diff --git a/config/systemd/user/graphical-session.target.wants/bt-agent.service b/config/systemd/user/graphical-session.target.wants/bt-agent.service
new file mode 120000
index 00000000..90bbe80a
--- /dev/null
+++ b/config/systemd/user/graphical-session.target.wants/bt-agent.service
@@ -0,0 +1 @@
+../bt-agent.service
\ No newline at end of file
diff --git a/config/systemd/user/graphical-session.target.wants/omarchy-sleep-lock.service b/config/systemd/user/graphical-session.target.wants/omarchy-sleep-lock.service
new file mode 120000
index 00000000..2a00b842
--- /dev/null
+++ b/config/systemd/user/graphical-session.target.wants/omarchy-sleep-lock.service
@@ -0,0 +1 @@
+../omarchy-sleep-lock.service
\ No newline at end of file
diff --git a/etc/sddm.conf.d/10-theme.conf b/etc/sddm.conf.d/10-theme.conf
new file mode 100644
index 00000000..5c9cef9b
--- /dev/null
+++ b/etc/sddm.conf.d/10-theme.conf
@@ -0,0 +1,2 @@
+[Theme]
+Current=omarchy
diff --git a/etc/sddm.conf.d/10-wayland.conf b/etc/sddm.conf.d/10-wayland.conf
new file mode 100644
index 00000000..2ecb22e8
--- /dev/null
+++ b/etc/sddm.conf.d/10-wayland.conf
@@ -0,0 +1,5 @@
+[General]
+DisplayServer=wayland
+
+[Wayland]
+CompositorCommand=start-hyprland -- --config /usr/share/sddm/hyprland.lua
diff --git a/etc/systemd/system.conf.d/20-omarchy-nofile.conf b/etc/systemd/system.conf.d/20-omarchy-nofile.conf
new file mode 100644
index 00000000..663a249d
--- /dev/null
+++ b/etc/systemd/system.conf.d/20-omarchy-nofile.conf
@@ -0,0 +1,2 @@
+[Manager]
+DefaultLimitNOFILE=65536:524288
diff --git a/etc/systemd/user.conf.d/20-omarchy-nofile.conf b/etc/systemd/user.conf.d/20-omarchy-nofile.conf
new file mode 100644
index 00000000..663a249d
--- /dev/null
+++ b/etc/systemd/user.conf.d/20-omarchy-nofile.conf
@@ -0,0 +1,2 @@
+[Manager]
+DefaultLimitNOFILE=65536:524288
diff --git a/install/config/hardware/bluetooth-user.sh b/install/config/hardware/bluetooth-user.sh
new file mode 100644
index 00000000..7962cfe9
--- /dev/null
+++ b/install/config/hardware/bluetooth-user.sh
@@ -0,0 +1,9 @@
+mkdir -p ~/.config/wireplumber/wireplumber.conf.d/
+cp "$OMARCHY_PATH/default/wireplumber/wireplumber.conf.d/bluetooth-a2dp-autoconnect.conf" ~/.config/wireplumber/wireplumber.conf.d/
+
+# Quickshell.Bluetooth has no Agent API, so the omarchy.bluetooth plugin
+# can't answer the auth prompts bluez issues during pair(). bt-agent registers
+# a NoInputNoOutput agent on the system bus so pair() actually completes.
