diff --git a/kickstart/veilor-os.ks b/kickstart/veilor-os.ks
index e05fe32..2ae0ec1 100644
--- a/kickstart/veilor-os.ks
+++ b/kickstart/veilor-os.ks
@@ -8,10 +8,11 @@
 # base Fedora 43 ships selinux-policy 42.12 with pcre2-10.47-built
 # file_contexts.bin, which fails chroot %triggerin against host's
 # libselinux (built against pcre2 10.46). 43.7 in updates is rebuilt.
-url --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64"
-# Updates cost=500 < base cost=1000 → dnf prefers updates (lower = higher priority).
-# Pulls selinux-policy 43.7 + pcre2 10.47 (matched pair, no regex mismatch).
-repo --name=updates --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64" --install --cost=500
+# Use updates as primary install source — base 42.12 selinux-policy
+# ships file_contexts.bin compiled with pcre2 10.47 but base ships
+# pcre2 10.46 (Fedora packaging bug). Updates 43.7 has matched pair.
+url --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64"
+repo --name=fedora --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64" --install
 
 # ── Locale / keyboard / time (template — adjust per build) ──
 keyboard --xlayouts='us'