diff --git a/bluebuild/recipe.yml b/bluebuild/recipe.yml
index bdf2229..64d0fff 100644
--- a/bluebuild/recipe.yml
+++ b/bluebuild/recipe.yml
@@ -52,6 +52,29 @@ modules:
         bash /usr/share/veilor-os/scripts/kde-theme-apply.sh || true
         bash /usr/share/veilor-os/scripts/30-apply-v03-theme.sh 2>/dev/null || true
         plymouth-set-default-theme details 2>/dev/null || true
+        # Mark all our shipped scripts + CLIs executable. cp -a from the
+        # repo preserves perms but BlueBuild's `type: files` sometimes
+        # drops the +x bit on the way through; belt-and-braces here.
+        chmod +x /usr/share/veilor-os/scripts/*.sh \
+                 /usr/share/veilor-os/scripts/selinux/*.sh \
+                 /usr/local/bin/veilor-* 2>/dev/null || true
+        # Refresh fontconfig cache so Fira Code is picked up by KDE
+        fc-cache -f 2>/dev/null || true
+        # os-release brand override (atomic /etc is r/w; safe to overwrite)
+        if [ -f /etc/os-release ]; then
+          sed -i \
+            -e 's|^NAME=.*|NAME="veilor-os"|' \
+            -e 's|^PRETTY_NAME=.*|PRETTY_NAME="veilor-os 0.7 (atomic)"|' \
+            -e 's|^ID=.*|ID=veilor|' \
+            -e 's|^ID_LIKE=.*|ID_LIKE="fedora kinoite"|' \
+            /etc/os-release || true
+        fi
+        # Sanity: brand-leak check, fail build if any onyx/personal data slipped in
+        if grep -rqi 'onyx\|192\.168\.0\.\|fedora\.local\|xynki\.dev' \
+            /etc/veilor* /etc/tuned/profiles/veilor-* /usr/share/veilor-os 2>/dev/null; then
+          echo "[ERR] brand leak detected in shipped state"
+          exit 1
+        fi
 
   # ── 3. Override secureblue's run0-only — restore sudo ───────────
   # secureblue removes sudo + replaces with run0. Too disruptive for
@@ -86,6 +109,19 @@ modules:
       - tailscale
       - yggdrasil
 
+  # ── 6b. Memory hygiene + ergonomic deps ─────────────────────────
+  # zram-generator gives us zram swap (no disk swap, no cold-boot
+  # leak). gum is the TUI primitive used by veilor-postinstall +
+  # veilor-update + veilor-doctor — vendor binary at build time so
+  # post-install layering doesn't need it.
+  - type: rpm-ostree
+    install:
+      - zram-generator
+      - jq
+      - vim-enhanced
+      - tmux
+      - htop
+
   # ── 7. ujust recipes for opt-in components ──────────────────────
   - type: files
     files:
@@ -103,13 +139,15 @@ modules:
         # auditd, firewalld, chronyd, sddm — no re-enable needed.
 
   # ── 9. veilor-os specific systemd units ─────────────────────────
-  # veilor-firstboot.service comes in via overlay/etc/systemd/system/
-  # — needs explicit enable since it's not part of secureblue's set.
+  # All veilor-* units come in via overlay/etc/systemd/system/ —
+  # explicit enable here since they aren't part of secureblue's set.
   - type: systemd
     system:
       enabled:
         - veilor-firstboot.service
         - veilor-modules-lock.service
+        - veilor-postinstall.service
+        - veilor-doctor.timer
 
   # ── 10. signing config ──────────────────────────────────────────
   # bluebuild emits cosign.pub at root; CI uses the pinned key