diff --git a/setup/build_linux b/setup/build_linux
index ec6b4a9f..71a9254c 100755
--- a/setup/build_linux
+++ b/setup/build_linux
@@ -116,48 +116,14 @@ function update_live_env() {
   username="tech"
   label="${KIT_NAME_SHORT}_LINUX"
 
+  # Boot config
+  cp "$ROOT_DIR/images/Syslinux.png" "$PROFILE_DIR/syslinux/splash.png"
+
   # MOTD
   sed -i -r "s/KIT_NAME_SHORT/$KIT_NAME_SHORT/" "$PROFILE_DIR/profiledef.sh"
   sed -i -r "s/KIT_NAME_FULL/$KIT_NAME_SHORT/" "$PROFILE_DIR/profiledef.sh"
   sed -i -r "s/SUPPORT_URL/$KIT_NAME_SHORT/" "$PROFILE_DIR/profiledef.sh"
 
-  # Boot config (legacy)
-  mkdir -p "$TEMP_DIR" 2>/dev/null
-  git clone --depth=1 https://github.com/ipxe/wimboot "$TEMP_DIR/wimboot"
-  rsync -aI "$TEMP_DIR/wimboot"/{LICENSE.txt,README.md,wimboot} "$PROFILE_DIR/syslinux/wimboot/"
-  cp "$ROOT_DIR/images/Pxelinux.png" "$PROFILE_DIR/syslinux/pxelinux.png"
-  cp "$ROOT_DIR/images/Syslinux.png" "$PROFILE_DIR/syslinux/syslinux.png"
-  sed -i -r "s/__+/$KIT_NAME_FULL/" "$PROFILE_DIR/syslinux/syslinux.cfg"
-
-  # Boot config (UEFI)
-  curl -Lo "$TEMP_DIR/refind.zip" "https://sourceforge.net/projects/refind/files/latest/download"
-  7z x -aoa "$TEMP_DIR/refind.zip" -o"$TEMP_DIR/refind"
-  cp "$ROOT_DIR/images/rEFInd.png" "$PROFILE_DIR/EFI/boot/rEFInd.png"
-  cp "$TEMP_DIR/refind"/refind*/"refind/refind_x64.efi" "$PROFILE_DIR/EFI/boot/bootx64.efi"
-  rsync -aI "$TEMP_DIR/refind"/refind*/refind/drivers_x64/ "$PROFILE_DIR/EFI/boot/drivers_x64/"
-  rsync -aI "$TEMP_DIR/refind"/refind*/refind/icons/ "$PROFILE_DIR/EFI/boot/icons/"
-  sed -i "s/%ARCHISO_LABEL%/${label}/" "$PROFILE_DIR/EFI/boot/refind.conf"
-
-  # Memtest86+ (Open Source)
-  mkdir -p "$PROFILE_DIR/EFI/memtest86+"
-  mkdir -p "$TEMP_DIR/memtest86+"
-  curl -Lo "$TEMP_DIR/memtest86+/memtest86-binaries.zip" "https://memtest.org/download/v6.10/mt86plus_6.10.binaries.zip"
-  7z e "$TEMP_DIR/memtest86+/memtest86-binaries.zip" -o"$TEMP_DIR/memtest86+" "memtest64.efi"
-  mv "$TEMP_DIR/memtest86+/memtest64.efi" "$PROFILE_DIR/EFI/memtest86+/bootx64.efi"
-
-  # Memtest86 (Passmark)
-  mkdir -p "$PROFILE_DIR/EFI/memtest86/Benchmark"
-  mkdir -p "$TEMP_DIR/memtest86"
-  curl -Lo "$TEMP_DIR/memtest86/memtest86-usb.zip" "https://www.memtest86.com/downloads/memtest86-usb.zip"
-  7z e -aoa "$TEMP_DIR/memtest86/memtest86-usb.zip" -o"$TEMP_DIR/memtest86" "memtest86-usb.img"
-  7z e -aoa "$TEMP_DIR/memtest86/memtest86-usb.img" -o"$TEMP_DIR/memtest86" "MemTest86.img"
-  7z x -aoa "$TEMP_DIR/memtest86/MemTest86.img" -o"$TEMP_DIR/memtest86"
-  rm "$TEMP_DIR/memtest86/EFI/BOOT/BOOTIA32.efi"
-  mv "$TEMP_DIR/memtest86/EFI/BOOT/BOOTX64.efi" "$PROFILE_DIR/EFI/memtest86/bootx64.efi"
-  mv "$TEMP_DIR/memtest86/EFI/BOOT"/* "$PROFILE_DIR/EFI/memtest86"/
-  mv "$TEMP_DIR/memtest86/help"/* "$PROFILE_DIR/EFI/memtest86"/
-  mv "$TEMP_DIR/memtest86/license.rtf" "$PROFILE_DIR/EFI/memtest86"/
-
   # Hostname
   echo "$hostname" > "$PROFILE_DIR/airootfs/etc/hostname"
   echo "127.0.1.1  $hostname.localdomain  $hostname" >> "$PROFILE_DIR/airootfs/etc/hosts"
@@ -176,9 +142,6 @@ function update_live_env() {
