diff --git a/bootupd.yaml b/bootupd.yaml
index 61a6a9a..2d50c71 100644
--- a/bootupd.yaml
+++ b/bootupd.yaml
@@ -12,21 +12,14 @@ postprocess:
     # Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload
     /usr/bin/bootupctl backend generate-update-metadata
 
-    # Trigger a bootloader update on boot
-    cat > /usr/lib/systemd/system/bootloader-update.service << 'EOF'
-    [Unit]
-    Description=Update bootloader on boot
-    Documentation=https://github.com/coreos/bootupd
-    ConditionFirmware=uefi
-      
+    # Enable migration to a static GRUB config
+    install -dm0755 /usr/lib/systemd/system/bootloader-update.service.d
+    cat > /usr/lib/systemd/system/bootloader-update.service.d/migrate-static-grub-config.conf << 'EOF'
     [Service]
-    Type=oneshot
-    ExecStart=/usr/bin/bootupctl update
-    RemainAfterExit=yes
-    MountFlags=slave
-                  
-    [Install]     
-    WantedBy=multi-user.target
+    ExecStart=/usr/bin/bootupctl migrate-static-grub-config
     EOF
-    chmod 644 /usr/lib/systemd/system/bootloader-update.service
-    echo "enable bootloader-update.service" > /usr/lib/systemd/system-preset/81-iot.preset
\ No newline at end of file
+    
+    echo "enable bootloader-update.service" >> /usr/lib/systemd/system-preset/80-iot.preset
+
+    # Turn permissive mode on for bootupd until all SELinux issues are fixed
+    semanage permissive --noreload --add bootupd_t
diff --git a/composefs.yaml b/composefs.yaml
new file mode 100644
index 0000000..1081a8c
--- /dev/null
+++ b/composefs.yaml
@@ -0,0 +1,13 @@
+# Enable composefs
+# See: https://fedoraproject.org/wiki/Changes/ComposefsAtomicDesktops
+# https://fedoraproject.org/wiki/Changes/ComposefsAtomicCoreOSIoT
+postprocess:
+  - |
+    #!/usr/bin/env bash 
+    set -xeuo pipefail
+
+    cat >> /usr/lib/ostree/prepare-root.conf << 'EOF'
+    [composefs]
+    enabled = yes
+    EOF
+
diff --git a/config.ini b/config.ini
index f7e27f5..c0887d3 100644
--- a/config.ini
+++ b/config.ini
@@ -11,8 +11,8 @@ tree_name   = docker-host
 tree_file   = %(os_name)s-%(tree_name)s.json
 arch        = x86_64
 release     = f42
-ref         = %(os_name)s/rawhide/%(arch)s/%(tree_name)s
-yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/
+ref         = %(os_name)s/stable/%(arch)s/%(tree_name)s
+yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/releases/42/Everything/%(arch)s/os/
 # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides
 lorax_include_packages = fedora-productimg-iot
 docker_os_name = fedora
diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml
index e6358e3..b0967de 100644
--- a/fedora-iot-base.yaml
+++ b/fedora-iot-base.yaml
@@ -1,11 +1,12 @@
 include: 
   - bootupd.yaml
-  # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2305291
-  - grub2-workaround.yaml
-ref: fedora/rawhide/${basearch}/iot
+  # Enable composefs
+  - composefs.yaml
+  # Read only sysroot
+  - sysroot-ro.yaml
+ref: fedora/stable/${basearch}/iot
 repos: []
 selinux: true
-ima: true
 tmp-is-dir: true
 recommends: false
 documentation: false
@@ -100,7 +101,6 @@ packages:
 - criu-libs
 - cryptsetup
 - curl
-- dbus-parsec
 - dnf5
 - dnf5-plugins
 - dosfstools
@@ -130,7 +130,6 @@ packages:
 - iwd
 - iwlwifi-mvm-firmware
 - kernel
-- kernel-tools
 - keyutils
 - less
 - libsss_sudo
@@ -146,11 +145,9 @@ packages:
 - openssh-server
 - passt
 - passt-selinux
-- parsec
 - pinentry
