diff --git a/README.md b/README.md
index 25e27d2..2eb5265 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,3 @@
-# ostree 
+# Fedora IoT ostree/rpm-ostree treefiles
 
 This is the repo for the ostree compose configs for Fedora IoT.
diff --git a/bootupd.yaml b/bootupd.yaml
new file mode 100644
index 0000000..62ebb0d
--- /dev/null
+++ b/bootupd.yaml
@@ -0,0 +1,26 @@
+# KEEP THIS IN SYNC WITH https://github.com/coreos/fedora-coreos-config/blob/testing-devel/manifests/bootupd.yaml
+# See also: https://forge.fedoraproject.org/atomic-desktops/config/src/branch/main/bootupd.yaml
+#
+# Integration with https://github.com/coreos/bootupd
+packages:
+  - bootupd
+
+postprocess:
+  - |
+    #!/bin/bash
+    set -xeuo pipefail
+
+    # Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload
+    /usr/bin/bootupctl backend generate-update-metadata
+
+    # Enable migration to a static GRUB config
+    install -dm0755 /usr/lib/systemd/system/bootloader-update.service.d
+    cat > /usr/lib/systemd/system/bootloader-update.service.d/migrate-static-grub-config.conf << 'EOF'
+    [Service]
+    ExecStart=/usr/bin/bootupctl migrate-static-grub-config
+    EOF
+
+    echo "enable bootloader-update.service" >> /usr/lib/systemd/system-preset/80-iot.preset
+
+    # Turn permissive mode on for bootupd until all SELinux issues are fixed
+    semanage permissive --noreload --add bootupd_t
diff --git a/ci/validate b/ci/validate
new file mode 100755
index 0000000..c9e6a32
--- /dev/null
+++ b/ci/validate
@@ -0,0 +1,57 @@
+#!/usr/bin/python3
+# Validate basic syntax of shell script and yaml.
+
+import os
+import stat
+import subprocess
+import yaml
+
+validated=0
+
+def openat(dirfd, name, mode='r'):
+    def opener(path, flags):
+        return os.open(path, flags, dir_fd=dirfd)
+    return open(name, mode, opener=opener)
+
+
+def validate_shell(rootfd, name):
+    subprocess.check_call(['bash', '-n', name], preexec_fn=lambda: os.fchdir(rootfd))
+    global validated
+    validated +=1
+
+
+for root, dirs, files, rootfd in os.fwalk('.'):
+    # Skip folders that do not include content to validate
+    for d in ['.git', '.github', 'repo', 'cache', 'tmp', 'logs', 'fedora-comps']:
+        if d in dirs:
+            dirs.remove(d)
+    for f in ['.gitlab-ci.yml']:
+        if f in files:
+            files.remove(f)
+    for name in files:
+        if name.endswith(('.yaml', '.yml')):
+            print("Validating:", name)
+            with open(os.open(name, dir_fd=rootfd, flags=os.O_RDONLY)) as f:
+                yaml.safe_load(f)
+            result = subprocess.run(['grep', '-RniEv', '^(  )*[a-z#/-]|^(  )*\\[|^$|^#', name], encoding='UTF-8',
+                                    preexec_fn=lambda: os.fchdir(rootfd))
+            if result.returncode == 0:
+                raise Exception("Found likely invalid indentation in YAML file: {}".format(name))
+            validated +=1
+            continue
+        elif name.endswith('.sh'):
+            print("Validating:", name)
+            validate_shell(rootfd, name)
+            continue
+        stbuf = os.lstat(name, dir_fd=rootfd)
+        if not stat.S_ISREG(stbuf.st_mode):
+            continue
+        if not stbuf.st_mode & stat.S_IXUSR:
+            continue
+        mimetype = subprocess.check_output(['file', '-b', '--mime-type', name], encoding='UTF-8',
+                                           preexec_fn=lambda: os.fchdir(rootfd)).strip()
+        if mimetype == 'text/x-shellscript':
+            print("Validating:", name)