   # MOTD
   sed -i -r "s/_+/$KIT_NAME_FULL Linux Environment/" "$PROFILE_DIR/airootfs/etc/motd"
 
-  # Network
-  ln -s "/run/systemd/resolve/stub-resolv.conf" "$PROFILE_DIR/airootfs/etc/resolv.conf"
-
   # Oh My ZSH
   git clone --depth=1 https://github.com/robbyrussell/oh-my-zsh.git "$SKEL_DIR/.oh-my-zsh"
   rm -Rf "$SKEL_DIR/.oh-my-zsh/.git"
diff --git a/setup/linux/packages/base b/setup/linux/packages/base
index d00261b2..86c62704 100644
--- a/setup/linux/packages/base
+++ b/setup/linux/packages/base
@@ -10,6 +10,7 @@ bc
 bind
 bluez
 bluez-utils
+bolt
 btrfs-progs
 cbatticon
 chntpw
@@ -31,15 +32,21 @@ dosfstools
 dunst
 e2fsprogs
 edk2-shell
+efibootmgr
 evince
 exfatprogs
+f2fs-tools
+fatresize
 feh
 ffmpeg
 firefox
+foot-terminfo
 gnome-keyring
+gnu-netcat
 gparted
 gpicview
 gptfdisk
+grub
 gsmartcontrol
 hardinfo-gtk3
 hexedit
@@ -50,6 +57,7 @@ intel-ucode
 iwd
 iwgtk
 jfsutils
+kitty-terminfo
 ldns
 leafpad
 less
@@ -57,10 +65,13 @@ lha
 libewf
 libinput
 libldm
+libusb-compat
 libxft
 linux
 linux-firmware
+linux-firmware-marvell
 lm_sensors
+lsscsi
 lvm2
 lzip
 man-db
@@ -73,22 +84,31 @@ mesa-demos
 mesa-utils
 mkinitcpio
 mkinitcpio-archiso
+mkinitcpio-nfs-utils
 mkvtoolnix-cli
 mprime-bin
 mpv
 mtools
 nano
+nbd
 ncdu
+ndisc6
+nfs-utils
+nmap
 noto-fonts
 noto-fonts-cjk
+ntfs-3g
 numlockx
 nvme-cli
+open-iscsi
 openbox
 openssh
+openssh
 opensuperclone-git
 otf-font-awesome-4
 p7zip
 papirus-icon-theme
+parted
 perl
 picom
 pipes.sh
@@ -100,22 +120,25 @@ python-psutil
 python-pytz
 python-requests
 qemu-guest-agent
-qemu-guest-agent
-reiserfsprogs
+refind
 reiserfsprogs
 rfkill
 rofi
 rsync
 rxvt-unicode
 rxvt-unicode-terminfo
+sdparm
 smartmontools-svn
+sof-firmware
 speedtest-cli
 spice-vdagent
+squashfs-tools
 st
 sudo
 sysbench
 sysfsutils
 syslinux
+systemd-resolvconf
 systemd-sysvcompat
 terminus-font
 testdisk
@@ -125,6 +148,8 @@ tigervnc
 tint2
 tk
 tmux
+tpm2-tools
+tpm2-tss
 tree
 ttf-font-awesome-4
 ttf-hack
@@ -135,6 +160,8 @@ ufw
 unarj
 unrar
 unzip
+usb_modeswitch
+usbmuxd
 usbutils
 util-linux
 veracrypt
@@ -142,6 +169,7 @@ vim
 virtualbox-guest-utils
 volumeicon
 wd719x-firmware
+wezterm-terminfo
 which
 wimlib
 wmctrl
diff --git a/setup/linux/profile/airootfs/etc/mkinitcpio.conf b/setup/linux/profile/airootfs/etc/mkinitcpio.conf
deleted file mode 100644
index c37b19fc..00000000
--- a/setup/linux/profile/airootfs/etc/mkinitcpio.conf
+++ /dev/null
@@ -1,70 +0,0 @@
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-# vim:set ft=sh
-# MODULES
-# The following modules are loaded before any boot hooks are
-# run.  Advanced users may wish to specify all system modules
-# in this array.  For instance:
-#     MODULES=(piix ide_disk reiserfs)
-MODULES=()
-
-# BINARIES
-# This setting includes any additional binaries a given user may
-# wish into the CPIO image.  This is run last, so it may be used to
-# override the actual binaries included by a given hook
-# BINARIES are dependency parsed, so you may safely ignore libraries
-BINARIES=()
-
-# FILES
-# This setting is similar to BINARIES above, however, files are added
-# as-is and are not parsed in any way.  This is useful for config files.
