/build_scripts/base/01-packages.sh
+++ b/build_scripts/base/01-packages.sh
@@ -22,6 +22,7 @@ OVERRIDES=(
     "mesa-libGL"
     "mesa-libgbm"
     "mesa-vulkan-drivers"
+    "openh264"
 )
 
 dnf5 distro-sync --skip-unavailable -y --repo='fedora-multimedia' "${OVERRIDES[@]}"
diff --git a/build_scripts/base/17-cleanup.sh b/build_scripts/base/17-cleanup.sh
deleted file mode 100755
index da4b55c3..00000000
--- a/build_scripts/base/17-cleanup.sh
+++ /dev/null
@@ -1,44 +0,0 @@
-#!/usr/bin/bash
-
-echo "::group:: ===$(basename "$0")==="
-
-set -eoux pipefail
-
-
-systemctl preset-all
-systemctl --global preset-all
-
-# Disable third-party repos
-for repo in fedora-multimedia tailscale fedora-cisco-openh264; do
-    if [[ -f "/etc/yum.repos.d/${repo}.repo" ]]; then
-        sed -i 's@enabled=1@enabled=0@g' "/etc/yum.repos.d/${repo}.repo"
-    fi
-done
-
-# Disable Terra repos (installed on F42 and earlier)
-for i in /etc/yum.repos.d/terra*.repo; do
-    if [[ -f "$i" ]]; then
-        sed -i 's@enabled=1@enabled=0@g' "$i"
-    fi
-done
-
-# Disable all COPR repos (should already be disabled by helpers, but ensure)
-for i in /etc/yum.repos.d/_copr:*.repo; do
-    if [[ -f "$i" ]]; then
-        sed -i 's@enabled=1@enabled=0@g' "$i"
-    fi
-done
-
-# Disable RPM Fusion repos
-for i in /etc/yum.repos.d/rpmfusion-*.repo; do
-    if [[ -f "$i" ]]; then
-        sed -i 's@enabled=1@enabled=0@g' "$i"
-    fi
-done
-
-# Disable fedora-coreos-pool if it exists
-if [ -f /etc/yum.repos.d/fedora-coreos-pool.repo ]; then
-    sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/fedora-coreos-pool.repo
-fi
-
-echo "::endgroup::"
diff --git a/build_scripts/base/17-services.sh b/build_scripts/base/17-services.sh
new file mode 100755
index 00000000..237de9aa
--- /dev/null
+++ b/build_scripts/base/17-services.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/bash
+
+echo "::group:: ===$(basename "$0")==="
+
+set -eoux pipefail
+
+systemctl preset-all
+systemctl --global preset-all
+
+echo "::endgroup::"
diff --git a/build_scripts/base/20-tests.sh b/build_scripts/base/20-tests.sh
index 14da193e..526f5fa2 100755
--- a/build_scripts/base/20-tests.sh
+++ b/build_scripts/base/20-tests.sh
@@ -166,4 +166,6 @@ if [[ "${IMAGE_FLAVOR}" == "dx" ]]; then
   /ctx/build_scripts/dx/10-tests-dx.sh;
 fi
 
+/ctx/build_scripts/shared/validate-repos.sh
+
 echo "::endgroup::"
diff --git a/build_scripts/dx/00-dx.sh b/build_scripts/dx/00-dx.sh
index d83c9d12..089d0f2d 100755
--- a/build_scripts/dx/00-dx.sh
+++ b/build_scripts/dx/00-dx.sh
@@ -109,11 +109,4 @@ EOF
 # Branding Changes
 echo "Variant=Developer Experience" >> /usr/share/kde-settings/kde-profile/default/xdg/kcm-about-distrorc
 
-# Disable RPM Fusion repos
-for i in /etc/yum.repos.d/rpmfusion-*.repo; do
-    if [[ -f "$i" ]]; then
-        sed -i 's@enabled=1@enabled=0@g' "$i"
-    fi
-done
-
 echo "::endgroup::"
diff --git a/build_scripts/shared/build-prep.sh b/build_scripts/shared/build-prep.sh
index ab56aafa..a20ef344 100755
--- a/build_scripts/shared/build-prep.sh
+++ b/build_scripts/shared/build-prep.sh
@@ -19,8 +19,13 @@ fi
 
 rsync -rvKl "${BUILD_FILES[@]}" /
 
+# mostly for codecs fedora can't ship
 dnf config-manager setopt fedora-multimedia.priority=90
 
+# https://fedoraproject.org/wiki/OpenH264
+# this would be fine to use as well, negativo just has it, one less repo
+dnf config-manager setopt fedora-cisco-openh264.enabled=0
+
 mkdir -p /tmp/scripts/helpers
 install -Dm0755 /ctx/build_scripts/shared/utils/ghcurl /tmp/scripts/helpers/ghcurl
 
diff --git a/build_scripts/shared/validate-repos.sh b/build_scripts/shared/validate-repos.sh
index 8535444a..6febc05f 100755
--- a/build_scripts/shared/validate-repos.sh
+++ b/build_scripts/shared/validate-repos.sh
@@ -1,121 +1,30 @@
 #!/usr/bin/bash
 
