diff --git a/cmd/earlyinit/main.go b/cmd/earlyinit/main.go
index 4088330..8bf7230 100644
--- a/cmd/earlyinit/main.go
+++ b/cmd/earlyinit/main.go
@@ -94,6 +94,22 @@ func main() {
 		"",
 	))
 
+	// after top level has been set up
+	mustSyscall("remount root", Mount(
+		"",
+		"/",
+		"",
+		MS_REMOUNT|MS_BIND|
+			MS_RDONLY|MS_NODEV|MS_NOSUID|MS_NOEXEC,
+		"",
+	))
+
+	must(os.WriteFile(
+		"/sys/module/firmware_class/parameters/path",
+		[]byte("/system/lib/firmware"),
+		0,
+	))
+
 }
 
 // mustSyscall calls [log.Fatalln] if err is non-nil.
diff --git a/internal/rosa/images.go b/internal/rosa/images.go
index e992d52..bfffaf4 100644
--- a/internal/rosa/images.go
+++ b/internal/rosa/images.go
@@ -32,11 +32,15 @@ func (t Toolchain) newImageSystem() (pkg.Artifact, string) {
 		SquashfsTools,
 	), nil, nil, `
 mksquashfs /mnt/system /work/system.img
-`, pkg.Path(fhs.AbsRoot.Append("mnt"), false,
-		t.Load(Musl),
-		t.Load(Mksh),
-		t.Load(Toybox),
-	)), Unversioned
+`, pkg.Path(fhs.AbsRoot.Append("mnt"), false, t.AppendPresets(nil,
+		Musl,
+		Mksh,
+		Toybox,
+
+		Kmod,
+		Kernel,
+		Firmware,
+	)...)), Unversioned
 }
 func init() {
 	artifactsM[ImageSystem] = Metadata{