-FILES=()
-
-# HOOKS
-# This is the most important setting in this file.  The HOOKS control the
-# modules and scripts added to the image, and what happens at boot time.
-# Order is important, and it is recommended that you do not change the
-# order in which HOOKS are added.  Run 'mkinitcpio -H <hook name>' for
-# help on a given hook.
-# 'base' is _required_ unless you know precisely what you are doing.
-# 'udev' is _required_ in order to automatically load modules
-# 'filesystems' is _required_ unless you specify your fs modules in MODULES
-# Examples:
-##   This setup specifies all modules in the MODULES setting above.
-##   No raid, lvm2, or encrypted root is needed.
-#    HOOKS=(base)
-#
-##   This setup will autodetect all modules for your system and should
-##   work as a sane default
-#    HOOKS=(base udev autodetect block filesystems)
-#
-##   This setup will generate a 'full' image which supports most systems.
-##   No autodetection is done.
-#    HOOKS=(base udev block filesystems)
-#
-##   This setup assembles a pata mdadm array with an encrypted root FS.
-##   Note: See 'mkinitcpio -H mdadm' for more information on raid devices.
-#    HOOKS=(base udev block mdadm encrypt filesystems)
-#
-##   This setup loads an lvm2 volume group on a usb device.
-#    HOOKS=(base udev block lvm2 filesystems)
-#
-##   NOTE: If you have /usr on a separate partition, you MUST include the
-#    usr, fsck and shutdown hooks.
-HOOKS=(base udev modconf memdisk archiso_shutdown archiso archiso_loop_mnt archiso_pxe_common archiso_pxe_nbd archiso_pxe_http archiso_pxe_nfs archiso_kms block filesystems keyboard)
-
-# COMPRESSION
-# Use this to compress the initramfs image. By default, gzip compression
-# is used. Use 'cat' to create an uncompressed image.
-#COMPRESSION="gzip"
-#COMPRESSION="bzip2"
-#COMPRESSION="lzma"
-COMPRESSION="xz"
-#COMPRESSION="lzop"
-#COMPRESSION="lz4"
-#COMPRESSION="zstd"
-
-# COMPRESSION_OPTIONS
-# Additional options for the compressor
-#COMPRESSION_OPTIONS=()
diff --git a/setup/linux/profile/airootfs/etc/mkinitcpio.conf.d/archiso.conf b/setup/linux/profile/airootfs/etc/mkinitcpio.conf.d/archiso.conf
new file mode 100644
index 00000000..b4b3095f
--- /dev/null
+++ b/setup/linux/profile/airootfs/etc/mkinitcpio.conf.d/archiso.conf
@@ -0,0 +1,2 @@
+HOOKS=(base udev modconf kms memdisk archiso archiso_loop_mnt archiso_pxe_common archiso_pxe_nbd archiso_pxe_http archiso_pxe_nfs block filesystems keyboard)
+COMPRESSION="xz"
diff --git a/setup/linux/profile/airootfs/etc/mkinitcpio.d/linux.preset b/setup/linux/profile/airootfs/etc/mkinitcpio.d/linux.preset
deleted file mode 100644
index 9f67184a..00000000
--- a/setup/linux/profile/airootfs/etc/mkinitcpio.d/linux.preset
+++ /dev/null
@@ -1,8 +0,0 @@
-# mkinitcpio preset file for the 'linux' package on archiso
-
-PRESETS=('archiso')
-
-ALL_kver='/boot/vmlinuz-linux'
-ALL_config='/etc/mkinitcpio.conf'
-
-archiso_image="/boot/initramfs-linux.img"
diff --git a/setup/linux/profile/airootfs/etc/resolv.conf b/setup/linux/profile/airootfs/etc/resolv.conf
new file mode 100644
index 00000000..a6a9a39f
--- /dev/null
+++ b/setup/linux/profile/airootfs/etc/resolv.conf
@@ -0,0 +1,23 @@
+# This is /run/systemd/resolve/stub-resolv.conf managed by man:systemd-resolved(8).
