diff --git a/bootupd.yaml b/bootupd.yaml
index 62ebb0d..3328d41 100644
--- a/bootupd.yaml
+++ b/bootupd.yaml
@@ -1,7 +1,7 @@
 # KEEP THIS IN SYNC WITH https://github.com/coreos/fedora-coreos-config/blob/testing-devel/manifests/bootupd.yaml
-# See also: https://forge.fedoraproject.org/atomic-desktops/config/src/branch/main/bootupd.yaml
+# See also: https://pagure.io/workstation-ostree-config/blob/main/f/bootupd.yaml
 #
-# Integration with https://github.com/coreos/bootupd
+#Integration with https://github.com/coreos/bootupd
 packages:
   - bootupd
 
@@ -9,18 +9,5 @@ postprocess:
   - |
     #!/bin/bash
     set -xeuo pipefail
-
     # Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload
     /usr/bin/bootupctl backend generate-update-metadata
-
-    # Enable migration to a static GRUB config
-    install -dm0755 /usr/lib/systemd/system/bootloader-update.service.d
-    cat > /usr/lib/systemd/system/bootloader-update.service.d/migrate-static-grub-config.conf << 'EOF'
-    [Service]
-    ExecStart=/usr/bin/bootupctl migrate-static-grub-config
-    EOF
-
-    echo "enable bootloader-update.service" >> /usr/lib/systemd/system-preset/80-iot.preset
-
-    # Turn permissive mode on for bootupd until all SELinux issues are fixed
-    semanage permissive --noreload --add bootupd_t
diff --git a/ci/validate b/ci/validate
deleted file mode 100755
index c9e6a32..0000000
--- a/ci/validate
+++ /dev/null
@@ -1,57 +0,0 @@
-#!/usr/bin/python3
-# Validate basic syntax of shell script and yaml.
-
-import os
-import stat
-import subprocess
-import yaml
-
-validated=0
-
-def openat(dirfd, name, mode='r'):
-    def opener(path, flags):
-        return os.open(path, flags, dir_fd=dirfd)
-    return open(name, mode, opener=opener)
-
-
-def validate_shell(rootfd, name):
-    subprocess.check_call(['bash', '-n', name], preexec_fn=lambda: os.fchdir(rootfd))
-    global validated
-    validated +=1
-
-
-for root, dirs, files, rootfd in os.fwalk('.'):
-    # Skip folders that do not include content to validate
-    for d in ['.git', '.github', 'repo', 'cache', 'tmp', 'logs', 'fedora-comps']:
-        if d in dirs:
-            dirs.remove(d)
-    for f in ['.gitlab-ci.yml']:
-        if f in files:
-            files.remove(f)
-    for name in files:
-        if name.endswith(('.yaml', '.yml')):
-            print("Validating:", name)
-            with open(os.open(name, dir_fd=rootfd, flags=os.O_RDONLY)) as f:
-                yaml.safe_load(f)
-            result = subprocess.run(['grep', '-RniEv', '^(  )*[a-z#/-]|^(  )*\\[|^$|^#', name], encoding='UTF-8',
-                                    preexec_fn=lambda: os.fchdir(rootfd))
-            if result.returncode == 0:
-                raise Exception("Found likely invalid indentation in YAML file: {}".format(name))
-            validated +=1
-            continue
-        elif name.endswith('.sh'):
-            print("Validating:", name)
-            validate_shell(rootfd, name)
-            continue
-        stbuf = os.lstat(name, dir_fd=rootfd)
-        if not stat.S_ISREG(stbuf.st_mode):
-            continue
-        if not stbuf.st_mode & stat.S_IXUSR:
-            continue
-        mimetype = subprocess.check_output(['file', '-b', '--mime-type', name], encoding='UTF-8',
-                                           preexec_fn=lambda: os.fchdir(rootfd)).strip()
-        if mimetype == 'text/x-shellscript':
-            print("Validating:", name)
-            validate_shell(rootfd, name)
-
-print(f"Validated {validated} files")
diff --git a/composefs.yaml b/composefs.yaml
index 8a721f3..c51f832 100644
--- a/composefs.yaml
+++ b/composefs.yaml
@@ -1,6 +1,5 @@
-# Enable composefs
-# See: https://fedoraproject.org/wiki/Changes/ComposefsAtomicDesktops
-# https://fedoraproject.org/wiki/Changes/ComposefsAtomicCoreOSIoT
+# Force disable composefs
+# See: https://github.com/ostreedev/ostree/pull/3353
 postprocess:
   - |
     #!/usr/bin/env bash
@@ -8,5 +7,5 @@ postprocess:
 
