diff --git a/install/config/all.sh b/install/config/all.sh
index 5e6fb924..f6eeb879 100644
--- a/install/config/all.sh
+++ b/install/config/all.sh
@@ -22,15 +22,16 @@ run_logged $OMARCHY_INSTALL/config/input-group.sh
 run_logged $OMARCHY_INSTALL/config/omarchy-ai-skill.sh
 run_logged $OMARCHY_INSTALL/config/pi.sh
 run_logged $OMARCHY_INSTALL/config/omarchy-toggles.sh
-run_logged $OMARCHY_INSTALL/config/kernel-modules-hook.sh
 run_logged $OMARCHY_INSTALL/config/powerprofilesctl-rules.sh
 run_logged $OMARCHY_INSTALL/config/wifi-powersave-rules.sh
 
+# Service enables centralized; run after all drop-in files are in place.
+run_logged $OMARCHY_INSTALL/config/enable-services.sh
+
 run_logged $OMARCHY_INSTALL/config/hardware/network.sh
 run_logged $OMARCHY_INSTALL/config/hardware/set-wireless-regdom.sh
 run_logged $OMARCHY_INSTALL/config/hardware/fix-fkeys.sh
 run_logged $OMARCHY_INSTALL/config/hardware/bluetooth.sh
-run_logged $OMARCHY_INSTALL/config/hardware/printer.sh
 run_logged $OMARCHY_INSTALL/config/hardware/nvidia.sh
 run_logged $OMARCHY_INSTALL/config/hardware/vulkan.sh
 
diff --git a/install/config/docker.sh b/install/config/docker.sh
index 8757d6cf..12f0bffc 100644
--- a/install/config/docker.sh
+++ b/install/config/docker.sh
@@ -1,10 +1,7 @@
-# Docker config files (daemon.json, resolved drop-in, no-block-boot drop-in)
-# ship via omarchy-settings. This script only handles the runtime side:
-# - reload systemd-resolved so the new drop-in takes effect
-# - add the current user to the docker group
-# - enable docker.socket and reload systemd unit files
-
+# Docker config files ship via omarchy-settings. This script only handles
+# runtime side: reload systemd-resolved so the new drop-in takes effect and
+# add the current user to the docker group. docker.socket enable lives in
+# install/config/enable-services.sh.
 sudo systemctl restart systemd-resolved
-sudo systemctl enable docker.socket
 sudo usermod -aG docker ${USER}
 sudo systemctl daemon-reload
diff --git a/install/config/enable-services.sh b/install/config/enable-services.sh
new file mode 100644
index 00000000..9cb6d924
--- /dev/null
+++ b/install/config/enable-services.sh
@@ -0,0 +1,12 @@
+# Central place for unconditional, safe-to-start-now service enables.
+# Services that should NOT be started during install (sddm, ufw) live in
+# their own scripts. Hardware-gated services (t2fanrd, intel_lpmd,
+# thermald, omarchy-nvme-suspend-fix) also live with their detection.
+chrootable_systemctl_enable bluetooth.service
+chrootable_systemctl_enable cups.service
+chrootable_systemctl_enable cups-browsed.service
+chrootable_systemctl_enable avahi-daemon.service
+chrootable_systemctl_enable docker.socket
+chrootable_systemctl_enable iwd.service
+chrootable_systemctl_enable linux-modules-cleanup.service
+chrootable_systemctl_enable power-profiles-daemon.service
diff --git a/install/config/hardware/bluetooth.sh b/install/config/hardware/bluetooth.sh
index c93379e3..058bd22d 100644
--- a/install/config/hardware/bluetooth.sh
+++ b/install/config/hardware/bluetooth.sh
@@ -1,5 +1,4 @@
-# Turn on bluetooth by default
-chrootable_systemctl_enable bluetooth.service
+# bluetooth.service enable lives in install/config/enable-services.sh.
 
 # Persist last power state across reboots (default AutoEnable=true overrides it)
 sudo sed -i 's/^#\?AutoEnable=.*/AutoEnable=false/' /etc/bluetooth/main.conf
diff --git a/install/config/hardware/printer.sh b/install/config/hardware/printer.sh
deleted file mode 100644
index 8dfb7f1a..00000000
--- a/install/config/hardware/printer.sh
+++ /dev/null
@@ -1,9 +0,0 @@
-# Printer config files now ship via omarchy-settings:
-# - etc/systemd/resolved.conf.d/10-disable-multicast.conf (package-owned drop-in)
-# - etc/nsswitch.conf (etc-overrides, replaces the previous in-place sed)
-# - etc/cups/cups-browsed.conf (etc-overrides, replaces the previous append)
-#
-# This script only handles service enables, which the configurator path needs.
-chrootable_systemctl_enable cups.service
-chrootable_systemctl_enable avahi-daemon.service
-chrootable_systemctl_enable cups-browsed.service
diff --git a/install/config/kernel-modules-hook.sh b/install/config/kernel-modules-hook.sh
deleted file mode 100644
index 29d0ec4d..00000000
--- a/install/config/kernel-modules-hook.sh
+++ /dev/null
@@ -1 +0,0 @@
-chrootable_systemctl_enable linux-modules-cleanup.service
diff --git a/install/config/powerprofilesctl-rules.sh b/install/config/powerprofilesctl-rules.sh
index d23e4a9b..6fa641f9 100644
--- a/install/config/powerprofilesctl-rules.sh
+++ b/install/config/powerprofilesctl-rules.sh
@@ -1,9 +1,8 @@
 # The udev rule (/etc/udev/rules.d/99-omarchy-power-profile.rules) ships via
-# omarchy-settings. This script handles the runtime side: enable the service
-# the rule's RUN+= chains through, and reload udev so the new rule takes effect.
-# Also remove the pre-rename legacy path in case the old installer ran since
-# the one-shot migration completed (idempotency for re-install/downgrade tests).
+# omarchy-settings. power-profiles-daemon.service enable lives in
+# install/config/enable-services.sh. This script just reloads udev so the
+# rule takes effect and removes the pre-rename legacy path (idempotent for
+# re-install/downgrade tests).
 sudo rm -f /etc/udev/rules.d/99-power-profile.rules
-sudo systemctl enable power-profiles-daemon
 sudo udevadm control --reload 2>/dev/null
 sudo udevadm trigger --subsystem-match=power_supply 2>/dev/null