+# Do not edit.
+#
+# This file might be symlinked as /etc/resolv.conf. If you're looking at
+# /etc/resolv.conf and seeing this text, you have followed the symlink.
+#
+# This is a dynamic resolv.conf file for connecting local clients to the
+# internal DNS stub resolver of systemd-resolved. This file lists all
+# configured search domains.
+#
+# Run "resolvectl status" to see details about the uplink DNS servers
+# currently in use.
+#
+# Third party programs should typically not access this file directly, but only
+# through the symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a
+# different way, replace this symlink by a static file or a different symlink.
+#
+# See man:systemd-resolved.service(8) for details about the supported modes of
+# operation for /etc/resolv.conf.
+
+nameserver 127.0.0.53
+options edns0 trust-ad
+search .
diff --git a/setup/linux/profile/airootfs/etc/systemd/network.conf.d/ipv6-privacy-extensions.conf b/setup/linux/profile/airootfs/etc/systemd/network.conf.d/ipv6-privacy-extensions.conf
new file mode 100644
index 00000000..0e9ceb4e
--- /dev/null
+++ b/setup/linux/profile/airootfs/etc/systemd/network.conf.d/ipv6-privacy-extensions.conf
@@ -0,0 +1,2 @@
+[Network]
+IPv6PrivacyExtensions=yes
diff --git a/setup/linux/profile/airootfs/etc/systemd/network/20-ethernet.network b/setup/linux/profile/airootfs/etc/systemd/network/20-ethernet.network
index 37878b0c..4b0f9b37 100644
--- a/setup/linux/profile/airootfs/etc/systemd/network/20-ethernet.network
+++ b/setup/linux/profile/airootfs/etc/systemd/network/20-ethernet.network
@@ -1,10 +1,21 @@
 [Match]
+# Matching with "Type=ether" causes issues with containers because it also matches virtual Ethernet interfaces (veth*).
+# See https://bugs.archlinux.org/task/70892
+# Instead match by globbing the network interface name.
 Name=en*
 Name=eth*
 
 [Network]
 DHCP=yes
-IPv6PrivacyExtensions=yes
+MulticastDNS=yes
 
-[DHCP]
-RouteMetric=512
+# systemd-networkd does not set per-interface-type default route metrics
+# https://github.com/systemd/systemd/issues/17698
+# Explicitly set route metric, so that Ethernet is preferred over Wi-Fi and Wi-Fi is preferred over mobile broadband.
+# Use values from NetworkManager. From nm_device_get_route_metric_default in
+# https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/main/src/core/devices/nm-device.c
+[DHCPv4]
+RouteMetric=100
+
+[IPv6AcceptRA]
+RouteMetric=100
diff --git a/setup/linux/profile/airootfs/etc/systemd/network/20-wireless.network b/setup/linux/profile/airootfs/etc/systemd/network/20-wireless.network
deleted file mode 100644
index e1d624cc..00000000
--- a/setup/linux/profile/airootfs/etc/systemd/network/20-wireless.network
+++ /dev/null
@@ -1,10 +0,0 @@
-[Match]
-Name=wlp*
-Name=wlan*
-
-[Network]
-DHCP=yes
-IPv6PrivacyExtensions=yes
-
-[DHCP]
-RouteMetric=1024
diff --git a/setup/linux/profile/airootfs/etc/systemd/network/20-wlan.network b/setup/linux/profile/airootfs/etc/systemd/network/20-wlan.network
new file mode 100644
index 00000000..970eb704
--- /dev/null
+++ b/setup/linux/profile/airootfs/etc/systemd/network/20-wlan.network
@@ -0,0 +1,17 @@
+[Match]
+Name=wl*
+
+[Network]
+DHCP=yes
+MulticastDNS=yes
+
+# systemd-networkd does not set per-interface-type default route metrics
+# https://github.com/systemd/systemd/issues/17698
+# Explicitly set route metric, so that Ethernet is preferred over Wi-Fi and Wi-Fi is preferred over mobile broadband.
