diff --git a/kickstart/veilor-os.ks b/kickstart/veilor-os.ks
index d97ab5c..5a88323 100644
--- a/kickstart/veilor-os.ks
+++ b/kickstart/veilor-os.ks
@@ -221,13 +221,21 @@ bash $REPO/scripts/kde-theme-apply.sh
 # Force admin password set on first boot.
 # livecd-creator does NOT honor `user` kickstart directive (it's a LIVE
 # image, no installer step). Create admin manually in chroot %post.
+# Note: SDDM rejects blank passwords by default (PAM nullok off), so we
+# set throwaway pw `veilor` + chage -d 0 to force reset on first login.
 if ! getent passwd admin >/dev/null; then
     useradd -m -G wheel -s /bin/bash -c "veilor admin" admin
-    passwd -d admin           # blank password
-    chage -d 0 admin          # expire → forced reset on first login
-    echo "[INFO] admin user created (blank password, expired)"
+    echo 'admin:veilor' | chpasswd
+    chage -d 0 admin
+    echo "[INFO] admin user created (default pw=veilor, expired)"
 fi
 
+# Symlink display-manager.service → sddm.service. graphical.target Wants=
+# display-manager but the alias doesn't get auto-created when sddm package
+# is installed via livecd-creator (vs Anaconda installer which handles it).
+# Without this, sddm stays inactive even though enabled.
+ln -sf /usr/lib/systemd/system/sddm.service /etc/systemd/system/display-manager.service
+
 # zram swap (no disk swap; keys never leak to platter)
 dnf install -y zram-generator || true
 cat > /etc/systemd/zram-generator.conf << 'EOF'