+            validate_shell(rootfd, name)
+
+print(f"Validated {validated} files")
diff --git a/composefs.yaml b/composefs.yaml
new file mode 100644
index 0000000..8a721f3
--- /dev/null
+++ b/composefs.yaml
@@ -0,0 +1,12 @@
+# Enable composefs
+# See: https://fedoraproject.org/wiki/Changes/ComposefsAtomicDesktops
+# https://fedoraproject.org/wiki/Changes/ComposefsAtomicCoreOSIoT
+postprocess:
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+
+    cat >> /usr/lib/ostree/prepare-root.conf << 'EOF'
+    [composefs]
+    enabled = yes
+    EOF
diff --git a/config.ini b/config.ini
index 3d79dfc..a91c1c6 100644
--- a/config.ini
+++ b/config.ini
@@ -10,9 +10,9 @@ os_pretty_name = Fedora IoT
 tree_name   = docker-host
 tree_file   = %(os_name)s-%(tree_name)s.json
 arch        = x86_64
-release     = f33
+release     = f46
 ref         = %(os_name)s/rawhide/%(arch)s/%(tree_name)s
-yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux//development/rawhide/%(arch)s/os/
+yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/
 # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides
 lorax_include_packages = fedora-productimg-iot
 docker_os_name = fedora
diff --git a/fedora-32.repo b/fedora-46.repo
similarity index 56%
rename from fedora-32.repo
rename to fedora-46.repo
index 5d5c0a0..03af70c 100644
--- a/fedora-32.repo
+++ b/fedora-46.repo
@@ -1,12 +1,12 @@
-[fedora-33]
-name=Fedora 33 - $basearch
+[fedora-46]
+name=Fedora 46 - $basearch
 failovermethod=priority
-#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/33/Everything/$basearch/os/
-metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-33&arch=$basearch
+#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/46/Everything/$basearch/os/
+metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-46&arch=$basearch
 enabled=1
 #metadata_expire=7d
-repo_gpgcheck=1
+repo_gpgcheck=0
 type=rpm
 gpgcheck=1
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-33-$basearch
+gpgkey=file:///usr/share/pki/rpm-gpg/RPM-GPG-KEY-fedora-46-$basearch
 skip_if_unavailable=False
diff --git a/fedora-iot-base.json b/fedora-iot-base.json
deleted file mode 100644
index bd18a09..0000000
--- a/fedora-iot-base.json
+++ /dev/null
@@ -1,131 +0,0 @@
-{
-    "ref": "fedora/rawhide/${basearch}/iot",
-    "ex-jigdo-spec": "fedora-iot.spec",
-
-    "repos": [],
-
-    "selinux": true,
-
-    "recommends": false,
-
-    "documentation": false,
-
-    "automatic_version_prefix": "33",
-    "mutate-os-release": "33",
-
-    "initramfs-args": ["--no-hostonly",
-                       "--add", "ignition"],
-    "boot_location": "new",
-
-    "install-langs-comment": "Keep this in sync with treecompose-post.sh",
-    "install-langs": [
-      "pt_BR",
-      "fr",
-      "fr_FR",
-      "de",
-      "de_DE",
-      "it",
-      "it_IT",
-      "ru",
-      "ru_RU",
-      "es",
-      "es_ES",
-      "en_US",
-      "zh_CN",
-      "ja",
-      "ja_JP",
-      "ko",
-      "ko_KR",
-      "zh_TW",
-      "as",
-      "as_IN",
-      "bn",
-      "bn_IN",
-      "gu",
-      "gu_IN",
-      "hi",
-      "hi_IN",
-      "kn",
-      "kn_IN",
-      "ml",
-      "ml_IN",
-      "mr",
-      "mr_IN",
-      "or",
-      "or_IN",
-      "pa",
-      "pa_IN",
-      "ta",
-      "ta_IN",
-      "te",
-      "te_IN"
-    ],
-
-    "postprocess-script": "treecompose-post.sh",
-
-    "etc-group-members": ["wheel", "docker"],
-
-    "ignore-removed-users": ["root"],
-    "ignore-removed-groups": ["root"],
-    "check-passwd": { "type": "file", "filename": "passwd" },
