diff --git a/overlay/usr/local/bin/veilor-installer b/overlay/usr/local/bin/veilor-installer
index 4e660b8..be00dd0 100644
--- a/overlay/usr/local/bin/veilor-installer
+++ b/overlay/usr/local/bin/veilor-installer
@@ -150,10 +150,30 @@ prompt_input() {
 }
 
 # prompt_password <header>
+#
+# v0.6: gum-path replaced with bash `read -srp` because `gum input
+# --password` rendered as a duplicate-"Install" + stray-T artefact on
+# the linux fbcon since v0.5.27 (Agent 7 of the v0.6 polish research
+# wave traced this to gum's bubbletea screen-restore writing back the
+# previous menu buffer when the framebuffer terminfo lacked
+# `civis/cnorm` cursor-hide sequences). bash `read -srp` is a single
+# write to stdout + termios echo-off — no redraw, no glitch. Header
+# rendered separately via gum style for visual parity with the rest
+# of the installer.
 prompt_password() {
     local header=$1
     if [[ $TUI == gum ]]; then
-        gum input --password --header "$header"
+        # Render the prompt header as a styled box so it looks at home
+        # next to the other gum prompts, then collect the password via
+        # plain bash read on the next line. `read -s` disables echo,
+        # `read -p` writes the prompt to stderr (so command-substitution
+        # callers still get the password on stdout cleanly).
+        gum style --foreground "${VEILOR_FG:-15}" --border rounded \
+            --border-foreground "${VEILOR_DIM:-240}" --padding "0 2" -- "$header"
+        local pw
+        read -srp "  password: " pw
+        echo >&2  # newline after silent read so next prompt isn't on same line
+        printf '%s' "$pw"
     else
         whiptail --title "veilor-os" --passwordbox "$header" 10 60 \
             3>&1 1>&2 2>&3