diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 82cfe9d..107f631 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -192,6 +192,21 @@ jobs:
              deploy/pi-gen/stage-betterframe-client/01-install-kiosk/files/
           cp deploy/plymouth/betterframe/betterframe.script \
              deploy/pi-gen/stage-betterframe-client/01-install-kiosk/files/
+          # RAUC config + custom bootloader backend
+          cp deploy/rauc/system.conf \
+             deploy/pi-gen/stage-betterframe-client/01-install-kiosk/files/rauc-system.conf
+          cp deploy/rauc/betterframe-rauc-boot.sh \
+             deploy/pi-gen/stage-betterframe-client/01-install-kiosk/files/
+          # CA cert is operator-supplied — generated locally via
+          # scripts/gen-rauc-signing-keys.sh and committed at
+          # deploy/rauc/ca-cert.pem. Without it the image installs but
+          # rauc refuses every bundle (verify-only mode).
+          if [ -f deploy/rauc/ca-cert.pem ]; then
+            cp deploy/rauc/ca-cert.pem \
+               deploy/pi-gen/stage-betterframe-client/01-install-kiosk/files/rauc-keyring.pem
+          else
+            echo "::warning::deploy/rauc/ca-cert.pem missing — OS OTA disabled in this image"
+          fi
           chmod +x deploy/pi-gen/stage-betterframe-client/01-install-kiosk/00-run.sh \
                    deploy/pi-gen/stage-betterframe-client/01-install-kiosk/01-run-chroot.sh \
                    deploy/pi-gen/stage-betterframe-client/prerun.sh
diff --git a/deploy/pi-gen/stage-betterframe-client/00-install-packages/00-packages b/deploy/pi-gen/stage-betterframe-client/00-install-packages/00-packages
index aa292a2..dc77fe1 100644
--- a/deploy/pi-gen/stage-betterframe-client/00-install-packages/00-packages
+++ b/deploy/pi-gen/stage-betterframe-client/00-install-packages/00-packages
@@ -15,3 +15,5 @@ gstreamer1.0-gtk4
 v4l-utils
 wlr-randr
 ca-certificates
+rauc
+dosfstools
diff --git a/deploy/pi-gen/stage-betterframe-client/01-install-kiosk/01-run-chroot.sh b/deploy/pi-gen/stage-betterframe-client/01-install-kiosk/01-run-chroot.sh
index e1c066b..fad0241 100755
--- a/deploy/pi-gen/stage-betterframe-client/01-install-kiosk/01-run-chroot.sh
+++ b/deploy/pi-gen/stage-betterframe-client/01-install-kiosk/01-run-chroot.sh
@@ -31,6 +31,20 @@ install -m 644 /tmp/bf-files/betterframe-kiosk.conf /etc/tmpfiles.d/betterframe-
 install -d -m 755 /etc/udev/rules.d
 install -m 644 /tmp/bf-files/90-betterframe-no-hid.rules /etc/udev/rules.d/90-betterframe-no-hid.rules
 
+# --- RAUC OS-OTA config ---
+# system.conf names the A/B slots + the custom bootloader backend.
+# keyring.pem is the operator's CA cert (generated by
+# scripts/gen-rauc-signing-keys.sh, committed at deploy/rauc/ca-cert.pem).
+# Without keyring.pem, RAUC refuses every bundle.
+install -d -m 755 /etc/rauc
+install -m 644 /tmp/bf-files/rauc-system.conf /etc/rauc/system.conf
+if [ -f /tmp/bf-files/rauc-keyring.pem ]; then
+  install -m 644 /tmp/bf-files/rauc-keyring.pem /etc/rauc/keyring.pem
+else
+  echo "WARNING: no rauc-keyring.pem staged — OS OTA will refuse all bundles" >&2
+fi
+install -m 755 /tmp/bf-files/betterframe-rauc-boot.sh /usr/local/sbin/betterframe-rauc-boot.sh
+
 # Default env file — operator may edit on first boot to point at their server.
 cat > /etc/default/betterframe-kiosk <<'EOF'
 # Runtime env for betterframe-kiosk. Edit and `systemctl restart betterframe-kiosk`.
@@ -42,6 +56,11 @@ cat > /etc/default/betterframe-kiosk <<'EOF'
 # builds auto-deploy once they land in the BF server (via the build workflow's
 # auto-import step). Set to 0 to pin a kiosk to its current binary.
 BF_ENABLE_APP_OTA=1
+
+# Enable full-OS RAUC OTA. The image ships with A/B partitions + rauc
+# preinstalled. Set to 0 to pin OS version manually (kiosk-app updates
+# still flow via BF_ENABLE_APP_OTA).
+BF_ENABLE_OS_OTA=1
 EOF
 
 # Plymouth boot splash