     cat >> /usr/lib/ostree/prepare-root.conf << 'EOF'
     [composefs]
-    enabled = yes
+    enabled = no
     EOF
diff --git a/config.ini b/config.ini
index a91c1c6..d4c4586 100644
--- a/config.ini
+++ b/config.ini
@@ -10,9 +10,9 @@ os_pretty_name = Fedora IoT
 tree_name   = docker-host
 tree_file   = %(os_name)s-%(tree_name)s.json
 arch        = x86_64
-release     = f46
-ref         = %(os_name)s/rawhide/%(arch)s/%(tree_name)s
-yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/
+release     = f41
+ref         = %(os_name)s/stable/%(arch)s/%(tree_name)s
+yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/releases/41/Everything/%(arch)s/os/
 # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides
 lorax_include_packages = fedora-productimg-iot
 docker_os_name = fedora
diff --git a/fedora-46.repo b/fedora-41.repo
similarity index 60%
rename from fedora-46.repo
rename to fedora-41.repo
index 03af70c..1412aca 100644
--- a/fedora-46.repo
+++ b/fedora-41.repo
@@ -1,12 +1,12 @@
-[fedora-46]
-name=Fedora 46 - $basearch
+[fedora-41]
+name=Fedora 41 - $basearch
 failovermethod=priority
-#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/46/Everything/$basearch/os/
-metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-46&arch=$basearch
+#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/41/Everything/$basearch/os/
+metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-41&arch=$basearch
 enabled=1
 #metadata_expire=7d
 repo_gpgcheck=0
 type=rpm
 gpgcheck=1
-gpgkey=file:///usr/share/pki/rpm-gpg/RPM-GPG-KEY-fedora-46-$basearch
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-41-$basearch
 skip_if_unavailable=False
diff --git a/fedora-bootc-base/basic-fixes.yaml b/fedora-bootc-base/basic-fixes.yaml
new file mode 100644
index 0000000..d9fe059
--- /dev/null
+++ b/fedora-bootc-base/basic-fixes.yaml
@@ -0,0 +1,29 @@
+# Fix general bugs
+
+postprocess:
+  # See also https://github.com/openshift/os/blob/f6cde963ee140c02364674db378b2bc4ac42675b/common.yaml#L156
+  # This one is undoes the effect of
+  # # RHEL-only: Disable /tmp on tmpfs.
+  #Wants=tmp.mount
+  # in /usr/lib/systemd/system/basic.target
+  # We absolutely must have tmpfs-on-tmp for multiple reasons,
+  # but the biggest is that when we have composefs for / it's read-only,
+  # and for units with ProtectSystem=full systemd clones / but needs
+  # a writable place.
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    mkdir -p /usr/lib/systemd/system/local-fs.target.wants
+    if test '!' -f /usr/lib/systemd/system/local-fs.target.wants/tmp.mount; then
+      ln -sf ../tmp.mount /usr/lib/systemd/system/local-fs.target.wants
+    fi
+
+    # See https://github.com/containers/bootc/issues/358
+    # basically systemd-tmpfiles doesn't follow symlinks; ordinarily our
+    # tmpfiles.d unit for `/var/roothome` is fine, but this actually doesn't
+    # work if we want to use tmpfiles.d to write to `/root/.ssh` because
+    # tmpfiles gives up on that before getting to `/var/roothome`.
+    sed -ie 's, /root, /var/roothome,' /usr/lib/tmpfiles.d/provision.conf
+    # Because /var/roothome is also defined in rpm-ostree-0-integration.conf
+    # we need to delete /var/roothome
+    sed -ie '/^d- \/var\/roothome /d' /usr/lib/tmpfiles.d/provision.conf
diff --git a/fedora-bootc-base/bootc-config.yaml b/fedora-bootc-base/bootc-config.yaml
new file mode 100644
index 0000000..e69de29
diff --git a/fedora-bootc-base/bootc.yaml b/fedora-bootc-base/bootc.yaml
new file mode 100644
index 0000000..a862e6c
--- /dev/null
+++ b/fedora-bootc-base/bootc.yaml
@@ -0,0 +1,12 @@
+# The bootc components.
+packages:
+ - systemd
+ - bootc
+ # Required by bootc install today, though we'll likely switch bootc to use a Rust crate instead of sgdisk
+ - gdisk xfsprogs e2fsprogs dosfstools
+
+exclude-packages:
+  # Exclude kernel-debug-core to make sure that it doesn't somehow get
+  # chosen as the package to satisfy the `kernel-core` dependency from
+  # the kernel package.