+mkdir -p ~/.config/systemd/user/
+cp "$OMARCHY_PATH/config/systemd/user/bt-agent.service" ~/.config/systemd/user/
+systemctl --user enable bt-agent.service
diff --git a/install/config/hardware/nvidia-user.sh b/install/config/hardware/nvidia-user.sh
new file mode 100644
index 00000000..e604f1db
--- /dev/null
+++ b/install/config/hardware/nvidia-user.sh
@@ -0,0 +1,21 @@
+envs="$HOME/.config/hypr/envs.lua"
+[[ -f $envs ]] || exit 0
+
+if lspci | grep -qi 'nvidia'; then
+  if omarchy-hw-nvidia-gsp && ! grep -q 'NVIDIA (Turing+ with GSP firmware)' "$envs"; then
+    cat >>"$envs" <<'EOF'
+
+-- NVIDIA (Turing+ with GSP firmware)
+hl.env("NVD_BACKEND", "direct")
+hl.env("LIBVA_DRIVER_NAME", "nvidia")
+hl.env("__GLX_VENDOR_LIBRARY_NAME", "nvidia")
+EOF
+  elif omarchy-hw-nvidia-without-gsp && ! grep -q 'NVIDIA (Maxwell/Pascal/Volta without GSP firmware)' "$envs"; then
+    cat >>"$envs" <<'EOF'
+
+-- NVIDIA (Maxwell/Pascal/Volta without GSP firmware)
+hl.env("NVD_BACKEND", "egl")
+hl.env("__GLX_VENDOR_LIBRARY_NAME", "nvidia")
+EOF
+  fi
+fi
diff --git a/install/config/theme-system.sh b/install/config/theme-system.sh
new file mode 100644
index 00000000..15d2d2b4
--- /dev/null
+++ b/install/config/theme-system.sh
@@ -0,0 +1,15 @@
+# Set links for Nautilus action icons
+mkdir -p /usr/share/icons/Yaru/scalable/actions
+ln -snf /usr/share/icons/Adwaita/symbolic/actions/go-previous-symbolic.svg \
+          /usr/share/icons/Yaru/scalable/actions/go-previous-symbolic.svg
+ln -snf /usr/share/icons/Adwaita/symbolic/actions/go-next-symbolic.svg \
+          /usr/share/icons/Yaru/scalable/actions/go-next-symbolic.svg
+
+# Chromium policy directory for theme
+mkdir -p /etc/chromium/policies/managed
+chmod a+rw /etc/chromium/policies/managed
+
+# Default Chromium to follow system appearance ("device") instead of dark
+mkdir -p /usr/lib/chromium
+echo '{"browser":{"theme":{"color_scheme":0,"color_scheme2":0}}}' > \
+  /usr/lib/chromium/initial_preferences
diff --git a/install/config/theme-user.sh b/install/config/theme-user.sh
new file mode 100644
index 00000000..c5a79394
--- /dev/null
+++ b/install/config/theme-user.sh
@@ -0,0 +1,16 @@
+# Setup user theme folder
+mkdir -p ~/.config/omarchy/themes
+
+# Set initial theme. Offline ISO installs only need the user's theme files and
+# symlinks seeded; there is no running desktop/session bus in the chroot, so
+# skip shell IPC, dconf, app retint hooks, and background transition work.
+if install_mode_is offline; then
+  OMARCHY_THEME_OFFLINE=1 OMARCHY_THEME_SKIP_BACKGROUND=1 omarchy-theme-set "Tokyo Night"
+else
+  omarchy-theme-set "Tokyo Night"
+fi
+rm -rf ~/.config/chromium/SingletonLock # otherwise archiso will own the chromium singleton
+
+# Set specific app links for current theme
+mkdir -p ~/.config/btop/themes
+ln -snf ~/.config/omarchy/current/theme/btop.theme ~/.config/btop/themes/current.theme
diff --git a/install/config/user.sh b/install/config/user.sh
new file mode 100644
index 00000000..4e5602ad
--- /dev/null
+++ b/install/config/user.sh
@@ -0,0 +1,10 @@
+run_logged $OMARCHY_INSTALL/config/theme-user.sh
+run_logged $OMARCHY_INSTALL/config/git.sh
+run_logged $OMARCHY_INSTALL/config/xcompose.sh
+run_logged $OMARCHY_INSTALL/config/mise-work.sh
+run_logged $OMARCHY_INSTALL/config/sleep-lock.sh
+run_logged $OMARCHY_INSTALL/config/hardware/bluetooth-user.sh
