diff --git a/kickstart/veilor-os.ks b/kickstart/veilor-os.ks
index 992060d..daa4bf1 100644
--- a/kickstart/veilor-os.ks
+++ b/kickstart/veilor-os.ks
@@ -8,11 +8,14 @@
 # base Fedora 43 ships selinux-policy 42.12 with pcre2-10.47-built
 # file_contexts.bin, which fails chroot %triggerin against host's
 # libselinux (built against pcre2 10.46). 43.7 in updates is rebuilt.
-# Base provides install tree metadata. Updates pulled only for
-# selinux-policy + pcre2 (the version-skew chokepoint) via includepkgs.
-# Cost=10 forces updates to win for the listed packages.
 url --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64"
-repo --name=updates --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64" --install --cost=10 --includepkgs=selinux-policy,selinux-policy-targeted,selinux-policy-devel,libselinux,libselinux-utils,python3-libselinux,pcre2,pcre2-syntax,pcre2-utf16,pcre2-utf32
+repo --name=updates --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64" --install
+# Local fix-repo: ships selinux-policy 43.7 + pcre2 10.47 paired (matched
+# regex versions) — bypasses Anaconda's repo-merger ignoring cost/priority
+# from updates. cost=1 = highest priority. Build via:
+#   dnf download pcre2-10.47 selinux-policy-43.7 ... -d /tmp/veilor-fix-repo
+#   createrepo_c /tmp/veilor-fix-repo
+repo --name=veilor-fix --baseurl=file:///tmp/veilor-fix-repo --install --cost=1
 
 # ── Locale / keyboard / time (template — adjust per build) ──
 keyboard --xlayouts='us'