+  - kernel-debug-core
diff --git a/fedora-bootc-base/bootupd.yaml b/fedora-bootc-base/bootupd.yaml
new file mode 100644
index 0000000..cc83d20
--- /dev/null
+++ b/fedora-bootc-base/bootupd.yaml
@@ -0,0 +1,31 @@
+# Integration with https://github.com/coreos/bootupd and bootloader logic
+# xref https://github.com/coreos/fedora-coreos-tracker/issues/510
+packages:
+  - bootupd
+
+# bootloader
+packages-aarch64:
+  - grub2-efi-aa64 efibootmgr shim
+packages-ppc64le:
+  - grub2 ostree-grub2
+packages-s390x:
+  # On Fedora, this is provided by s390utils-core. on RHEL, this is for now
+  # provided by s390utils-base, but soon will be -core too.
+  - /usr/sbin/zipl
+packages-x86_64:
+  - grub2-efi-x64 efibootmgr shim
+  - microcode_ctl
+
+conditional-include:
+  - if: basearch != "s390x"
+    # And remove some cruft from grub2
+    include: grub2-removals.yaml
+
+postprocess:
+  - |
+    #!/bin/bash
+    set -xeuo pipefail
+    # Until we have https://github.com/coreos/rpm-ostree/pull/2275
+    mkdir -p /run
+    # Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload
+    /usr/bin/bootupctl backend generate-update-metadata
diff --git a/fedora-bootc-base/group b/fedora-bootc-base/group
new file mode 100644
index 0000000..2fd197c
--- /dev/null
+++ b/fedora-bootc-base/group
@@ -0,0 +1,46 @@
+root:x:0:
+bin:x:1:
+daemon:x:2:
+sys:x:3:
+adm:x:4:
+tty:x:5:
+disk:x:6:
+lp:x:7:
+mem:x:8:
+kmem:x:9:
+wheel:x:10:
+cdrom:x:11:
+mail:x:12:
+man:x:15:
+sudo:x:16:
+dialout:x:18:
+floppy:x:19:
+games:x:20:
+tape:x:33:
+video:x:39:
+ftp:x:50:
+lock:x:54:
+audio:x:63:
+nobody:x:99:
+users:x:100:
+ssh_keys:x:999:
+systemd-journal:x:190:
+polkitd:x:998:
+etcd:x:997:
+dip:x:40:
+cgred:x:996:
+avahi-autoipd:x:170:
+sssd:x:993:
+dockerroot:x:986:
+rpcuser:x:29:
+nfsnobody:x:65534:
+kube:x:994:
+chrony:x:992:
+tcpdump:x:72:
+ceph:x:167:
+input:x:104:
+systemd-timesync:x:991:
+systemd-network:x:990:
+systemd-resolve:x:989:
+systemd-bus-proxy:x:988:
+cockpit-ws:x:987:
diff --git a/fedora-bootc-base/grub2-removals.yaml b/fedora-bootc-base/grub2-removals.yaml
new file mode 100644
index 0000000..f4800dd
--- /dev/null
+++ b/fedora-bootc-base/grub2-removals.yaml
@@ -0,0 +1,8 @@
+remove-from-packages:
+  # The grub bits are mainly designed for desktops, and IMO haven't seen
+  # enough testing in concert with ostree. At some point we'll flesh out
+  # the full plan in https://github.com/coreos/fedora-coreos-tracker/issues/47
+  - [grub2-tools, /etc/grub.d/08_fallback_counting,
+                  /etc/grub.d/10_reset_boot_success,
+                  /etc/grub.d/12_menu_auto_hide,
+                  /usr/lib/systemd/.*]
diff --git a/fedora-bootc-base/initramfs.yaml b/fedora-bootc-base/initramfs.yaml
new file mode 100644
index 0000000..95146e2
--- /dev/null
+++ b/fedora-bootc-base/initramfs.yaml
@@ -0,0 +1,18 @@
+# Configuration for the initramfs
+postprocess:
+  - |
+    #!/usr/bin/env bash
+    mkdir -p /usr/lib/dracut/dracut.conf.d
+    cat > /usr/lib/dracut/dracut.conf.d/20-bootc-base.conf << 'EOF'
+    # We want a generic image; hostonly makes no sense as part of a server side build
+    hostonly=no
+    add_dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree "
+    EOF
+    cat > /usr/lib/dracut/dracut.conf.d/22-bootc-generic.conf << 'EOF'
+    # Extra modules that we want by default that are known to exist in the kernel
+    add_dracutmodules+=" virtiofs "
+    EOF
+    cat > /usr/lib/dracut/dracut.conf.d/49-bootc-tpm2-tss.conf << 'EOF'