-    "check-groups": { "type": "file", "filename": "group" },
-
-    "packages": ["fedora-release-iot",
-         "glibc", "glibc-minimal-langpack", "nss-altfiles",
-         "sssd-client", "libsss_sudo", "shadow-utils",
-         "kernel",
-         "dracut-config-generic", "dracut-network",
-         "rpm-ostree", "polkit", "lvm2",
-         "cryptsetup", "pinentry",
-         "keyutils", "cracklib-dicts",
-         "e2fsprogs", "xfsprogs", "dosfstools",
-         "gnupg2",
-         "basesystem", "python3", "bash",
-         "xz", "gzip",
-         "coreutils", "which", "curl",
-         "firewalld", "iptables",
-         "NetworkManager", "NetworkManager-wifi", "NetworkManager-wwan",
-         "wpa_supplicant", "iwd", "tpm2-pkcs11",
-         "dnsmasq", "traceroute",
-         "hostname", "iproute", "iputils",
-         "openssh-clients", "openssh-server", "passwd",
-         "policycoreutils", "procps-ng", "rootfiles", "rpm",
-         "selinux-policy-targeted", "setup", "shadow-utils",
-         "sudo", "systemd", "util-linux", "vim-minimal",
-         "less", "tar",
-	 "fwupd", "usbguard",
-         "greenboot", "greenboot-grub2", "greenboot-rpm-ostree-grub2", "greenboot-reboot", "greenboot-status",
-         "ignition", "zezere-ignition",
-         "rsync", "attr",
-         "ima-evm-utils",
-         "bash-completion",
-         "tmux", "screen",
-         "policycoreutils-python-utils",
-         "setools-console",
-         "audit", "rng-tools", "chrony",
-         "bluez", "bluez-libs", "bluez-mesh", "wpan-tools",
-         "kernel-tools", "libgpiod-utils",
-         "podman", "container-selinux", "skopeo", "criu",
-	 "slirp4netns", "fuse-overlayfs",
-         "clevis", "clevis-dracut", "clevis-luks"],
-
-    "packages-aarch64": ["grub2-efi-aa64", "efibootmgr", "shim-aa64",
-                         "uboot-tools", "uboot-images-armv8", "bcm283x-firmware",
-                         "arm-image-installer", "iwl7260-firmware"],
-
-    "packages-armhfp": ["grub2-efi-arm", "efibootmgr",
-                        "uboot-tools", "uboot-images-armv7", "bcm283x-firmware",
-                        "arm-image-installer"],
-
-    "packages-x86_64": ["grub2", "grub2-efi-x64", "efibootmgr", "shim-x64", "microcode_ctl",
-                        "iwl1000-firmware", "iwl100-firmware", "iwl105-firmware", "iwl135-firmware",
-                        "iwl2000-firmware", "iwl2030-firmware", "iwl3160-firmware", "iwl5000-firmware",
-                        "iwl5150-firmware", "iwl6000-firmware", "iwl6050-firmware", "iwl7260-firmware"],
-
-    "default_target": "multi-user.target",
-
-    "units": ["NetworkManager.service", "firewalld.service", "rngd.service", "sshd.service",
-              "zezere_ignition.timer", "zezere_ignition_banner.service",
-              "greenboot-grub2-set-counter", "greenboot-grub2-set-success", "greenboot-healthcheck", "greenboot-rpm-ostree-grub2-check-fallback",
-              "greenboot-status", "greenboot-task-runner", "redboot-auto-reboot", "edboot-task-runner"]
-}
diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml
new file mode 100644
index 0000000..79160b5
--- /dev/null
+++ b/fedora-iot-base.yaml
@@ -0,0 +1,205 @@
+include:
+  - bootupd.yaml
+  # Enable composefs
+  - composefs.yaml
+  # Read only sysroot
+  - sysroot-ro.yaml
+ref: fedora/rawhide/${basearch}/iot
+repos: []
+selinux: true
+tmp-is-dir: true
+recommends: false
+documentation: false
+automatic_version_prefix: '46'
+mutate-os-release: '46'
+initramfs-args:
+- "--no-hostonly"
