diff --git a/build/build-iso.sh b/build/build-iso.sh
index 162d536..f86fbf3 100755
--- a/build/build-iso.sh
+++ b/build/build-iso.sh
@@ -13,10 +13,12 @@ set -euo pipefail
 
 REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 OUT_DIR="$REPO_ROOT/build/out"
+CACHE_DIR="$REPO_ROOT/build/cache"
 KS="$REPO_ROOT/kickstart/veilor-os.ks"
 RELEASEVER="${RELEASEVER:-43}"
 DATE="$(date +%Y%m%d-%H%M%S)"
 ISO_NAME="veilor-os-${RELEASEVER}-${DATE}.iso"
+BOOT_ISO="${BOOT_ISO:-$CACHE_DIR/Fedora-Everything-netinst-x86_64-43-1.6.iso}"
 
 mkdir -p "$OUT_DIR"
 
@@ -42,6 +44,11 @@ rm -rf "$OUT_DIR/build-${DATE}"
 mkdir -p /tmp/veilor-lmc
 
 # ── Build ISO ──
+# --no-virt: chroot install on host. selinux-policy %triggerin always
+# fails exit 255 in chroot (no /sys/fs/selinux). Host's anaconda is
+# patched (transaction_progress.py: log warning instead of raise on
+# non-fatal tx error). --virt would be cleaner but needs iso9660
+# kernel module which veilor host has locked (modules_disabled=1).
 livemedia-creator \
     --make-iso \
     --no-virt \