+# Use values from NetworkManager. From nm_device_get_route_metric_default in
+# https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/main/src/core/devices/nm-device.c
+[DHCPv4]
+RouteMetric=600
+
+[IPv6AcceptRA]
+RouteMetric=600
diff --git a/setup/linux/profile/airootfs/etc/systemd/network/20-wwan.network b/setup/linux/profile/airootfs/etc/systemd/network/20-wwan.network
new file mode 100644
index 00000000..625abbef
--- /dev/null
+++ b/setup/linux/profile/airootfs/etc/systemd/network/20-wwan.network
@@ -0,0 +1,16 @@
+[Match]
+Name=ww*
+
+[Network]
+DHCP=yes
+
+# systemd-networkd does not set per-interface-type default route metrics
+# https://github.com/systemd/systemd/issues/17698
+# Explicitly set route metric, so that Ethernet is preferred over Wi-Fi and Wi-Fi is preferred over mobile broadband.
+# Use values from NetworkManager. From nm_device_get_route_metric_default in
+# https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/main/src/core/devices/nm-device.c
+[DHCPv4]
+RouteMetric=700
+
+[IPv6AcceptRA]
+RouteMetric=700
diff --git a/setup/linux/profile/airootfs/etc/systemd/resolved.conf.d/archiso.conf b/setup/linux/profile/airootfs/etc/systemd/resolved.conf.d/archiso.conf
new file mode 100644
index 00000000..636f3bd6
--- /dev/null
+++ b/setup/linux/profile/airootfs/etc/systemd/resolved.conf.d/archiso.conf
@@ -0,0 +1,4 @@
+# Default systemd-resolved configuration for archiso
+
+[Resolve]
+MulticastDNS=yes
diff --git a/setup/linux/profile/airootfs/etc/systemd/system/etc-pacman.d-gnupg.mount b/setup/linux/profile/airootfs/etc/systemd/system/etc-pacman.d-gnupg.mount
index 4eab5513..038961e4 100644
--- a/setup/linux/profile/airootfs/etc/systemd/system/etc-pacman.d-gnupg.mount
+++ b/setup/linux/profile/airootfs/etc/systemd/system/etc-pacman.d-gnupg.mount
@@ -5,4 +5,4 @@ Description=Temporary /etc/pacman.d/gnupg directory
 What=tmpfs
 Where=/etc/pacman.d/gnupg
 Type=tmpfs
-Options=mode=0755
+Options=mode=0755,noswap
diff --git a/setup/linux/profile/airootfs/etc/systemd/system/pacman-init.service b/setup/linux/profile/airootfs/etc/systemd/system/pacman-init.service
index acd558f8..b8248843 100644
--- a/setup/linux/profile/airootfs/etc/systemd/system/pacman-init.service
+++ b/setup/linux/profile/airootfs/etc/systemd/system/pacman-init.service
@@ -1,13 +1,15 @@
 [Unit]
 Description=Initializes Pacman keyring
 Requires=etc-pacman.d-gnupg.mount
-After=etc-pacman.d-gnupg.mount
+After=etc-pacman.d-gnupg.mount time-sync.target
+BindsTo=etc-pacman.d-gnupg.mount
+Before=archlinux-keyring-wkd-sync.service
 
 [Service]
 Type=oneshot
 RemainAfterExit=yes
 ExecStart=/usr/bin/pacman-key --init
-ExecStart=/usr/bin/pacman-key --populate archlinux
+ExecStart=/usr/bin/pacman-key --populate
 
 [Install]
 WantedBy=multi-user.target
diff --git a/setup/linux/profile/airootfs/root/.gnupg/scdaemon.conf b/setup/linux/profile/airootfs/root/.gnupg/scdaemon.conf
new file mode 100644
index 00000000..e1f3d1fd
--- /dev/null
+++ b/setup/linux/profile/airootfs/root/.gnupg/scdaemon.conf
@@ -0,0 +1,4 @@
+disable-ccid
+disable-pinpad
+pcsc-driver /usr/lib/libpcsclite.so
+pcsc-shared
diff --git a/setup/linux/profile/efiboot/loader/entries/01-archiso-x86_64-linux.conf b/setup/linux/profile/efiboot/loader/entries/01-archiso-x86_64-linux.conf
index 05e5c9b9..8cdae03d 100644
--- a/setup/linux/profile/efiboot/loader/entries/01-archiso-x86_64-linux.conf
