diff --git a/overlay/usr/local/bin/veilor-installer b/overlay/usr/local/bin/veilor-installer
index e1b6acc..a9f6ac5 100644
--- a/overlay/usr/local/bin/veilor-installer
+++ b/overlay/usr/local/bin/veilor-installer
@@ -501,14 +501,34 @@ bash $REPO/scripts/selinux/build-policy.sh || echo "[WARN] SELinux build failed;
 # Apply KDE theme + DuckSans + os-release branding
 bash $REPO/scripts/kde-theme-apply.sh
 
-# Mask plymouth services. Plymouth boot splash is unreliable in QEMU
-# (race between plymouth-start and systemd-ask-password-plymouth.path
-# leaves LUKS prompt invisible → boot hangs in dracut-initqueue).
-# `systemctl mask` requires systemd running, which isn't true in
-# anaconda chroot %post — write the /dev/null symlinks directly instead.
-# Targets the path-activated ask-password unit too (the .path is what
-# plymouth-start gets pulled in by). systemd-tty-ask-password-agent
-# handles LUKS prompt as fallback on tty1.
+# Disable plymouth at TWO layers:
+#
+# 1. Initramfs (the boot stage where LUKS unlock happens). Plymouth is
+#    a dracut module; masking units in /etc/systemd/ has zero effect
+#    here because dracut bundles its own copies into initramfs/.
+#    Solution: omit_dracutmodules in dracut.conf.d, then regenerate
+#    initramfs so the new config takes effect.
+#
+# 2. Real root (post-pivot, before SDDM). /dev/null symlinks mask all
+#    plymouth services + the path-activated ask-password unit so they
+#    never start when systemd is up.
+#
+# After both, LUKS prompt falls back to systemd-tty-ask-password-agent
+# on tty1 — text "Please enter passphrase for disk... :" — works in
+# QEMU sendkey AND on real hardware.
+
+# Layer 1: initramfs
+mkdir -p /etc/dracut.conf.d
+cat > /etc/dracut.conf.d/99-veilor-no-plymouth.conf << 'EOF'
+omit_dracutmodules+=" plymouth "
+EOF
+# Regenerate initramfs for the installed kernel(s).
+for kver in /lib/modules/*/; do
+    kver=$(basename "$kver")
+    dracut --force --kver "$kver" 2>/dev/null || true
+done
+
+# Layer 2: real-root masks
 mkdir -p /etc/systemd/system
 for unit in \
     plymouth-start.service \