+- "--add"
+- ignition watchdog
+boot_location: modules
+  # Keep this in sync with treecompose-post.sh
+install-langs:
+- pt_BR
+- fr
+- fr_FR
+- de
+- de_DE
+- it
+- it_IT
+- ru
+- ru_RU
+- es
+- es_ES
+- en_US
+- zh_CN
+- ja
+- ja_JP
+- ko
+- ko_KR
+- zh_TW
+- as
+- as_IN
+- bn
+- bn_IN
+- gu
+- gu_IN
+- hi
+- hi_IN
+- kn
+- kn_IN
+- ml
+- ml_IN
+- mr
+- mr_IN
+- or
+- or_IN
+- pa
+- pa_IN
+- ta
+- ta_IN
+- te
+- te_IN
+postprocess-script: treecompose-post.sh
+etc-group-members:
+- wheel
+- docker
+ignore-removed-users:
+- root
+ignore-removed-groups:
+- root
+check-passwd:
+  type: file
+  filename: passwd
+check-groups:
+  type: file
+  filename: group
+packages:
+# This list of packages should be kept in sync with 
+# the iot-commit definition is osbuild, as found here:
+# https://github.com/osbuild/images/blob/0584c20b0c14a89e833b875252114ceff61805e8/pkg/distro/fedora/package_sets.go#L123
+- fedora-release-iot
+- fedora-iot-config
+- aardvark-dns
+- atheros-firmware
+- attr
+- authselect
+- bash
+- bash-completion
+- bootc
+- brcmfmac-firmware
+- chrony
+- clevis
+- clevis-dracut
+- clevis-luks
+- clevis-pin-tpm2
+- container-selinux
+- containernetworking-plugins
+- coreutils
+- cracklib-dicts
+- criu
+- criu-libs
+- cryptsetup
+- curl
+- dnf5
+- dnf5-plugins
+- dosfstools
+- dracut-config-generic
+- dracut-network
+- e2fsprogs
+- efibootmgr
+- fdo-client
+- fdo-owner-cli
+- filesystem
+- firewalld
+- fwupd
+- fwupd-efi
+- fwupd-plugin-modem-manager
+- fwupd-plugin-uefi-capsule-data
+- glibc
+- glibc-minimal-langpack
+- gnupg2
+- greenboot
+- greenboot-default-health-checks
+- gzip
+- hostname
+- ignition-edge
+- ima-evm-utils
+- iproute
+- iputils
+- iwd
+- iwlwifi-mvm-firmware
+- kernel
+- keyutils
+- kmscon
+- less
+- libsss_sudo
+- linux-firmware
+- lvm2
+- netavark
+- NetworkManager
+- NetworkManager-wifi
+- NetworkManager-wwan
+- nss-altfiles
+- openssl
+- openssh-clients
+- openssh-server
+- passt
+- passt-selinux
+- pinentry
+- podman
+- policycoreutils
+- polkit
+- procps-ng
+- realtek-firmware
+- rootfiles
+- rpm
+- screen
+- selinux-policy-targeted
+- setools-console
+- setup
+- shadow-utils
+- skopeo
+- slirp4netns
+- sssd-client
+- sudo
+- systemd
+- systemd-pam
+- systemd-resolved
+- tar
+- tmux
+- tpm2-pkcs11
+- traceroute
+- usbguard
+- util-linux
+- vim-minimal
+- wpa_supplicant
+- wireless-regdb
+- xfsprogs
+- xz
+- zram-generator
+- zram-generator-defaults
+packages-aarch64:
+- arm-image-installer
+- bcm283x-firmware
+- grub2-efi-aa64
+- optee_client
+- shim-aa64
+- uboot-images-armv8
+packages-x86_64:
+- grub2-efi-x64
+- microcode_ctl
+- shim-x64
+default_target: multi-user.target
+units:
+- NetworkManager.service
+- fdo-client-linuxapp.service
+- fedora-iot-config-remote-fix.service
+- firewalld.service
+- sshd.service
+- systemd-firstboot.service
+- greenboot-grub2-set-counter.service
+- greenboot-grub2-set-success.service
+- greenboot-healthcheck.service
+- greenboot-rpm-ostree-grub2-check-fallback.service
+- greenboot-status.service
+- greenboot-task-runner.service
diff --git a/fedora-iot-bootc.yaml b/fedora-iot-bootc.yaml
new file mode 100644
index 0000000..6ae5882
--- /dev/null
+++ b/fedora-iot-bootc.yaml
@@ -0,0 +1,15 @@
+releasever: rawhide
+variables:
+  distro: "fedora-iot"
+
+repos:
+  - fedora-rawhide
+
+metadata:
+  name: fedora-iot-bootc-base
+  summary: Fedora IoT bootc base image
+
+include:
+  - fedora-bootc-base/manifest.yaml
+  - fedora-bootc-base/kernel.yaml
+
diff --git a/fedora-iot-rawhide.tdl b/fedora-iot-rawhide.tdl