+    # We want this for systemd-cryptsetup tpm2 locking
+    add_dracutmodules+=" systemd-cryptsetup tpm2-tss "
+    EOF
diff --git a/fedora-bootc-base/iot.yaml b/fedora-bootc-base/iot.yaml
new file mode 100644
index 0000000..2c02ca6
--- /dev/null
+++ b/fedora-bootc-base/iot.yaml
@@ -0,0 +1,113 @@
+# Fedora IoT specific packages
+packages:
+  - fedora-release-iot
+  - aardvark-dns
+  - atheros-firmware
+  - attr
+  - authselect
+  - basesystem
+  - bash
+  - bash-completion
+  - bootc
+  - brcmfmac-firmware
+  - chrony
+  - clevis
+  - clevis-dracut
+  - clevis-luks
+  - clevis-pin-tpm2
+  - container-selinux
+  - containernetworking-plugins
+  - coreutils
+  - cracklib-dicts
+  - criu
+  - criu-libs
+  - cryptsetup
+  - curl
+  - dbus-parsec
+  - dnf5-plugins
+  - dosfstools
+  - dracut-config-generic
+  - dracut-network
+  - e2fsprogs
+  - efibootmgr
+  - fdo-client
+  - firewalld
+  - fwupd
+  - fwupd-efi
+  - fwupd-plugin-modem-manager
+  - fwupd-plugin-uefi-capsule-data
+  - glibc
+  - glibc-minimal-langpack
+  - gnupg2
+  - greenboot
+  - greenboot-default-health-checks
+  - gzip
+  - hostname
+  - ignition
+  - ima-evm-utils
+  - iproute
+  - iputils
+  - iwd
+  - iwlwifi-mvm-firmware
+  - kernel-tools
+  - keyutils
+  - less
+  - libsss_sudo
+  - linux-firmware
+  - lvm2
+  - netavark
+  - NetworkManager
+  - NetworkManager-wifi
+  - NetworkManager-wwan
+  - nss-altfiles
+  - openssl
+  - openssh-clients
+  - openssh-server
+  - passt
+  - passt-selinux
+  - parsec
+  - pinentry
+  - podman
+  - policycoreutils
+  - policycoreutils-python-utils
+  - polkit
+  - procps-ng
+  - realtek-firmware
+  - rootfiles
+  - rpm
+  - screen
+  - selinux-policy-targeted
+  - setools-console
+  - setup
+  - shadow-utils
+  - skopeo
+  - slirp4netns
+  - sssd-client
+  - sudo
+  - systemd
+  - systemd-resolved
+  - tar
+  - tmux
+  - tpm2-pkcs11
+  - traceroute
+  - usbguard
+  - util-linux
+  - vim-minimal
+  - wpa_supplicant
+  - wireless-regdb
+  - xfsprogs
+  - xz
+  - zezere-ignition
+  - zram-generator
+  - zram-generator-defaults
+packages-aarch64:
+  - arm-image-installer
+  - bcm283x-firmware
+  - grub2-efi-aa64
+  - optee_client
+  - shim-aa64
+  - uboot-images-armv8
+packages-x86_64:
+  - grub2-efi-x64
+  - microcode_ctl
+  - shim-x64
diff --git a/fedora-bootc-base/kernel.yaml b/fedora-bootc-base/kernel.yaml
new file mode 100644
index 0000000..0dd777d
--- /dev/null
+++ b/fedora-bootc-base/kernel.yaml
@@ -0,0 +1,6 @@
+# Enable the Linux kernel; see also kernel-rt.
+packages:
+ - kernel
+
+exclude-packages:
+  - kernel-debug
diff --git a/fedora-bootc-base/manifest.yaml b/fedora-bootc-base/manifest.yaml
new file mode 100644
index 0000000..f836419
--- /dev/null
+++ b/fedora-bootc-base/manifest.yaml
@@ -0,0 +1,68 @@
+
+# Modern defaults we want
+boot-location: modules
+tmp-is-dir: true
+# https://github.com/CentOS/centos-bootc/issues/167
+machineid-compat: true
+# Be minimal
+recommends: false
+
+ignore-removed-users:
+  - root
+ignore-removed-groups:
+  - root
+etc-group-members:
+  - wheel
+  - sudo
+  - systemd-journal
+  - adm
+
+# Default to `bash` in our container, the same as other containers we ship.
+container-cmd:
+  - /sbin/init
+
+# Note that the default for c9s+ is sqlite; we can't rely on rpm being
+# in the target (it isn't in tier-0!) so turn this to host here.  This
+# does break the "hermetic build" aspect a bit.  Maybe eventually
+# what we should do is special case this and actually install RPM temporarily
+# and then remove it...