+run_logged $OMARCHY_INSTALL/config/hardware/asus/fix-audio-mixer.sh
+run_logged $OMARCHY_INSTALL/config/hardware/asus/fix-mic.sh
+run_logged $OMARCHY_INSTALL/config/hardware/framework/fix-f13-amd-audio-input.sh
+run_logged $OMARCHY_INSTALL/config/hardware/nvidia-user.sh
diff --git a/install/first-run/gnome-theme-system.sh b/install/first-run/gnome-theme-system.sh
new file mode 100644
index 00000000..28c2a137
--- /dev/null
+++ b/install/first-run/gnome-theme-system.sh
@@ -0,0 +1 @@
+sudo gtk-update-icon-cache /usr/share/icons/Yaru
diff --git a/install/first-run/gnome-theme-user.sh b/install/first-run/gnome-theme-user.sh
new file mode 100644
index 00000000..52082d59
--- /dev/null
+++ b/install/first-run/gnome-theme-user.sh
@@ -0,0 +1,3 @@
+gsettings set org.gnome.desktop.interface gtk-theme "Adwaita-dark"
+gsettings set org.gnome.desktop.interface color-scheme "prefer-dark"
+gsettings set org.gnome.desktop.interface icon-theme "Yaru-blue"
diff --git a/install/login/system.sh b/install/login/system.sh
new file mode 100644
index 00000000..7303c80e
--- /dev/null
+++ b/install/login/system.sh
@@ -0,0 +1,5 @@
+run_logged $OMARCHY_INSTALL/login/sddm.sh
+if install_mode_is online; then
+  run_logged $OMARCHY_INSTALL/login/hibernation.sh
+fi
+run_logged $OMARCHY_INSTALL/login/limine-snapper.sh
diff --git a/install/packaging/system.sh b/install/packaging/system.sh
new file mode 100644
index 00000000..1486cfe1
--- /dev/null
+++ b/install/packaging/system.sh
@@ -0,0 +1,4 @@
+run_logged $OMARCHY_INSTALL/packaging/asus-rog.sh
+run_logged $OMARCHY_INSTALL/packaging/framework16.sh
+run_logged $OMARCHY_INSTALL/packaging/dell-xps-touchpad-haptics.sh
+run_logged $OMARCHY_INSTALL/packaging/surface.sh
diff --git a/install/packaging/user.sh b/install/packaging/user.sh
new file mode 100644
index 00000000..0489e75d
--- /dev/null
+++ b/install/packaging/user.sh
@@ -0,0 +1 @@
+run_logged $OMARCHY_INSTALL/packaging/nvim.sh
diff --git a/install/post-install/first-run-mode.sh b/install/post-install/first-run-mode.sh
new file mode 100644
index 00000000..b5cd9813
--- /dev/null
+++ b/install/post-install/first-run-mode.sh
@@ -0,0 +1,19 @@
+# Setup sudo-less access for the privileged first-run system one-shot. The
+# install user's ~/.local/state/omarchy/first-run.mode marker is created by
+# finalize.sh while running as that user.
+install_user="${OMARCHY_INSTALL_USER:-${USER:-}}"
+install_mode_is offline || exit 0
+[[ -n $install_user ]] || exit 0
+
+mkdir -p /etc/sudoers.d
+cat > /etc/sudoers.d/first-run <<EOF
+Cmnd_Alias FIRST_RUN_CLEANUP = /bin/rm -f /etc/sudoers.d/first-run
+Cmnd_Alias SYMLINK_RESOLVED = /usr/bin/ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
+$install_user ALL=(ALL) NOPASSWD: /usr/bin/systemctl
+$install_user ALL=(ALL) NOPASSWD: /usr/bin/ufw
+$install_user ALL=(ALL) NOPASSWD: /usr/bin/ufw-docker
+$install_user ALL=(ALL) NOPASSWD: /usr/bin/gtk-update-icon-cache
+$install_user ALL=(ALL) NOPASSWD: SYMLINK_RESOLVED
+$install_user ALL=(ALL) NOPASSWD: FIRST_RUN_CLEANUP
+EOF
+chmod 440 /etc/sudoers.d/first-run
diff --git a/install/post-install/legacy-cleanup.sh b/install/post-install/legacy-cleanup.sh
new file mode 100644
index 00000000..ba673f1d
--- /dev/null
+++ b/install/post-install/legacy-cleanup.sh
@@ -0,0 +1,5 @@
+# Remove legacy paths replaced by package-owned Omarchy defaults.