deleted file mode 100644
index 8ad38cb..0000000
--- a/fedora-iot-rawhide.tdl
+++ /dev/null
@@ -1,13 +0,0 @@
-<template>
-    <name>rawhide</name>
-    <os>
-        <name>Fedora</name>
-        <version>20</version>
-        <arch>x86_64</arch>
-        <install type='url'>
-            <url>http://dl.fedoraproject.org/pub/fedora/linux/development/22/x86_64/os/</url>
-        </install>
-        <rootpw>ewwwwwww</rootpw>
-    </os>
-</template>
-
diff --git a/fedora-iot-updates-stable.json b/fedora-iot-updates-stable.json
deleted file mode 100644
index 1bacd21..0000000
--- a/fedora-iot-updates-stable.json
+++ /dev/null
@@ -1,5 +0,0 @@
-
-    "ref": "fedora/devel/${basearch}/updates/iot",
-    "ex-jigdo-spec": "fedora-iot.spec",
-    "include": "fedora-iot-base.json"
-}
diff --git a/fedora-iot-updates-stable.yaml b/fedora-iot-updates-stable.yaml
new file mode 100644
index 0000000..263bd4b
--- /dev/null
+++ b/fedora-iot-updates-stable.yaml
@@ -0,0 +1,2 @@
+include: fedora-iot-base.yaml
+ref: fedora/rawhide/${basearch}/updates/iot
diff --git a/fedora-iot-updates-testing.json b/fedora-iot-updates-testing.json
deleted file mode 100644
index 96b50ac..0000000
--- a/fedora-iot-updates-testing.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-    "ref": "fedora/rawhide/${basearch}/testing/iot",
-    "ex-jigdo-spec": "fedora-iot.spec",
-    "include": "fedora-iot-base.json"
-}
diff --git a/fedora-iot-updates-testing.yaml b/fedora-iot-updates-testing.yaml
new file mode 100644
index 0000000..c6eb5a5
--- /dev/null
+++ b/fedora-iot-updates-testing.yaml
@@ -0,0 +1,2 @@
+include: fedora-iot-base.yaml
+ref: fedora/rawhide/${basearch}/testing/iot
diff --git a/fedora-iot.json b/fedora-iot.json
deleted file mode 100644
index 3892dcc..0000000
--- a/fedora-iot.json
+++ /dev/null
@@ -1,6 +0,0 @@
-{
-    "ref": "fedora/rawhide/${basearch}/iot",
-    "ex-jigdo-spec": "fedora-iot.spec",
-    "repos": ["fedora-33"],
-    "include": "fedora-iot-base.json"
-}
diff --git a/fedora-iot.spec b/fedora-iot.spec
deleted file mode 100644
index f8b12a5..0000000
--- a/fedora-iot.spec
+++ /dev/null
@@ -1,22 +0,0 @@
-# Suppress most build root processing since we are just carrying binary data
-%global __os_install_post /usr/lib/rpm/brp-compress %{nil}
-Name: fedora-iot
-Version:	%{ostree_version}
-Release:	1%{?dist}
-Summary:	Image (rpm-ostree jigdo) for Fedora IoT
-License:	MIT
-#@@@rpmostree_jigdo_meta@@@
-
-%description
-%{summary}
-
-%prep
-
-%build
-
-%install
-mkdir -p %{buildroot}%{_prefix}/lib/ostree-jigdo/%{name}
-for x in *; do mv ${x} %{buildroot}%{_prefix}/lib/ostree-jigdo/%{name}; done
-
-%files
-%{_prefix}/lib/ostree-jigdo/%{name}
diff --git a/fedora-iot.yaml b/fedora-iot.yaml
new file mode 100644
index 0000000..b770dff
--- /dev/null
+++ b/fedora-iot.yaml
@@ -0,0 +1,5 @@
+include: fedora-iot-base.yaml
+ref: fedora/rawhide/${basearch}/iot
+
+repos:
+- fedora-46
diff --git a/fedora-rawhide.repo b/fedora-rawhide.repo
new file mode 100644
index 0000000..30b51c9
--- /dev/null
+++ b/fedora-rawhide.repo
@@ -0,0 +1,6 @@
+[fedora-rawhide]
+name=Fedora rawhide $basearch
+mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=rawhide&arch=$basearch
+enabled=1
+gpgcheck=1
+metadata_expire=1d
diff --git a/justfile b/justfile
new file mode 100644
index 0000000..3eaf256
--- /dev/null
+++ b/justfile
@@ -0,0 +1,156 @@
+# This is a justfile. See https://github.com/casey/just
+# This is only used for local development. The builds made on the Fedora
+# infrastructure are run via Pungi in a Koji runroot.
