diff --git a/finalize.sh b/finalize.sh
index 6f201df1..02862518 100644
--- a/finalize.sh
+++ b/finalize.sh
@@ -1,16 +1,10 @@
 #!/bin/bash
 #
-# The in-target portion of an Omarchy install: preflight checks, package-level
-# setup, system configuration, login wiring, post-install steps. Run AFTER the
-# orchestrator (offline mode) or install.sh (online mode) has ensured the
-# omarchy runtime + omarchy-base.packages set is already installed.
-#
-# Called by:
-#   - install.sh (online mode, after pacman -Syu)
-#   - orchestrator/main.py (offline mode, via arch-chroot -u $USER)
-#
-# Anything that *must* happen as root pre-user lives in the orchestrator; this
-# script runs as the install user.
+# The in-target portion of an Omarchy install: package-level setup, system
+# configuration, login wiring, post-install. Self-contained — works whether
+# invoked by install.sh (online) or by the Python orchestrator (offline, via
+# arch-chroot). The caller is responsible for system sanity checks (guards),
+# UI styling, and log capture.
 
 set -eEo pipefail
 
@@ -26,7 +20,13 @@ export_legacy_mode_flags
 
 source "$OMARCHY_INSTALL/helpers/all.sh"
 
-source "$OMARCHY_INSTALL/preflight/all.sh"
+# Mark every shipped migration as "done" so future updates only run the new
+# ones. Idempotent; safe to re-run.
+mkdir -p ~/.local/state/omarchy/migrations
+for _f in "$OMARCHY_PATH/migrations"/*.sh; do
+  [[ -f $_f ]] && touch ~/.local/state/omarchy/migrations/"$(basename "$_f")"
+done
+
 source "$OMARCHY_INSTALL/packaging/all.sh"
 source "$OMARCHY_INSTALL/config/all.sh"
 source "$OMARCHY_INSTALL/login/all.sh"
diff --git a/install.sh b/install.sh
index d2a358bb..cfbaf05a 100644
--- a/install.sh
+++ b/install.sh
@@ -1,12 +1,12 @@
 #!/bin/bash
 #
-# Online install entry point. Run by the user on an existing system to install
-# / refresh Omarchy. Ensures the omarchy runtime + omarchy-base.packages set
-# is up to date, then hands off to finalize.sh for the actual configure work.
+# Online install entry point. Run by the user on an existing Arch system to
+# install / refresh Omarchy. Guards the host, ensures the omarchy runtime is
+# up to date, then hands off to finalize.sh for the actual configure work.
 #
 # Offline installs (from the ISO) skip this script entirely: the Python
-# orchestrator handles partitioning, base install, package install, then calls
-# finalize.sh directly inside the chroot.
+# orchestrator owns disk, base, bootloader, and package install before calling
+# finalize.sh directly in the chroot.
 
 set -eEo pipefail
 
@@ -22,18 +22,17 @@ export_legacy_mode_flags
 
 source "$OMARCHY_INSTALL/helpers/all.sh"
 
-# The finalize scripts assume the omarchy runtime + the default install set are
-# already on disk. In online mode we install them here; offline mode asserts
-# (the orchestrator pacstraps them before calling finalize.sh directly).
+# Online-only setup: sanity-check the host, show the logo, start capturing
+# the install log to /var/log. The orchestrator handles all of this itself
+# in offline mode, so finalize.sh's caller environment looks the same in
+# both modes by the time finalize.sh runs.
+source "$OMARCHY_INSTALL/preflight/guard.sh"
+source "$OMARCHY_INSTALL/preflight/begin.sh"
+run_logged "$OMARCHY_INSTALL/preflight/show-env.sh"
+
+# Install/update the omarchy runtime + the default install set.
 _omarchy_runtime_pkg="${OMARCHY_RUNTIME_PACKAGE:-omarchy}"
 mapfile -t _omarchy_base_pkgs < <(grep -v '^#\|^$' "$OMARCHY_PATH/install/omarchy-base.packages")
-if install_mode_is offline; then
-  pacman -Q "$_omarchy_runtime_pkg" >/dev/null 2>&1 || {
-    echo "Error: $_omarchy_runtime_pkg must be installed before install.sh runs in offline mode" >&2
-    exit 1
-  }
-else
-  sudo pacman -Syu --noconfirm --needed "$_omarchy_runtime_pkg" "${_omarchy_base_pkgs[@]}"
-fi
+sudo pacman -Syu --noconfirm --needed "$_omarchy_runtime_pkg" "${_omarchy_base_pkgs[@]}"
 
 exec bash "$OMARCHY_PATH/finalize.sh"