+rm -f /etc/udev/rules.d/99-power-profile.rules
+rm -f /etc/udev/rules.d/99-wifi-powersave.rules
+rm -f /etc/systemd/system.conf.d/99-omarchy-nofile.conf
+rm -f /etc/systemd/user.conf.d/99-omarchy-nofile.conf
diff --git a/install/post-install/localdb.sh b/install/post-install/localdb.sh
new file mode 100644
index 00000000..635cf613
--- /dev/null
+++ b/install/post-install/localdb.sh
@@ -0,0 +1,4 @@
+# Update localdb so locate can find the installed system files immediately.
+if omarchy-cmd-present updatedb; then
+  updatedb
+fi
diff --git a/install/post-install/system.sh b/install/post-install/system.sh
new file mode 100644
index 00000000..2ac3a0d8
--- /dev/null
+++ b/install/post-install/system.sh
@@ -0,0 +1,8 @@
+run_logged $OMARCHY_INSTALL/post-install/first-run-mode.sh
+run_logged $OMARCHY_INSTALL/post-install/pacman.sh
+run_logged $OMARCHY_INSTALL/post-install/legacy-cleanup.sh
+run_logged $OMARCHY_INSTALL/post-install/udev.sh
+run_logged $OMARCHY_INSTALL/post-install/localdb.sh
+if install_mode_is online; then
+  run_logged $OMARCHY_INSTALL/post-install/allow-reboot.sh
+fi
diff --git a/install/post-install/udev.sh b/install/post-install/udev.sh
new file mode 100644
index 00000000..ffb0da18
--- /dev/null
+++ b/install/post-install/udev.sh
@@ -0,0 +1,3 @@
+# Apply package-owned udev rules for the live install session when possible.
+udevadm control --reload 2>/dev/null || true
+udevadm trigger --subsystem-match=power_supply 2>/dev/null || true
diff --git a/install/system/all.sh b/install/system/all.sh
new file mode 100644
index 00000000..161f42ea
--- /dev/null
+++ b/install/system/all.sh
@@ -0,0 +1,6 @@
+# System-level install work. Keep the actual logic in the same atomic
+# packaging/config/login/post-install scripts used by the online installer.
+source $OMARCHY_INSTALL/packaging/system.sh
+source $OMARCHY_INSTALL/config/all.sh
+source $OMARCHY_INSTALL/login/system.sh
+source $OMARCHY_INSTALL/post-install/system.sh
diff --git a/install/user/all.sh b/install/user/all.sh
new file mode 100644
index 00000000..563c0bd7
--- /dev/null
+++ b/install/user/all.sh
@@ -0,0 +1,3 @@
+source $OMARCHY_INSTALL/packaging/user.sh
+source $OMARCHY_INSTALL/config/user.sh
+run_logged $OMARCHY_INSTALL/login/default-keyring.sh
diff --git a/system-finalize.sh b/system-finalize.sh
new file mode 100755
index 00000000..3c554b42
--- /dev/null
+++ b/system-finalize.sh
@@ -0,0 +1,26 @@
+#!/bin/bash
+#
+# System-level Omarchy install work. This intentionally runs as root inside
+# the target system. User-home setup stays in finalize.sh.
+
+export OMARCHY_INSTALL_LOG_FILE="${OMARCHY_INSTALL_LOG_FILE:-/var/log/omarchy-install.log}"
+
+set -eEo pipefail
+
+_OMARCHY_INSTALLER_DIR=$(dirname "$(realpath "${BASH_SOURCE[0]}")")
+export OMARCHY_PATH="${OMARCHY_PATH:-$_OMARCHY_INSTALLER_DIR}"
+export OMARCHY_INSTALL="${OMARCHY_INSTALL:-$_OMARCHY_INSTALLER_DIR/install}"
+export PATH="${OMARCHY_PATH}/bin:$_OMARCHY_INSTALLER_DIR/bin:$PATH"
+
+source "$OMARCHY_INSTALL/helpers/mode.sh"
+detect_install_mode
+export_legacy_mode_flags
+source "$OMARCHY_INSTALL/helpers/chroot.sh"
+source "$OMARCHY_INSTALL/helpers/logging.sh"
+
+if (( EUID != 0 )); then
+  echo "Error: system-finalize.sh must run as root" >&2
+  exit 1
+fi
+
+source "$OMARCHY_INSTALL/system/all.sh"