diff --git a/docs/ROADMAP.md b/docs/ROADMAP.md
index 89f0639..42e4b72 100644
--- a/docs/ROADMAP.md
+++ b/docs/ROADMAP.md
@@ -24,6 +24,30 @@ Released `v0.2.5` on 2026-05-01. CI on every push to `main`.
 
 ---
 
+## v0.5.27–v0.5.28 — install path stabilisation (active)
+
+The bridge between v0.2 (greens at all) and v0.3 (looks polished). All
+of these are install-path bugs surfaced by the formal hybrid-VM test
+procedure (`test/TESTING.md`).
+
+- **v0.5.27 (DONE)** — `rd.luks.uuid` injected via `grubby
+  --update-kernel=ALL` so Fedora 43 BLS entries actually carry the
+  arg; without it first boot drops to dracut emergency shell. GRUB
+  rebrand (single "veilor-os" entry, rescue suppressed). `fbcon=nodefer`
+  in live cmdline so real laptops don't black-screen on KMS handoff.
+  ASCII gum cursor (cosmetic only — duplicate-render bug runs deeper,
+  carried to v0.5.28).
+- **v0.5.28 (next)** — locale picker removed; en_US.UTF-8 hardcoded
+  for install (post-install menu in v0.7 handles locale switch). gum
+  input render glitches on linux fbcon (duplicate "Install", stray T
+  in password fields) get a real fix — likely replace `gum input
+  --password` with bash `read -srp`, since masked input does not need
+  TUI polish and every other distro installer does it this way.
+  Anaconda transaction containment so the user sees a branded
+  "INSTALLING" panel instead of `Configuring xxx.x86_64` scroll.
+
+---
+
 ## v0.3 — UX polish (in progress)
 
 The visible polish layer that v0.2 deferred for build velocity.
@@ -108,7 +132,18 @@ hardening.
 - **`veilor-doctor`** — diagnostic helper. Walks the audit checklist
   (`getenforce`, `mokutil --sb-state`, `firewall-cmd --get-default-zone`,
   fail2ban status, USBGuard policy, sysctl drift) and reports what's
-  drifted from baseline.
+  drifted from baseline. This is the **post-install audit** path:
+  every veilor-os user can run `veilor-doctor` weekly and see exactly
+  where their system has drifted from the hardened defaults.
+- **`veilor-postinstall`** — first-login welcome menu, EndeavourOS-style
+  but cleaner. Single TUI screen with: keyboard layout, locale, hostname
+  override, optional package presets (dev / media / homelab), driver
+  choices (NVIDIA / Intel / AMD), Bluetooth opt-in, audit baseline run.
+  Each step is skippable, runs once on first SDDM login, never auto-runs
+  again. Lives in `overlay/usr/local/bin/veilor-postinstall` + a
+  `~/.config/autostart/veilor-postinstall.desktop` that self-deletes
+  after first run. Replaces the current "user has to know what to
+  configure" model with "we ask, once, with sane defaults pre-selected".
 - **Opt-in installer ISO** — flip from live-only to live + installer,
   user picks at boot menu. Installer uses the v0.5 kickstart with full
   LUKS + btrfs subvols + zram.
diff --git a/overlay/usr/local/bin/veilor-installer b/overlay/usr/local/bin/veilor-installer
index 4dcc9e5..770a364 100644
--- a/overlay/usr/local/bin/veilor-installer
+++ b/overlay/usr/local/bin/veilor-installer
@@ -224,7 +224,7 @@ collect_answers() {
         prompt_error "No installable disks found."
         return 1
     fi
-    disk=$(prompt_choose_pairs "[1/4] Select install disk · WILL BE ERASED" "${disks_pairs[@]}") || return 1
+    disk=$(prompt_choose_pairs "[1/3] Select install disk · WILL BE ERASED" "${disks_pairs[@]}") || return 1
 
     # ── Hostname ──
     # Hardcoded for branded consistency. Post-install: `hostnamectl set-hostname`.
@@ -253,17 +253,21 @@ collect_answers() {
     }
 
     # ── LUKS passphrase ──
-    luks_pw=$(prompt_password "[2/4] Encryption · LUKS2 passphrase (min 8)") || return 1
+    luks_pw=$(prompt_password "[2/3] Encryption · LUKS2 passphrase (min 8)") || return 1
     validate_pw "$luks_pw" "passphrase" || return 1
 
     # ── Admin password ──
-    admin_pw=$(prompt_password "[3/4] Admin user · password for 'admin'") || return 1
+    admin_pw=$(prompt_password "[3/3] Admin user · password for 'admin'") || return 1
     validate_pw "$admin_pw" "password" || return 1
 
     # ── Locale ──
-    locale=$(prompt_choose "[4/4] Locale" \
-        "en_GB.UTF-8" \
-        "en_US.UTF-8") || return 1
+    # Hardcoded en_US.UTF-8 for branded consistency. The picker that
+    # used to live here (en_GB / en_US) only added confusion — both
+    # locales install identically, the user couldn't notice the
+    # difference, and the post-install `localectl set-locale` works for
+    # any locale anyway. v0.7 post-install menu will offer locale + kb
+    # layout switch with live preview. For the install flow, fixed.
+    locale="en_US.UTF-8"
 
     # ── Confirmation ──
     # Render summary box + danger lines via gum style, then gum confirm.