+
+# Set a default for some recipes
+default_variant := "fedora-iot"
+default_arch := "default"
+# Current default in Pungi
+force_nocache := "true"
+
+# Just doesn't have a native dict type, but quoted bash dictionary works fine
+pretty_names := '(
+    [fedora-iot]="IoT"
+)'
+
+# Default is to only validate the manifests
+all: validate
+
+# Basic validation to make sure the manifests are not completely broken
+validate:
+    ./ci/validate
+
+# Output the processed manifest for a given variant (defaults to Silverblue)
+manifest variant=default_variant:
+    #!/bin/bash
+    set -euo pipefail
+
+    rpm-ostree compose tree --print-only --repo=repo {{variant}}.yaml
+
+# Perform dependency resolution for a given variant (defaults to Silverblue)
+compose-dry-run variant=default_variant:
+    #!/bin/bash
+    set -euxo pipefail
+
+    mkdir -p repo cache logs
+    if [[ ! -f "repo/config" ]]; then
+        pushd repo > /dev/null || exit 1
+        ostree init --repo . --mode=bare-user
+        popd > /dev/null || exit 1
+    fi
+
+    rpm-ostree compose tree --unified-core --repo=repo --dry-run {{variant}}.yaml
+
+# Alias/shortcut for compose-image command
+compose variant=default_variant: (compose-image variant)
+
+# Compose a variant using the legacy non container path (defaults to Silverblue)
+compose-legacy variant=default_variant:
+    #!/bin/bash
+    set -euxo pipefail
+
+    declare -A pretty_names={{pretty_names}}
+    variant={{variant}}
+    variant_pretty=${pretty_names[$variant]-}
+    if [[ -z $variant_pretty ]]; then
+        echo "Unknown variant"
+        exit 1
+    fi
+
+    ./ci/validate > /dev/null || (echo "Failed manifest validation" && exit 1)
+
+    mkdir -p repo cache logs
+    if [[ ! -f "repo/config" ]]; then
+        pushd repo > /dev/null || exit 1
+        ostree init --repo . --mode=bare-user
+        popd > /dev/null || exit 1
+    fi
+    # Set option to reduce fsync for transient builds
+    ostree --repo=repo config set 'core.fsync' 'false'
+
+    buildid="$(date '+%Y%m%d.0')"
+    timestamp="$(date --iso-8601=sec)"
+    echo "${buildid}" > .buildid
+
+    version="$(rpm-ostree compose tree --print-only --repo=repo ${variant}.yaml | jq -r '."mutate-os-release"')"
+    echo "Composing ${variant_pretty} ${version}.${buildid} ..."
+
+    ARGS="--repo=repo --cachedir=cache"
+    ARGS+=" --unified-core"
+    if [[ {{force_nocache}} == "true" ]]; then
+        ARGS+=" --force-nocache"
+    fi
+    CMD="rpm-ostree"
+    if [[ ${EUID} -ne 0 ]]; then
+        CMD="sudo rpm-ostree"
+    fi
+
+    ${CMD} compose tree ${ARGS} \
+        --add-metadata-string="version=${variant_pretty} ${version}.${buildid}" \
+        "${variant}.yaml" \
+            |& tee "logs/${variant}_${version}_${buildid}.${timestamp}.log"
+
+    if [[ ${EUID} -ne 0 ]]; then
+        sudo chown --recursive "$(id --user --name):$(id --group --name)" repo cache
+    fi
+
+    ostree summary --repo=repo --update
+
+# Compose an Ostree Native Container OCI image
+compose-image variant=default_variant:
+    #!/bin/bash
+    set -euxo pipefail
+
+    declare -A pretty_names={{pretty_names}}
+    variant={{variant}}
+    variant_pretty=${pretty_names[$variant]-}
+    if [[ -z $variant_pretty ]]; then
+        echo "Unknown variant"
+        exit 1
+    fi
+
+    ./ci/validate > /dev/null || (echo "Failed manifest validation" && exit 1)
+
+    mkdir -p repo cache
+    if [[ ! -f "repo/config" ]]; then
+        pushd repo > /dev/null || exit 1
+        ostree init --repo . --mode=bare-user
+        popd > /dev/null || exit 1
+    fi
+    # Set option to reduce fsync for transient builds
+    ostree --repo=repo config set 'core.fsync' 'false'
+
+    buildid="$(date '+%Y%m%d.0')"
+    timestamp="$(date --iso-8601=sec)"
+    echo "${buildid}" > .buildid
+
+    version="$(rpm-ostree compose tree --print-only --repo=repo ${variant}.yaml | jq -r '."mutate-os-release"')"
+    echo "Composing ${variant_pretty} ${version}.${buildid} ..."
