diff --git a/flake.nix b/flake.nix
index 73a4ea1..dd90c08 100644
--- a/flake.nix
+++ b/flake.nix
@@ -235,14 +235,20 @@
                         boot.resumeDevice = "/dev/disk/by-uuid/00000000-0000-0000-0000-000000000000";
                         boot.kernelParams = [ "resume_offset=1" ];
                         boot.initrd.luks.devices.crypted.device = "/dev/disk/by-partlabel/disk-main-root";
-                        # The real install is BTRFS — the placeholder's ext4
-                        # would leave the btrfs-gated bits (snapper!) out of
-                        # this pin.
+                        # The real install is BTRFS with a vfat ESP — the
+                        # placeholder's bare ext4 would leave fs-gated bits
+                        # out of this pin (snapper via btrfs; mtools and
+                        # dosfstools enter systemPackages via vfat!).
                         fileSystems."/" = lib.mkForce {
                           device = "/dev/mapper/crypted";
                           fsType = "btrfs";
                           options = [ "subvol=@" "compress=zstd" "noatime" ];
                         };
+                        fileSystems."/boot" = {
+                          device = "/dev/disk/by-uuid/0000-0000";
+                          fsType = "vfat";
+                          options = [ "umask=0077" ];
+                        };
                       })
                     ];
                   };
@@ -258,6 +264,27 @@
                   representativeInstall.config.system.build.etc.inputDerivation
                   representativeInstall.config.system.build.initialRamdisk.inputDerivation
                   template.homeConfigurations.${username}.activationPackage.inputDerivation
+                ] ++ [
+                  # …and the second-level build tools those rebuilds need
+                  # (their parents are themselves rebuilt, so parent
+                  # inputDerivations don't reach them): kernel-module
+                  # shrinking, unit-dir assembly, dbus config, /etc.
+                  pkgs.kmod.dev
+                  pkgs.nukeReferences
+                  pkgs.xorg.lndir
+                  pkgs.libxslt.bin
+                  pkgs.python3Minimal
+                  # system-path is rebuilt on EVERY machine: buildEnv's
+                  # package-list order follows module-graph order, and any
+                  # hardware profile/import reshuffles it. Its builder
+                  # wants these.
+                  pkgs.texinfo
+                  pkgs.getconf
+                  # greetd.toml embeds the auto-login user and is generated
+                  # by remarshal — without this pin an offline install
+                  # tries to BUILD remarshal, whose test closure pulls
+                  # matplotlib/ffmpeg/x265 (the ~1900-drv cascade).
+                  pkgs.remarshal
 
                   # …and one representative disko script: its tool closure
                   # (file, which, wrapper hooks, …) isn't otherwise on the