diff --git a/kickstart/veilor-os.ks b/kickstart/veilor-os.ks
index 2ae0ec1..992060d 100644
--- a/kickstart/veilor-os.ks
+++ b/kickstart/veilor-os.ks
@@ -8,11 +8,11 @@
 # base Fedora 43 ships selinux-policy 42.12 with pcre2-10.47-built
 # file_contexts.bin, which fails chroot %triggerin against host's
 # libselinux (built against pcre2 10.46). 43.7 in updates is rebuilt.
-# Use updates as primary install source — base 42.12 selinux-policy
-# ships file_contexts.bin compiled with pcre2 10.47 but base ships
-# pcre2 10.46 (Fedora packaging bug). Updates 43.7 has matched pair.
-url --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64"
-repo --name=fedora --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64" --install
+# Base provides install tree metadata. Updates pulled only for
+# selinux-policy + pcre2 (the version-skew chokepoint) via includepkgs.
+# Cost=10 forces updates to win for the listed packages.
+url --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64"
+repo --name=updates --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64" --install --cost=10 --includepkgs=selinux-policy,selinux-policy-targeted,selinux-policy-devel,libselinux,libselinux-utils,python3-libselinux,pcre2,pcre2-syntax,pcre2-utf16,pcre2-utf32
 
 # ── Locale / keyboard / time (template — adjust per build) ──
 keyboard --xlayouts='us'