+
+    ARGS="--cachedir=cache --initialize"
+    if [[ {{force_nocache}} == "true" ]]; then
+        ARGS+=" --force-nocache"
+    fi
+    # To debug with gdb, use: gdb --args ...
+    CMD="rpm-ostree"
+    if [[ ${EUID} -ne 0 ]]; then
+        CMD="sudo rpm-ostree"
+    fi
+
+    ${CMD} compose image ${ARGS} \
+         --label="quay.expires-after=4w" \
+        "${variant}.yaml" \
+        "${variant}.ociarchive"
+
+# Clean up everything
+clean-all:
+    just clean-repo
+    just clean-cache
+
+# Only clean the ostree repo
+clean-repo:
+    rm -rf ./repo
+
+# Only clean the package and repo caches
+clean-cache:
+    rm -rf ./cache
diff --git a/sysroot-ro.yaml b/sysroot-ro.yaml
new file mode 100644
index 0000000..8214f05
--- /dev/null
+++ b/sysroot-ro.yaml
@@ -0,0 +1,15 @@
+# Set up default root config to mount sysroot as read only
+# https://fedoraproject.org/wiki/Changes/Silverblue_Kinoite_readonly_sysroot
+# See: https://gitlab.com/fedora/bootc/base-images/-/blob/main/tier-0/ostree.yaml
+# See: https://github.com/fedora-iot/iot-distro/issues/81
+
+postprocess:
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+
+    install -dm 0755 -o 0 -g 0 /usr/lib/ostree
+    cat >> /usr/lib/ostree/prepare-root.conf << 'EOF'
+    [sysroot]
+    readonly = true
+    EOF
diff --git a/treecompose-post.sh b/treecompose-post.sh
index 81d6c5e..e62b942 100755
--- a/treecompose-post.sh
+++ b/treecompose-post.sh
@@ -2,12 +2,9 @@
 
 set -xeuo pipefail
 
-# Work around https://bugzilla.redhat.com/show_bug.cgi?id=1265295
-# Also note the create-new-then-rename dance for rofiles-fuse compat
-if ! grep -q '^Storage=persistent' /etc/systemd/journald.conf; then
-    (cat /etc/systemd/journald.conf && echo 'Storage=persistent') > /etc/systemd.journald.conf.new
-    mv /etc/systemd.journald.conf{.new,}
-fi
+# From https://github.com/coreos/fedora-coreos-config/blob/testing-devel/overlay.d/05core/usr/lib/systemd/journald.conf.d/10-coreos-persistent.conf
+install -dm0755 /usr/lib/systemd/journald.conf.d/
+echo -e "[Journal]\nStorage=persistent" > /usr/lib/systemd/journald.conf.d/10-persistent.conf
 
 # See: https://src.fedoraproject.org/rpms/glibc/pull-request/4
 # Basically that program handles deleting old shared library directories
@@ -18,3 +15,15 @@ for x in /usr/sbin/glibc_post_upgrade.*; do
         ln -srf /usr/bin/true ${x}
     fi
 done
+
+# Remove loader directory causing issues in Anaconda in unified core mode
+# Will be obsolete once we start using bootupd
+# See - https://forge.fedoraproject.org/atomic-desktops/config/pulls/344
+rm -rf /usr/lib/ostree-boot/loader
+
+# Undo RPM scripts enabling units; we want the presets to be canonical
+# https://github.com/projectatomic/rpm-ostree/issues/1803
+rm -rf /etc/systemd/system/*
+systemctl preset-all
+rm -rf /etc/systemd/user/*
+systemctl --user --global preset-all