+++ b/setup/linux/profile/efiboot/loader/entries/01-archiso-x86_64-linux.conf
@@ -1,7 +1,7 @@
-title   %ARCHISO_LABEL%
+title    %ARCHISO_LABEL%
 sort-key 01
-linux   /%INSTALL_DIR%/boot/x86_64/vmlinuz-linux
-initrd  /%INSTALL_DIR%/boot/intel-ucode.img
-initrd  /%INSTALL_DIR%/boot/amd-ucode.img
-initrd  /%INSTALL_DIR%/boot/x86_64/initramfs-linux.img
-options archisobasedir=%INSTALL_DIR% archisolabel=%ARCHISO_LABEL%
+linux    /%INSTALL_DIR%/boot/x86_64/vmlinuz-linux
+initrd   /%INSTALL_DIR%/boot/intel-ucode.img
+initrd   /%INSTALL_DIR%/boot/amd-ucode.img
+initrd   /%INSTALL_DIR%/boot/x86_64/initramfs-linux.img
+options  archisobasedir=%INSTALL_DIR% archisodevice=UUID=%ARCHISO_UUID%
diff --git a/setup/linux/profile/efiboot/loader/entries/02-archiso-x86_64-ram-linux.conf b/setup/linux/profile/efiboot/loader/entries/02-archiso-x86_64-ram-linux.conf
deleted file mode 100644
index b721e2cc..00000000
--- a/setup/linux/profile/efiboot/loader/entries/02-archiso-x86_64-ram-linux.conf
+++ /dev/null
@@ -1,7 +0,0 @@
-title   %ARCHISO_LABEL% (Copy to RAM)
-sort-key 02
-linux   /%INSTALL_DIR%/boot/x86_64/vmlinuz-linux
-initrd  /%INSTALL_DIR%/boot/intel-ucode.img
-initrd  /%INSTALL_DIR%/boot/amd-ucode.img
-initrd  /%INSTALL_DIR%/boot/x86_64/initramfs-linux.img
-options archisobasedir=%INSTALL_DIR% archisolabel=%ARCHISO_LABEL% copytoram
diff --git a/setup/linux/profile/grub/grub.cfg b/setup/linux/profile/grub/grub.cfg
new file mode 100644
index 00000000..3486753c
--- /dev/null
+++ b/setup/linux/profile/grub/grub.cfg
@@ -0,0 +1,116 @@
+# Load partition table and file system modules
+insmod part_gpt
+insmod part_msdos
+insmod fat
+insmod iso9660
+insmod ntfs
+insmod ntfscomp
+insmod exfat
+insmod udf
+
+# Use graphics-mode output
+if loadfont "${prefix}/fonts/unicode.pf2" ; then
+    insmod all_video
+    set gfxmode="auto"
+    terminal_input console
+    terminal_output console
+fi
+
+# Enable serial console
+insmod serial
+insmod usbserial_common
+insmod usbserial_ftdi
+insmod usbserial_pl2303
+insmod usbserial_usbdebug
+if serial --unit=0 --speed=115200; then
+    terminal_input --append serial
+    terminal_output --append serial
+fi
+
+# Search for the ISO volume
+if [ -z "${ARCHISO_UUID}" ]; then
+    if [ -z "${ARCHISO_HINT}" ]; then
+        regexp --set=1:ARCHISO_HINT '^\(([^)]+)\)' "${cmdpath}"
+    fi
+    search --no-floppy --set=root --file '%ARCHISO_SEARCH_FILENAME%' --hint "${ARCHISO_HINT}"
+    probe --set ARCHISO_UUID --fs-uuid "${root}"
+fi
+
+# Get a human readable platform identifier
+if [ "${grub_platform}" == 'efi' ]; then
+    archiso_platform='UEFI'
+    if [ "${grub_cpu}" == 'x86_64' ]; then
+        archiso_platform="x64 ${archiso_platform}"
+    elif [ "${grub_cpu}" == 'i386' ]; then
+        archiso_platform="IA32 ${archiso_platform}"
+    else
+        archiso_platform="${grub_cpu} ${archiso_platform}"
+    fi
+elif [ "${grub_platform}" == 'pc' ]; then
+    archiso_platform='BIOS'
+else
+    archiso_platform="${grub_cpu} ${grub_platform}"
+fi
+
+# Set default menu entry
+default=archlinux
+timeout=15
+timeout_style=menu
+
+
+# Menu entries
+
+menuentry "Arch Linux install medium (%ARCH%, ${archiso_platform})" --class arch --class gnu-linux --class gnu --class os --id 'archlinux' {
+    set gfxpayload=keep
+    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux archisobasedir=%INSTALL_DIR% archisodevice=UUID=${ARCHISO_UUID}