+rpmdb: host
+
+check-passwd:
+  type: "file"
+  filename: "passwd"
+check-groups:
+  type: "file"
+  filename: "group"
+
+automatic-version-prefix: "${releasever}.<date:%Y%m%d>"
+mutate-os-release: "${releasever}"
+
+remove-from-packages:
+  # Generally we expect other tools to do this (e.g. Ignition or cloud-init)
+  - [systemd, /usr/lib/systemd/system/sysinit.target.wants/systemd-firstboot.service]
+  # We don't want auto-generated mount units. See also
+  # https://github.com/systemd/systemd/issues/13099
+  - [systemd-udev, /usr/lib/systemd/system-generators/systemd-gpt-auto-generator]
+  # Drop some buggy sysusers fragments which do not match static IDs allocation:
+  # https://bugzilla.redhat.com/show_bug.cgi?id=2105177
+  - [dbus-common, /usr/lib/sysusers.d/dbus.conf]
+
+include:
+  - bootc.yaml
+  - bootupd.yaml
+  - ostree.yaml
+  - initramfs.yaml
+  - basic-fixes.yaml
+  - iot.yaml
+
+packages:
+  # needed for building derived container images
+  - dnf5
+  # Even in tier-0, we have this.  If you don't want SELinux today, you'll need
+  # to build a custom image.
+  - selinux-policy-targeted
+  # And we want container-selinux because trying to layer it on later currently causes issues.
+  - container-selinux
+  # Needed for tpm2 bound luks
+  - tpm2-tools
diff --git a/fedora-bootc-base/ostree.yaml b/fedora-bootc-base/ostree.yaml
new file mode 100644
index 0000000..6f30861
--- /dev/null
+++ b/fedora-bootc-base/ostree.yaml
@@ -0,0 +1,17 @@
+packages:
+ - ostree nss-altfiles
+
+# We want content lifecycled with the image
+opt-usrlocal: "root"
+
+postprocess:
+  # Set up default root config
+  - |
+    #!/usr/bin/env bash
+    mkdir -p /usr/lib/ostree
+    cat > /usr/lib/ostree/prepare-root.conf << EOF
+    [composefs]
+    enabled = yes
+    [sysroot]
+    readonly = true
+    EOF
diff --git a/fedora-bootc-base/passwd b/fedora-bootc-base/passwd
new file mode 100644
index 0000000..ea84802
--- /dev/null
+++ b/fedora-bootc-base/passwd
@@ -0,0 +1,32 @@
+adm:x:3:4:adm:/var/adm:/usr/sbin/nologin
+avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/usr/sbin/nologin
+bin:x:1:1:bin:/bin:/usr/sbin/nologin
+ceph:x:167:167:Ceph daemons:/var/lib/ceph:/usr/sbin/nologin
+chrony:x:994:992::/var/lib/chrony:/usr/sbin/nologin
+cockpit-ws:x:988:987:User for cockpit-ws:/:/usr/sbin/nologin
+daemon:x:2:2:daemon:/sbin:/usr/sbin/nologin
+dbus:x:81:81:System Message Bus:/:/usr/sbin/nologin
+dockerroot:x:997:986:Docker User:/var/lib/docker:/usr/sbin/nologin
+etcd:x:998:997:etcd user:/var/lib/etcd:/usr/sbin/nologin
+ftp:x:14:50:FTP User:/var/ftp:/usr/sbin/nologin
+games:x:12:100:games:/usr/games:/usr/sbin/nologin
+halt:x:7:0:halt:/sbin:/sbin/halt
+kube:x:996:994:Kubernetes user:/:/usr/sbin/nologin
+lp:x:4:7:lp:/var/spool/lpd:/usr/sbin/nologin
+mail:x:8:12:mail:/var/spool/mail:/usr/sbin/nologin
+nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/usr/sbin/nologin
+nobody:x:99:99:Kernel Overflow User:/:/usr/sbin/nologin
+operator:x:11:0:operator:/root:/usr/sbin/nologin
+polkitd:x:999:998:User for polkitd:/:/usr/sbin/nologin
+root:x:0:0:Super User:/root:/bin/bash
+rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/usr/sbin/nologin
+rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/usr/sbin/nologin
+shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
+sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/usr/sbin/nologin
+sssd:x:995:993:User for sssd:/:/usr/sbin/nologin
+sync:x:5:0:sync:/sbin:/bin/sync
+systemd-bus-proxy:x:989:988:systemd Bus Proxy:/:/usr/sbin/nologin
+systemd-network:x:991:990:systemd Network Management:/:/usr/sbin/nologin
+systemd-resolve:x:990:989:systemd Resolver:/:/usr/sbin/nologin
+systemd-timesync:x:993:991:systemd Time Synchronization:/:/usr/sbin/nologin
+tcpdump:x:72:72::/:/usr/sbin/nologin
diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml
index 79160b5..4cc389a 100644
--- a/fedora-iot-base.yaml
+++ b/fedora-iot-base.yaml
@@ -1,17 +1,18 @@
 include:
   - bootupd.yaml
-  # Enable composefs
+  # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2305291
+  - grub2-workaround.yaml
+  # Force disable composefs