 - podman
 - policycoreutils
-- policycoreutils-python-utils
 - polkit
 - procps-ng
 - realtek-firmware
@@ -179,7 +176,6 @@ packages:
 - wireless-regdb
 - xfsprogs
 - xz
-- zezere-ignition
 - zram-generator
 - zram-generator-defaults
 packages-aarch64:
@@ -200,13 +196,10 @@ units:
 - fedora-iot-config-remote-fix.service
 - firewalld.service
 - sshd.service
+- systemd-firstboot.service
 - greenboot-grub2-set-counter.service
 - greenboot-grub2-set-success.service
 - greenboot-healthcheck.service
 - greenboot-rpm-ostree-grub2-check-fallback.service
 - greenboot-status.service
 - greenboot-task-runner.service
-- parsec.service
-- dbus-parsec.service
-- zezere_ignition.timer
-- zezere_ignition_banner.service
diff --git a/fedora-iot-updates-stable.yaml b/fedora-iot-updates-stable.yaml
index 263bd4b..f8d1849 100644
--- a/fedora-iot-updates-stable.yaml
+++ b/fedora-iot-updates-stable.yaml
@@ -1,2 +1,2 @@
 include: fedora-iot-base.yaml
-ref: fedora/rawhide/${basearch}/updates/iot
+ref: fedora/stable/${basearch}/updates/iot
diff --git a/fedora-iot-updates-testing.yaml b/fedora-iot-updates-testing.yaml
index c6eb5a5..11cb696 100644
--- a/fedora-iot-updates-testing.yaml
+++ b/fedora-iot-updates-testing.yaml
@@ -1,2 +1,2 @@
 include: fedora-iot-base.yaml
-ref: fedora/rawhide/${basearch}/testing/iot
+ref: fedora/stable/${basearch}/testing/iot
diff --git a/fedora-iot.yaml b/fedora-iot.yaml
index f765bfe..b6018eb 100644
--- a/fedora-iot.yaml
+++ b/fedora-iot.yaml
@@ -1,4 +1,4 @@
 include: fedora-iot-base.yaml
-ref: fedora/rawhide/${basearch}/iot
+ref: fedora/stable/${basearch}/iot
 repos:
 - fedora-42
diff --git a/grub2-workaround.yaml b/grub2-workaround.yaml
deleted file mode 100644
index 3b58a9e..0000000
--- a/grub2-workaround.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Temporarily disable new GRUB2 config options until we can ensure that we
-# have an updated bootloader via bootupd.
-# This is workaround for: https://bugzilla.redhat.com/show_bug.cgi?id=2305291
-# See: https://github.com/fedora-silverblue/issue-tracker/issues/587
-postprocess:
-  - |
-    #!/usr/bin/env bash
-    set -xeuo pipefail
-
-    # Completely disable this module
-    sed -i '2i exit 0' /etc/grub.d/25_bli
-
-    # Skip check that was not performed in previous Fedora versions
-    sed -i '/fwsetup --is-supported/d' /etc/grub.d/30_uefi-firmware
-    sed -i '/\tif/d'                   /etc/grub.d/30_uefi-firmware
-    sed -i '/\tfi/d'                   /etc/grub.d/30_uefi-firmware
-    sed -i 's/\t\t/\t/'                /etc/grub.d/30_uefi-firmware
-
-    # Verify that the content matches what we expect the file to look like.
-    # This will fail the build here instead of breaking users' systems.
-    hash="5a77a16c6a94e664e2e96a870f4531b9a0b4e63be1f46751d01e774629a8c84b"
-    echo "$hash  /etc/grub.d/30_uefi-firmware" | sha256sum -c
diff --git a/sysroot-ro.yaml b/sysroot-ro.yaml
new file mode 100644
index 0000000..46bc791
--- /dev/null
+++ b/sysroot-ro.yaml
@@ -0,0 +1,14 @@
+# Set up default root config to mount sysroot as read only
+# See: https://github.com/fedora-iot/iot-distro/issues/81
+# https://fedoraproject.org/wiki/Changes/Silverblue_Kinoite_readonly_sysroot
+
+postprocess:
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+
+    install -dm 0755 -o 0 -g 0 /usr/lib/ostree
+    cat >> /usr/lib/ostree/prepare-root.conf << 'EOF'
+    [sysroot]
+    readonly = true
+    EOF