+    initrd /%INSTALL_DIR%/boot/intel-ucode.img /%INSTALL_DIR%/boot/amd-ucode.img /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux.img
+}
+
+menuentry "Arch Linux install medium with speakup screen reader (%ARCH%, ${archiso_platform})" --hotkey s --class arch --class gnu-linux --class gnu --class os --id 'archlinux-accessibility' {
+    set gfxpayload=keep
+    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux archisobasedir=%INSTALL_DIR% archisodevice=UUID=${ARCHISO_UUID} accessibility=on
+    initrd /%INSTALL_DIR%/boot/intel-ucode.img /%INSTALL_DIR%/boot/amd-ucode.img /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux.img
+}
+
+
+if [ "${grub_platform}" == 'efi' -a "${grub_cpu}" == 'x86_64' -a -f '/boot/memtest86+/memtest.efi' ]; then
+    menuentry 'Run Memtest86+ (RAM test)' --class memtest86 --class memtest --class gnu --class tool {
+        set gfxpayload=800x600,1024x768
+        linux /boot/memtest86+/memtest.efi
+    }
+fi
+if [ "${grub_platform}" == 'pc' -a -f '/boot/memtest86+/memtest' ]; then
+    menuentry 'Run Memtest86+ (RAM test)' --class memtest86 --class memtest --class gnu --class tool {
+        set gfxpayload=800x600,1024x768
+        linux /boot/memtest86+/memtest
+    }
+fi
+if [ "${grub_platform}" == 'efi' ]; then
+    if [ "${grub_cpu}" == 'x86_64' -a -f '/shellx64.efi' ]; then
+        menuentry 'UEFI Shell' --class efi {
+            chainloader /shellx64.efi
+        }
+    elif [ "${grub_cpu}" == "i386" -a -f '/shellia32.efi' ]; then
+        menuentry 'UEFI Shell' --class efi {
+            chainloader /shellia32.efi
+        }
+    fi
+
+    menuentry 'UEFI Firmware Settings' --id 'uefi-firmware' {
+        fwsetup
+    }
+fi
+
+menuentry 'System shutdown' --class shutdown --class poweroff {
+    echo 'System shutting down...'
+    halt
+}
+
+menuentry 'System restart' --class reboot --class restart {
+    echo 'System rebooting...'
+    reboot
+}
+
+
+# GRUB init tune for accessibility
+play 600 988 1 1319 4
diff --git a/setup/linux/profile/grub/loopback.cfg b/setup/linux/profile/grub/loopback.cfg
new file mode 100644
index 00000000..3ee0d334
--- /dev/null
+++ b/setup/linux/profile/grub/loopback.cfg
@@ -0,0 +1,80 @@
+# https://www.supergrubdisk.org/wiki/Loopback.cfg
+
+# Search for the ISO volume
+search --no-floppy --set=archiso_img_dev --file "${iso_path}"
+probe --set archiso_img_dev_uuid --fs-uuid "${archiso_img_dev}"
+
+# Get a human readable platform identifier
+if [ "${grub_platform}" == 'efi' ]; then
+    archiso_platform='UEFI'
+    if [ "${grub_cpu}" == 'x86_64' ]; then
+        archiso_platform="x64 ${archiso_platform}"
+    elif [ "${grub_cpu}" == 'i386' ]; then
+        archiso_platform="IA32 ${archiso_platform}"
+    else
+        archiso_platform="${grub_cpu} ${archiso_platform}"
+    fi
+elif [ "${grub_platform}" == 'pc' ]; then
+    archiso_platform='BIOS'
+else
+    archiso_platform="${grub_cpu} ${grub_platform}"
+fi
+
+# Set default menu entry
+default=archlinux
+timeout=15
+timeout_style=menu
+
+
+# Menu entries
+
+menuentry "Arch Linux install medium (%ARCH%, ${archiso_platform})" --class arch --class gnu-linux --class gnu --class os --id 'archlinux' {
+    set gfxpayload=keep
+    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux archisobasedir=%INSTALL_DIR% img_dev=UUID=${archiso_img_dev_uuid} img_loop="${iso_path}"
