diff --git a/overlay/usr/local/bin/veilor-installer b/overlay/usr/local/bin/veilor-installer
index 87299b6..f698aff 100644
--- a/overlay/usr/local/bin/veilor-installer
+++ b/overlay/usr/local/bin/veilor-installer
@@ -501,6 +501,16 @@ bash $REPO/scripts/selinux/build-policy.sh || echo "[WARN] SELinux build failed;
 # Apply KDE theme + DuckSans + os-release branding
 bash $REPO/scripts/kde-theme-apply.sh
 
+# Mask plymouth services. Plymouth boot splash is unreliable in QEMU
+# (race between plymouth-start and systemd-ask-password-plymouth.path
+# leaves LUKS prompt invisible → boot hangs in dracut-initqueue).
+# Disabled at kernel-cmdline level (plymouth.enable=0 rd.plymouth=0)
+# but services still register; mask them to prevent any startup attempt.
+# LUKS prompt falls back to systemd-tty-ask-password-agent on tty1.
+systemctl mask plymouth-start.service plymouth-quit.service \
+    plymouth-quit-wait.service plymouth-read-write.service \
+    plymouth-switch-root.service 2>/dev/null || true
+
 # Symlink display-manager.service → sddm.service. (Anaconda usually
 # handles this when sddm is the only DM, but be explicit.)
 ln -sf /usr/lib/systemd/system/sddm.service /etc/systemd/system/display-manager.service