   - composefs.yaml
-  # Read only sysroot
-  - sysroot-ro.yaml
-ref: fedora/rawhide/${basearch}/iot
+ref: fedora/stable/${basearch}/iot
 repos: []
 selinux: true
+ima: true
 tmp-is-dir: true
 recommends: false
 documentation: false
-automatic_version_prefix: '46'
-mutate-os-release: '46'
+automatic_version_prefix: '41'
+mutate-os-release: '41'
 initramfs-args:
 - "--no-hostonly"
 - "--add"
@@ -74,17 +75,17 @@ check-groups:
   type: file
   filename: group
 packages:
-# This list of packages should be kept in sync with 
+# This list of packages should be kept in sync with
 # the iot-commit definition is osbuild, as found here:
-# https://github.com/osbuild/images/blob/0584c20b0c14a89e833b875252114ceff61805e8/pkg/distro/fedora/package_sets.go#L123
+# https://github.com/osbuild/images/blob/0584c20b0c14a89e833b875252114ceff61805e8/pkg/distro/fedora/package_sets.go#L73
 - fedora-release-iot
 - fedora-iot-config
 - aardvark-dns
 - atheros-firmware
 - attr
 - authselect
+- basesystem
 - bash
-- bash-completion
 - bootc
 - brcmfmac-firmware
 - chrony
@@ -100,6 +101,7 @@ packages:
 - criu-libs
 - cryptsetup
 - curl
+- dbus-parsec
 - dnf5
 - dnf5-plugins
 - dosfstools
@@ -109,7 +111,6 @@ packages:
 - efibootmgr
 - fdo-client
 - fdo-owner-cli
-- filesystem
 - firewalld
 - fwupd
 - fwupd-efi
@@ -122,6 +123,7 @@ packages:
 - greenboot-default-health-checks
 - gzip
 - hostname
+- ignition
 - ignition-edge
 - ima-evm-utils
 - iproute
@@ -129,8 +131,8 @@ packages:
 - iwd
 - iwlwifi-mvm-firmware
 - kernel
+- kernel-tools
 - keyutils
-- kmscon
 - less
 - libsss_sudo
 - linux-firmware
@@ -145,9 +147,11 @@ packages:
 - openssh-server
 - passt
 - passt-selinux
+- parsec
 - pinentry
 - podman
 - policycoreutils
+- policycoreutils-python-utils
 - polkit
 - procps-ng
 - realtek-firmware
@@ -160,10 +164,10 @@ packages:
 - shadow-utils
 - skopeo
 - slirp4netns
+- ssh-key-dir
 - sssd-client
 - sudo
 - systemd
-- systemd-pam
 - systemd-resolved
 - tar
 - tmux
@@ -176,6 +180,7 @@ packages:
 - wireless-regdb
 - xfsprogs
 - xz
+- zezere-ignition
 - zram-generator
 - zram-generator-defaults
 packages-aarch64:
@@ -196,10 +201,13 @@ units:
 - fedora-iot-config-remote-fix.service
 - firewalld.service
 - sshd.service
-- systemd-firstboot.service
 - greenboot-grub2-set-counter.service
 - greenboot-grub2-set-success.service
 - greenboot-healthcheck.service
 - greenboot-rpm-ostree-grub2-check-fallback.service
 - greenboot-status.service
 - greenboot-task-runner.service
+- parsec.service
+- dbus-parsec.service
+- zezere_ignition.timer
+- zezere_ignition_banner.service
diff --git a/fedora-iot-bootc.yaml b/fedora-iot-bootc.yaml
index 6ae5882..475c0ca 100644
--- a/fedora-iot-bootc.yaml
+++ b/fedora-iot-bootc.yaml
@@ -1,9 +1,9 @@
-releasever: rawhide
+releasever: 41
 variables:
   distro: "fedora-iot"
 
 repos:
-  - fedora-rawhide
+  - fedora-41
 
 metadata:
   name: fedora-iot-bootc-base
diff --git a/fedora-iot-updates-stable.yaml b/fedora-iot-updates-stable.yaml
index 263bd4b..f8d1849 100644
--- a/fedora-iot-updates-stable.yaml
+++ b/fedora-iot-updates-stable.yaml
@@ -1,2 +1,2 @@
 include: fedora-iot-base.yaml
-ref: fedora/rawhide/${basearch}/updates/iot
+ref: fedora/stable/${basearch}/updates/iot
diff --git a/fedora-iot-updates-testing.yaml b/fedora-iot-updates-testing.yaml
index c6eb5a5..11cb696 100644
--- a/fedora-iot-updates-testing.yaml
+++ b/fedora-iot-updates-testing.yaml
@@ -1,2 +1,2 @@
 include: fedora-iot-base.yaml
-ref: fedora/rawhide/${basearch}/testing/iot
+ref: fedora/stable/${basearch}/testing/iot
diff --git a/fedora-iot.yaml b/fedora-iot.yaml
index b770dff..eee67dd 100644
--- a/fedora-iot.yaml
+++ b/fedora-iot.yaml
@@ -1,5 +1,4 @@
 include: fedora-iot-base.yaml
-ref: fedora/rawhide/${basearch}/iot
-
+ref: fedora/stable/${basearch}/iot
 repos:
-- fedora-46
+- fedora-41
diff --git a/grub2-workaround.yaml b/grub2-workaround.yaml
new file mode 100644
index 0000000..3b58a9e
--- /dev/null
+++ b/grub2-workaround.yaml
@@ -0,0 +1,22 @@
+# Temporarily disable new GRUB2 config options until we can ensure that we
+# have an updated bootloader via bootupd.
