diff --git a/deploy/pi-gen/stage-betterframe-client/01-install-kiosk/01-run-chroot.sh b/deploy/pi-gen/stage-betterframe-client/01-install-kiosk/01-run-chroot.sh
index baef042..6fd79c7 100755
--- a/deploy/pi-gen/stage-betterframe-client/01-install-kiosk/01-run-chroot.sh
+++ b/deploy/pi-gen/stage-betterframe-client/01-install-kiosk/01-run-chroot.sh
@@ -144,6 +144,13 @@ for name in ['default','left_ptr','arrow','watch','hand2','text','xterm',
 # Set as system default cursor theme
 update-alternatives --install /usr/share/icons/default/index.theme x-cursor-theme \
   /usr/share/icons/betterframe-empty/cursor.theme 100 2>/dev/null || true
+# Per-user cursor config for bfkiosk (cage reads user's icon theme)
+install -d -o bfkiosk -g bfkiosk -m 755 /home/bfkiosk/.icons/default
+cat > /home/bfkiosk/.icons/default/index.theme <<'CURSOR'
+[Icon Theme]
+Inherits=betterframe-empty
+CURSOR
+chown bfkiosk:bfkiosk /home/bfkiosk/.icons/default/index.theme
 
 # --- Enable services, disable noise ---
 systemctl enable seatd
@@ -217,11 +224,14 @@ rm -f /etc/systemd/system/getty.target.wants/* 2>/dev/null || true
 printf 'BetterFrame Kiosk\n\n' > /etc/issue
 rm -f /etc/update-motd.d/* 2>/dev/null || true
 
-# Nuke entire desktop environment if installed (stage3 leftovers).
-# This is the nuclear option — piwiz can't run if there's no desktop.
-apt-get -y purge 'lx*' 'labwc*' 'wayfire*' 'wf-*' lightdm gdm3 sddm \
-  xserver-xorg-core xwayland rpd-plym-splash pi-greeter \
-  desktop-base raspberrypi-ui-mods 2>/dev/null || true
+# Remove desktop packages that could show setup wizards. Be specific —
+# wildcard 'lx*' kills libwlroots which removes cage (our compositor).
+apt-get -y purge piwiz userconf-pi rpi-first-boot-wizard pi-greeter \
+  rpd-plym-splash lightdm gdm3 sddm desktop-base \
+  raspberrypi-ui-mods lxde lxde-core lxpanel lxsession lxterminal \
+  labwc wayfire 2>/dev/null || true
+# Mark cage as manually installed so autoremove won't touch it.
+apt-mark manual cage 2>/dev/null || true
 apt-get -y autoremove 2>/dev/null || true
 
 # Force multi-user via kernel cmdline (overrides any default target)
diff --git a/deploy/rauc/repartition-image.sh b/deploy/rauc/repartition-image.sh
index bbf969e..83b57b2 100755
--- a/deploy/rauc/repartition-image.sh
+++ b/deploy/rauc/repartition-image.sh
@@ -96,7 +96,11 @@ cp "$WORK/bootfs.vfat" "$WORK/bootfs_A.vfat"
 BOOT_A_LOOP="$(losetup -f --show "$WORK/bootfs_A.vfat")"
 mkdir -p "$WORK/mnt-ba"
 mount "$BOOT_A_LOOP" "$WORK/mnt-ba"
+# Disable initramfs — it can't resolve LABEL= and we don't need it.
+# Kernel mounts root directly with rootwait.
+sed -i 's/^auto_initramfs=1/auto_initramfs=0/' "$WORK/mnt-ba/config.txt" 2>/dev/null || true
 sed -i 's|root=PARTUUID=[^ ]*|root=LABEL=BF_ROOT_A|' "$WORK/mnt-ba/cmdline.txt" 2>/dev/null || true
+sed -i 's|root=/dev/[^ ]*|root=LABEL=BF_ROOT_A|' "$WORK/mnt-ba/cmdline.txt" 2>/dev/null || true
 # autoboot.txt: normal boot → partition 1 (this one), tryboot → partition 2
 cat > "$WORK/mnt-ba/autoboot.txt" <<'AUTOBOOT'
 [all]
@@ -115,7 +119,9 @@ cp "$WORK/bootfs.vfat" "$WORK/bootfs_B.vfat"
 BOOT_B_LOOP="$(losetup -f --show "$WORK/bootfs_B.vfat")"
 mkdir -p "$WORK/mnt-bb"
 mount "$BOOT_B_LOOP" "$WORK/mnt-bb"
+sed -i 's/^auto_initramfs=1/auto_initramfs=0/' "$WORK/mnt-bb/config.txt" 2>/dev/null || true
 sed -i 's|root=PARTUUID=[^ ]*|root=LABEL=BF_ROOT_B|' "$WORK/mnt-bb/cmdline.txt" 2>/dev/null || true
+sed -i 's|root=/dev/[^ ]*|root=LABEL=BF_ROOT_B|' "$WORK/mnt-bb/cmdline.txt" 2>/dev/null || true
 cat > "$WORK/mnt-bb/autoboot.txt" <<'AUTOBOOT'
 [all]
 tryboot_a_b=1