-echo "::group:: ===$(basename "$0")==="
-
 set -eou pipefail
 
-REPOS_DIR="/etc/yum.repos.d"
-VALIDATION_FAILED=0
-ENABLED_REPOS=()
-
-echo "Validating all repository files are disabled..."
-
-# Check if repos directory exists
-if [[ ! -d "$REPOS_DIR" ]]; then
-    echo "Warning: $REPOS_DIR does not exist"
-    exit 0
-fi
-
-# Function to check if a repo file has any enabled repos
-check_repo_file() {
-    local repo_file="$1"
-    local basename_file
-    basename_file=$(basename "$repo_file")
-
-    # Skip if file doesn't exist or isn't readable
-    [[ ! -f "$repo_file" ]] && return 0
-    [[ ! -r "$repo_file" ]] && return 0
-
-    # Check for enabled=1 in the file
-    if grep -q "^enabled=1" "$repo_file" 2>/dev/null; then
-        echo "ENABLED: $basename_file"
-        ENABLED_REPOS+=("$basename_file")
-        VALIDATION_FAILED=1
-
-        # Show which sections are enabled
-        echo "   Enabled sections:"
-        local section_name=""
-        while IFS= read -r line; do
-            if [[ "$line" =~ ^\[.*\]$ ]]; then
-                section_name="$line"
-            elif [[ "$line" =~ ^enabled=1 ]]; then
-                echo "     - $section_name"
-            fi
-        done < "$repo_file"
-    else
-        echo "Disabled: $basename_file"
-    fi
-}
-
-echo ""
-echo "Checking COPR repositories (standard naming)..."
-echo "NOTE: With secure isolated installation, NO COPRs should be globally enabled!"
-for repo in "$REPOS_DIR"/_copr:copr.fedorainfracloud.org:*.repo; do
-    [[ -f "$repo" ]] && check_repo_file "$repo"
-done
-
-echo ""
-echo "Checking COPR repositories (non-standard naming)..."
-echo "SECURITY: Enabled COPRs can inject malicious versions of Fedora packages!"
-for repo in "$REPOS_DIR"/_copr_*.repo; do
-    [[ -f "$repo" ]] && check_repo_file "$repo"
-done
-
-echo ""
-echo "Checking other third-party repositories..."
-# List of known third-party repos that should be disabled
-OTHER_REPOS=(
-    "fedora-multimedia.repo"
-    "tailscale.repo"
-    "vscode.repo"
-    "docker-ce.repo"
-    "fedora-cisco-openh264.repo"
-    "fedora-coreos-pool.repo"
-    "terra.repo"
+ALLOWED_REPOS=(
+  fedora
+  updates{-archive,}
 )
 
-for repo_name in "${OTHER_REPOS[@]}"; do
-    repo_path="$REPOS_DIR/$repo_name"
-    if [[ -f "$repo_path" ]]; then
-        check_repo_file "$repo_path"
-    fi
-done
+BETA_REPOS=(updates-testing)
 
-echo ""
-echo "Checking RPM Fusion repositories..."
-for repo in "$REPOS_DIR"/rpmfusion-*.repo; do
-    [[ -f "$repo" ]] && check_repo_file "$repo"
-done
+source /usr/lib/os-release
 
-echo ""
-echo "Checking Fedora updates-testing (should be disabled unless beta)..."
-if [[ -f "$REPOS_DIR/fedora-updates-testing.repo" ]]; then
-    if grep -q "^enabled=1" "$REPOS_DIR/fedora-updates-testing.repo" 2>/dev/null; then
-        # Allow updates-testing to be enabled for beta builds
-        if [[ "${UBLUE_IMAGE_TAG:-stable}" == "beta" ]]; then
-            echo "updates-testing is enabled (allowed for beta builds)"
-        else
-            echo "ENABLED: fedora-updates-testing.repo (should only be enabled for beta)"
-            ENABLED_REPOS+=("fedora-updates-testing.repo")
-            VALIDATION_FAILED=1
-        fi
-    else
-        echo "Disabled: fedora-updates-testing.repo"
-    fi
+# TODO: we need a way to temporarily allow this on stable releases by checking
+# installed packages via dnf
+# Betas/pre-releases use updates-testing
+if [[ "$RELEASE_TYPE" == "development" ]]; then
+  ALLOWED_REPOS=( "${ALLOWED_REPOS[@]}" "${BETA_REPOS[@]}" )
 fi
 
-# Final summary
-echo ""
-echo "======================================"
-if [[ $VALIDATION_FAILED -eq 1 ]]; then
-    echo "VALIDATION FAILED"
-    echo "======================================"
-    echo ""
-    echo "The following repositories are still ENABLED:"
-    for repo in "${ENABLED_REPOS[@]}"; do
-        echo "  • $repo"
-    done
-    exit 1
-fi
+ALLOWED_REPO_LIST="$(printf '%s\n' "${ALLOWED_REPOS[@]}")"
 
-echo "::endgroup::"
+ENABLED_REPOS="$(dnf repolist --enabled | awk 'NR>1 {print $1}')"
+
+BAD_REPOS="$(grep -v --fixed-strings --line-regexp -f <(echo "$ALLOWED_REPO_LIST") <<< "$ENABLED_REPOS" || true)"
+
+if [[ -n "$BAD_REPOS" ]]; then
+  echo "unexpected enabled repo(s) detected:"
+  echo "$BAD_REPOS"; exit 1
+fi