diff --git a/configs/airootfs/usr/share/omarchy-iso/orchestrator/phases_impl.py b/configs/airootfs/usr/share/omarchy-iso/orchestrator/phases_impl.py
index f723dde..fe975ef 100644
--- a/configs/airootfs/usr/share/omarchy-iso/orchestrator/phases_impl.py
+++ b/configs/airootfs/usr/share/omarchy-iso/orchestrator/phases_impl.py
@@ -158,12 +158,13 @@ def _early_packages() -> list[str]:
 # configurator output.
 #
 # The live pacman keyring is deliberately NOT waited on. The offline repo is
-# SigLevel = Optional TrustAll and archinstall bootstraps with pacstrap -K,
-# which initializes an independent keyring inside the target, so no install
-# step consults the live keyring. archiso's boot-time pacman-init.service
+# SigLevel = Never (see configs/pacman-offline.conf for why that is required:
+# pacstrap verifies against the LIVE GpgDir, so anything short of Never makes
+# installs depend on archiso's boot-time pacman-init.service). That service
 # (gpg key generation + populating every keyring, Type=oneshot with no start
 # timeout) can take minutes on real hardware reading from USB — blocking on
-# it here stalled installs at 5% while it ground away in the background.
+# it here stalled installs at 5% while it ground away in the background, and
+# racing it failed pacstrap with "required key missing from keyring".
 #
 # archinstall is patched in the wrapper (omarchy-iso-install) BEFORE Python
 # imports it, so no patching happens here.
diff --git a/configs/pacman-offline.conf b/configs/pacman-offline.conf
index 45051ad..1ee0fd1 100644
--- a/configs/pacman-offline.conf
+++ b/configs/pacman-offline.conf
@@ -13,6 +13,13 @@ ParallelDownloads = 5
 SigLevel    = Required DatabaseOptional
 LocalFileSigLevel = Optional
 
+# No signature checks for the offline mirror: it ships inside the ISO, whose
+# integrity is already covered by the airootfs sha512 and the ISO signature.
+# "Optional TrustAll" is NOT a bypass — Optional verifies whenever a .sig file
+# exists (they all do), and pacstrap verifies against the LIVE keyring (pacman
+# -r relocates the root but not GpgDir). That made installs depend on archiso's
+# slow boot-time pacman-init.service having finished, which stalled or failed
+# pacstrap on real hardware with "required key missing from keyring".
 [offline]
-SigLevel = Optional TrustAll
+SigLevel = Never
 Server = file:///var/cache/omarchy/mirror/offline/