diff --git a/kickstart/veilor-os.ks b/kickstart/veilor-os.ks
index 4c8359c..f8437d8 100644
--- a/kickstart/veilor-os.ks
+++ b/kickstart/veilor-os.ks
@@ -3,8 +3,14 @@
 # Build with livemedia-creator inside build/Containerfile.
 
 # ── Install source ──
-url --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-$releasever&arch=$basearch"
-repo --name=updates --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f$releasever&arch=$basearch"
+# Hard-code version (not $releasever) because lorax doesn't expand
+# inside kickstart `url`/`repo` directives. Updates repo critical:
+# base Fedora 43 ships selinux-policy 42.12 with pcre2-10.47-built
+# file_contexts.bin, which fails chroot %triggerin against host's
+# libselinux (built against pcre2 10.46). 43.7 in updates is rebuilt.
+url --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64"
+repo --name=updates --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64" --install
+repo --name=updates-testing --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=updates-testing-f43&arch=x86_64" --cost=1500
 
 # ── Locale / keyboard / time (template — adjust per build) ──
 keyboard --xlayouts='us'