+# This is workaround for: https://bugzilla.redhat.com/show_bug.cgi?id=2305291
+# See: https://github.com/fedora-silverblue/issue-tracker/issues/587
+postprocess:
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+
+    # Completely disable this module
+    sed -i '2i exit 0' /etc/grub.d/25_bli
+
+    # Skip check that was not performed in previous Fedora versions
+    sed -i '/fwsetup --is-supported/d' /etc/grub.d/30_uefi-firmware
+    sed -i '/\tif/d'                   /etc/grub.d/30_uefi-firmware
+    sed -i '/\tfi/d'                   /etc/grub.d/30_uefi-firmware
+    sed -i 's/\t\t/\t/'                /etc/grub.d/30_uefi-firmware
+
+    # Verify that the content matches what we expect the file to look like.
+    # This will fail the build here instead of breaking users' systems.
+    hash="5a77a16c6a94e664e2e96a870f4531b9a0b4e63be1f46751d01e774629a8c84b"
+    echo "$hash  /etc/grub.d/30_uefi-firmware" | sha256sum -c
diff --git a/justfile b/justfile
deleted file mode 100644
index 3eaf256..0000000
--- a/justfile
+++ /dev/null
@@ -1,156 +0,0 @@
-# This is a justfile. See https://github.com/casey/just
-# This is only used for local development. The builds made on the Fedora
-# infrastructure are run via Pungi in a Koji runroot.
-
-# Set a default for some recipes
-default_variant := "fedora-iot"
-default_arch := "default"
-# Current default in Pungi
-force_nocache := "true"
-
-# Just doesn't have a native dict type, but quoted bash dictionary works fine
-pretty_names := '(
-    [fedora-iot]="IoT"
-)'
-
-# Default is to only validate the manifests
-all: validate
-
-# Basic validation to make sure the manifests are not completely broken
-validate:
-    ./ci/validate
-
-# Output the processed manifest for a given variant (defaults to Silverblue)
-manifest variant=default_variant:
-    #!/bin/bash
-    set -euo pipefail
-
-    rpm-ostree compose tree --print-only --repo=repo {{variant}}.yaml
-
-# Perform dependency resolution for a given variant (defaults to Silverblue)
-compose-dry-run variant=default_variant:
-    #!/bin/bash
-    set -euxo pipefail
-
-    mkdir -p repo cache logs
-    if [[ ! -f "repo/config" ]]; then
-        pushd repo > /dev/null || exit 1
-        ostree init --repo . --mode=bare-user
-        popd > /dev/null || exit 1
-    fi
-
-    rpm-ostree compose tree --unified-core --repo=repo --dry-run {{variant}}.yaml
-
-# Alias/shortcut for compose-image command
-compose variant=default_variant: (compose-image variant)
-
-# Compose a variant using the legacy non container path (defaults to Silverblue)
-compose-legacy variant=default_variant:
-    #!/bin/bash
-    set -euxo pipefail
-
-    declare -A pretty_names={{pretty_names}}
-    variant={{variant}}
-    variant_pretty=${pretty_names[$variant]-}
-    if [[ -z $variant_pretty ]]; then
-        echo "Unknown variant"
-        exit 1
-    fi
-
-    ./ci/validate > /dev/null || (echo "Failed manifest validation" && exit 1)
-
-    mkdir -p repo cache logs
-    if [[ ! -f "repo/config" ]]; then
-        pushd repo > /dev/null || exit 1
-        ostree init --repo . --mode=bare-user
-        popd > /dev/null || exit 1
-    fi
-    # Set option to reduce fsync for transient builds
-    ostree --repo=repo config set 'core.fsync' 'false'
-
-    buildid="$(date '+%Y%m%d.0')"
-    timestamp="$(date --iso-8601=sec)"
-    echo "${buildid}" > .buildid
-
-    version="$(rpm-ostree compose tree --print-only --repo=repo ${variant}.yaml | jq -r '."mutate-os-release"')"
-    echo "Composing ${variant_pretty} ${version}.${buildid} ..."
