diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 07b8430..5ef4cb6 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -174,7 +174,9 @@ jobs:
              deploy/pi-gen/stage-betterframe-client/01-install-kiosk/files/
           cp deploy/plymouth/betterframe/betterframe.script \
              deploy/pi-gen/stage-betterframe-client/01-install-kiosk/files/
-          chmod +x deploy/pi-gen/stage-betterframe-client/01-install-kiosk/00-run-chroot.sh
+          chmod +x deploy/pi-gen/stage-betterframe-client/01-install-kiosk/00-run.sh \
+                   deploy/pi-gen/stage-betterframe-client/01-install-kiosk/01-run-chroot.sh \
+                   deploy/pi-gen/stage-betterframe-client/prerun.sh
 
       - name: Build Pi image (pi-gen)
         uses: usimd/pi-gen-action@v1.11.0
diff --git a/deploy/pi-gen/stage-betterframe-client/01-install-kiosk/00-run.sh b/deploy/pi-gen/stage-betterframe-client/01-install-kiosk/00-run.sh
new file mode 100755
index 0000000..92ab34c
--- /dev/null
+++ b/deploy/pi-gen/stage-betterframe-client/01-install-kiosk/00-run.sh
@@ -0,0 +1,8 @@
+#!/bin/bash -e
+# Host-side (runs outside chroot, before 01-run-chroot.sh). Stages every
+# file from the sub-stage's files/ dir into the chroot at /tmp/bf-files
+# so the chroot script can install them. Files dir is populated by CI
+# (build.yml's "Stage files for pi-gen" step).
+install -d "${ROOTFS_DIR}/tmp/bf-files"
+cp -r "${BASE_DIR}/stage-betterframe-client/01-install-kiosk/files/." \
+      "${ROOTFS_DIR}/tmp/bf-files/"
diff --git a/deploy/pi-gen/stage-betterframe-client/01-install-kiosk/00-run-chroot.sh b/deploy/pi-gen/stage-betterframe-client/01-install-kiosk/01-run-chroot.sh
similarity index 100%
rename from deploy/pi-gen/stage-betterframe-client/01-install-kiosk/00-run-chroot.sh
rename to deploy/pi-gen/stage-betterframe-client/01-install-kiosk/01-run-chroot.sh