diff --git a/overlay/usr/local/bin/veilor-installer b/overlay/usr/local/bin/veilor-installer
index f698aff..e1b6acc 100644
--- a/overlay/usr/local/bin/veilor-installer
+++ b/overlay/usr/local/bin/veilor-installer
@@ -504,12 +504,23 @@ bash $REPO/scripts/kde-theme-apply.sh
 # Mask plymouth services. Plymouth boot splash is unreliable in QEMU
 # (race between plymouth-start and systemd-ask-password-plymouth.path
 # leaves LUKS prompt invisible → boot hangs in dracut-initqueue).
-# Disabled at kernel-cmdline level (plymouth.enable=0 rd.plymouth=0)
-# but services still register; mask them to prevent any startup attempt.
-# LUKS prompt falls back to systemd-tty-ask-password-agent on tty1.
-systemctl mask plymouth-start.service plymouth-quit.service \
-    plymouth-quit-wait.service plymouth-read-write.service \
-    plymouth-switch-root.service 2>/dev/null || true
+# `systemctl mask` requires systemd running, which isn't true in
+# anaconda chroot %post — write the /dev/null symlinks directly instead.
+# Targets the path-activated ask-password unit too (the .path is what
+# plymouth-start gets pulled in by). systemd-tty-ask-password-agent
+# handles LUKS prompt as fallback on tty1.
+mkdir -p /etc/systemd/system
+for unit in \
+    plymouth-start.service \
+    plymouth-quit.service \
+    plymouth-quit-wait.service \
+    plymouth-read-write.service \
+    plymouth-switch-root.service \
+    systemd-ask-password-plymouth.path \
+    systemd-ask-password-plymouth.service \
+    ; do
+    ln -sf /dev/null /etc/systemd/system/$unit
+done
 
 # Symlink display-manager.service → sddm.service. (Anaconda usually
 # handles this when sddm is the only DM, but be explicit.)