-
-    ARGS="--repo=repo --cachedir=cache"
-    ARGS+=" --unified-core"
-    if [[ {{force_nocache}} == "true" ]]; then
-        ARGS+=" --force-nocache"
-    fi
-    CMD="rpm-ostree"
-    if [[ ${EUID} -ne 0 ]]; then
-        CMD="sudo rpm-ostree"
-    fi
-
-    ${CMD} compose tree ${ARGS} \
-        --add-metadata-string="version=${variant_pretty} ${version}.${buildid}" \
-        "${variant}.yaml" \
-            |& tee "logs/${variant}_${version}_${buildid}.${timestamp}.log"
-
-    if [[ ${EUID} -ne 0 ]]; then
-        sudo chown --recursive "$(id --user --name):$(id --group --name)" repo cache
-    fi
-
-    ostree summary --repo=repo --update
-
-# Compose an Ostree Native Container OCI image
-compose-image variant=default_variant:
-    #!/bin/bash
-    set -euxo pipefail
-
-    declare -A pretty_names={{pretty_names}}
-    variant={{variant}}
-    variant_pretty=${pretty_names[$variant]-}
-    if [[ -z $variant_pretty ]]; then
-        echo "Unknown variant"
-        exit 1
-    fi
-
-    ./ci/validate > /dev/null || (echo "Failed manifest validation" && exit 1)
-
-    mkdir -p repo cache
-    if [[ ! -f "repo/config" ]]; then
-        pushd repo > /dev/null || exit 1
-        ostree init --repo . --mode=bare-user
-        popd > /dev/null || exit 1
-    fi
-    # Set option to reduce fsync for transient builds
-    ostree --repo=repo config set 'core.fsync' 'false'
-
-    buildid="$(date '+%Y%m%d.0')"
-    timestamp="$(date --iso-8601=sec)"
-    echo "${buildid}" > .buildid
-
-    version="$(rpm-ostree compose tree --print-only --repo=repo ${variant}.yaml | jq -r '."mutate-os-release"')"
-    echo "Composing ${variant_pretty} ${version}.${buildid} ..."
-
-    ARGS="--cachedir=cache --initialize"
-    if [[ {{force_nocache}} == "true" ]]; then
-        ARGS+=" --force-nocache"
-    fi
-    # To debug with gdb, use: gdb --args ...
-    CMD="rpm-ostree"
-    if [[ ${EUID} -ne 0 ]]; then
-        CMD="sudo rpm-ostree"
-    fi
-
-    ${CMD} compose image ${ARGS} \
-         --label="quay.expires-after=4w" \
-        "${variant}.yaml" \
-        "${variant}.ociarchive"
-
-# Clean up everything
-clean-all:
-    just clean-repo
-    just clean-cache
-
-# Only clean the ostree repo
-clean-repo:
-    rm -rf ./repo
-
-# Only clean the package and repo caches
-clean-cache:
-    rm -rf ./cache
diff --git a/sysroot-ro.yaml b/sysroot-ro.yaml
deleted file mode 100644
index 8214f05..0000000
--- a/sysroot-ro.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-# Set up default root config to mount sysroot as read only
-# https://fedoraproject.org/wiki/Changes/Silverblue_Kinoite_readonly_sysroot
-# See: https://gitlab.com/fedora/bootc/base-images/-/blob/main/tier-0/ostree.yaml
-# See: https://github.com/fedora-iot/iot-distro/issues/81
-
-postprocess:
-  - |
-    #!/usr/bin/env bash
-    set -xeuo pipefail
-
-    install -dm 0755 -o 0 -g 0 /usr/lib/ostree
-    cat >> /usr/lib/ostree/prepare-root.conf << 'EOF'
-    [sysroot]
-    readonly = true
-    EOF
diff --git a/treecompose-post.sh b/treecompose-post.sh
index e62b942..a47d8cf 100755
--- a/treecompose-post.sh
+++ b/treecompose-post.sh
@@ -18,7 +18,7 @@ done
 
 # Remove loader directory causing issues in Anaconda in unified core mode
 # Will be obsolete once we start using bootupd
-# See - https://forge.fedoraproject.org/atomic-desktops/config/pulls/344
+# See - https://pagure.io/workstation-ostree-config/pull-request/344
 rm -rf /usr/lib/ostree-boot/loader
 
 # Undo RPM scripts enabling units; we want the presets to be canonical