diff --git a/overlay/usr/local/bin/veilor-installer b/overlay/usr/local/bin/veilor-installer
index 69c84a8..5da0da9 100644
--- a/overlay/usr/local/bin/veilor-installer
+++ b/overlay/usr/local/bin/veilor-installer
@@ -562,11 +562,11 @@ omit_dracutmodules+=" plymouth "
 add_dracutmodules+=" crypt systemd-cryptsetup "
 install_items+=" /usr/bin/systemd-tty-ask-password-agent "
 EOF
-# Regenerate initramfs for the installed kernel(s).
-for kver in /lib/modules/*/; do
-    kver=$(basename "$kver")
-    dracut --force --kver "$kver" 2>/dev/null || true
-done
+# Regenerate initramfs for ALL installed kernels with our dracut config.
+# `--regenerate-all` walks /lib/modules itself; safer than bash glob in
+# chroot where shell may be dash + nullglob unset → glob expands literally
+# → dracut --kver "/lib/modules/*/" fails silently.
+dracut --force --regenerate-all 2>&1 | tail -5 || true
 
 # Layer 2: real-root masks
 mkdir -p /etc/systemd/system