diff --git a/kickstart/veilor-os.ks b/kickstart/veilor-os.ks
index daa4bf1..cfc32f0 100644
--- a/kickstart/veilor-os.ks
+++ b/kickstart/veilor-os.ks
@@ -31,7 +31,9 @@ eula --agreed
 # vs 10.47). veilor-firstboot.service triggers `fixfiles -F onboot` and
 # `setenforce 1` on first boot to re-enable enforcing mode.
 selinux --permissive
-services --enabled=sshd,fail2ban,usbguard,tuned,auditd,firewalld,chronyd,sddm,veilor-firstboot,veilor-modules-lock
+# veilor-firstboot + veilor-modules-lock enabled via %post after overlay
+# copy (units don't exist yet at services-config phase).
+services --enabled=sshd,fail2ban,usbguard,tuned,auditd,firewalld,chronyd,sddm
 
 # ── Network / hostname ──
 network --bootproto=dhcp --device=link --activate --hostname=veilor-os