diff --git a/pkgbuilds/omarchy-mac-boot/PKGBUILD b/pkgbuilds/omarchy-mac-boot/PKGBUILD
index 184a6b97..65ea8a65 100644
--- a/pkgbuilds/omarchy-mac-boot/PKGBUILD
+++ b/pkgbuilds/omarchy-mac-boot/PKGBUILD
@@ -8,7 +8,7 @@ pkgname=omarchy-mac-boot
 # 20260921-N. Reset pkgrel to 1 when pkgver changes; bump it to re-pin or
 # rebuild on the same day.
 pkgver=20260925
-pkgrel=3
+pkgrel=4
 pkgdesc='Apple Silicon boot support for Omarchy: initramfs, in-place encryption, first boot and Limine activation'
 arch=('aarch64')
 groups=('omarchy-platform-apple-silicon')
@@ -20,9 +20,9 @@ conflicts=('omarchy-apple-boot' 'omarchy-first-boot')
 replaces=('omarchy-apple-boot' 'omarchy-first-boot')
 install=omarchy-mac-boot.install
 # An exact omarchy-mac commit, never a branch.
-_commit=f7ea7ecc804a133e1afe571b708458a6d71db77d
+_commit=84352fdb8fd03d149682ac54466b1a1add176f84
 source=("omarchy-mac::git+https://github.com/omacom/omarchy-mac.git#commit=${_commit}")
-sha256sums=('b14b862e8f22cb7db49afcf7e380bc92d532967cc0edef72adfda54a1eb5605b')
+sha256sums=('06514d03eef7e8468277ae97c3258bc595f307aa0cf3356d3f71cfb6b0d14fe2')
 
 prepare() {
   # Tests and staging must not be able to read the surrounding desktop source.
@@ -41,8 +41,8 @@ package() {
   # desktop or a boot chain. 1.39.0-2 is the first limine-mkinitcpio-hook that
   # leaves a Mac's /boot to mkinitcpio until Limine is activated.
   depends=('omarchy' 'limine' 'limine-mkinitcpio-hook>=1.39.0-2' 'limine-snapper-sync' 'asahi-scripts'
-           'bash' 'btrfs-progs' 'coreutils' 'cpio' 'cryptsetup' 'diffutils' 'gawk' 'gnupg' 'grep' 'gum'
-           'gzip' 'kbd' 'mkinitcpio' 'sed' 'systemd' 'util-linux')
+           'bash' 'binutils' 'btrfs-progs' 'coreutils' 'cpio' 'cryptsetup' 'diffutils' 'gawk' 'gnupg' 'grep'
+           'gum' 'gzip' 'kbd' 'mkinitcpio' 'sed' 'systemd' 'util-linux')
 
   "$srcdir/boot/install" "$pkgdir"
   # Once the source drops its own Plymouth fragment (omacom/omarchy-mac#544),
@@ -56,7 +56,7 @@ package() {
     depends+=('omarchy-mkinitcpio-hooks-baseline')
   printf '%s\n' "$_commit" | install -Dm644 /dev/stdin "$pkgdir/usr/share/omarchy-mac/boot-source-revision"
 
-  # Administrator-editable: every /etc path and the initramfs helpers an image
+  # Administrator-editable: every /etc file and the initramfs helpers an image
   # may rewrite.
   mapfile -t backup < <(cd "$pkgdir" && find etc usr/lib/omarchy/initcpio -type f | sort)
 }
diff --git a/pkgbuilds/omarchy-mac-boot/README.md b/pkgbuilds/omarchy-mac-boot/README.md
index 83076db0..269b37de 100644
--- a/pkgbuilds/omarchy-mac-boot/README.md
+++ b/pkgbuilds/omarchy-mac-boot/README.md
@@ -20,12 +20,13 @@ A new pin publishes on merge, so check what the pinned source needs first:
 
 - **Settings baseline.** A pin that includes omacom/omarchy-mac#544 (no `93-omarchy-mac-plymouth.conf`) needs omarchy-settings with the HOOKS baseline (omacom/omarchy-mac#542) published on aarch64, and providing `omarchy-mkinitcpio-hooks-baseline`. Publish that first; otherwise this build cannot be installed.
 - **Update verification.** A pin that includes omacom/omarchy-mac#543 (`/usr/lib/omarchy/mac-boot/update-verify`) must publish before any runtime that carries #543. Otherwise that runtime blocks every update on Macs whose `omarchy-mac-boot` predates it.
+- **Reset and key-slot entrypoints.** A pin that includes omacom/omarchy-mac#552 (`reset-prepare`, `reset-verify`, `reset-commit`, `reset-rollback`) and #553 (`luks-slots`) must publish before any runtime that carries them. That runtime's `omarchy-lifecycle-dispatch` requires them on Apple Silicon, so otherwise factory reset, owner setup and `omarchy-drive-password` on the system disk fail on Macs whose `omarchy-mac-boot` predates them.
 
 ## Transition
 
 - It provides, conflicts with and replaces `omarchy-apple-boot` and `omarchy-first-boot`. The scriptlet moves a pending `omarchy-first-boot` marker to `omarchy-mac-first-boot`, drops the replaced unit's dangling enable link and points at a customised `90-omarchy-asahi.conf.pacsave`.
 - `pkgver` is the UTC commit date of the pin, so any pin from `20260925` on upgrades the fork's `20260921-10` on mx-mac Macs. The files the fork shipped that the source no longer does (the image finalize tools, the upstream ARM repository key and the GRUB snapshot-menu hook) are removed by that upgrade.
-- `backup=` covers every `/etc` path and `/usr/lib/omarchy/initcpio`. It includes `/etc/default/update-m1n1`, which pins update-m1n1's device-tree order to the C locale. On a Mac that already has its own unowned copy, pacman keeps it and installs the shipped one as `.pacnew`.
+- `backup=` covers every `/etc` file and `/usr/lib/omarchy/initcpio`. It includes `/etc/default/update-m1n1`, which pins update-m1n1's device-tree order to the C locale. On a Mac that already has its own unowned copy, pacman keeps it and installs the shipped one as `.pacnew`. The snapshot restore hooks in `/etc/boot/hooks` are symlinks to `/usr/bin/omarchy-mac-snapshot-check`, not files, so they stay out of it.
 
 ## Updates