+    initrd /%INSTALL_DIR%/boot/intel-ucode.img /%INSTALL_DIR%/boot/amd-ucode.img /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux.img
+}
+
+menuentry "Arch Linux install medium with speakup screen reader (%ARCH%, ${archiso_platform})" --hotkey s --class arch --class gnu-linux --class gnu --class os --id 'archlinux-accessibility' {
+    set gfxpayload=keep
+    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux archisobasedir=%INSTALL_DIR% img_dev=UUID=${archiso_img_dev_uuid} img_loop="${iso_path}" accessibility=on
+    initrd /%INSTALL_DIR%/boot/intel-ucode.img /%INSTALL_DIR%/boot/amd-ucode.img /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux.img
+}
+
+
+if [ "${grub_platform}" == 'efi' -a "${grub_cpu}" == 'x86_64' -a -f '/boot/memtest86+/memtest.efi' ]; then
+    menuentry 'Run Memtest86+ (RAM test)' --class memtest86 --class memtest --class gnu --class tool {
+        set gfxpayload=800x600,1024x768
+        linux /boot/memtest86+/memtest.efi
+    }
+fi
+if [ "${grub_platform}" == 'pc' -a -f '/boot/memtest86+/memtest' ]; then
+    menuentry 'Run Memtest86+ (RAM test)' --class memtest86 --class memtest --class gnu --class tool {
+        set gfxpayload=800x600,1024x768
+        linux /boot/memtest86+/memtest
+    }
+fi
+if [ "${grub_platform}" == 'efi' ]; then
+    if [ "${grub_cpu}" == 'x86_64' -a -f '/shellx64.efi' ]; then
+        menuentry 'UEFI Shell' --class efi {
+            chainloader /shellx64.efi
+        }
+    elif [ "${grub_cpu}" == "i386" -a -f '/shellia32.efi' ]; then
+        menuentry 'UEFI Shell' --class efi {
+            chainloader /shellia32.efi
+        }
+    fi
+
+    menuentry 'UEFI Firmware Settings' --id 'uefi-firmware' {
+        fwsetup
+    }
+fi
+
+menuentry 'System shutdown' --class shutdown --class poweroff {
+    echo 'System shutting down...'
+    halt
+}
+
+menuentry 'System restart' --class reboot --class restart {
+    echo 'System rebooting...'
+    reboot
+}
diff --git a/setup/linux/profile/profiledef.sh b/setup/linux/profile/profiledef.sh
index 3a4e1386..87c36ecd 100644
--- a/setup/linux/profile/profiledef.sh
+++ b/setup/linux/profile/profiledef.sh
@@ -8,16 +8,19 @@ iso_application="KIT_NAME_FULL Linux Environment"
 iso_version="$(date +%Y-%m-%d)"
 install_dir="arch"
 buildmodes=('iso')
-bootmodes=('bios.syslinux.mbr' 'bios.syslinux.eltorito')
+bootmodes=('bios.syslinux.mbr' 'bios.syslinux.eltorito'
+           'uefi-ia32.grub.esp' 'uefi-x64.grub.esp'
+           'uefi-ia32.grub.eltorito' 'uefi-x64.grub.eltorito')
 arch="x86_64"
 pacman_conf="pacman.conf"
 airootfs_image_type="squashfs"
 airootfs_image_tool_options=('-comp' 'xz' '-Xbcj' 'x86' '-b' '1M' '-Xdict-size' '1M')
 file_permissions=(
-  ["/root"]="0:0:750"
-  ["/etc/shadow"]="0:0:400"
   ["/etc/gshadow"]="0:0:400"
+  ["/etc/shadow"]="0:0:400"
   ["/etc/skel/.ssh"]="0:0:700"
   ["/etc/skel/.ssh/authorized_keys"]="0:0:600"
   ["/etc/skel/.ssh/id_rsa"]="0:0:600"
+  ["/root"]="0:0:750"
+  ["/root/.gnupg"]="0:0:700"
 )
diff --git a/setup/linux/profile/syslinux/archiso_head.cfg b/setup/linux/profile/syslinux/archiso_head.cfg
new file mode 100644
index 00000000..671ab4e7
--- /dev/null
+++ b/setup/linux/profile/syslinux/archiso_head.cfg
@@ -0,0 +1,28 @@
+SERIAL 0 115200
+UI vesamenu.c32
+MENU TITLE Arch Linux
+MENU BACKGROUND splash.png
+
+MENU WIDTH 78
+MENU MARGIN 4
+MENU ROWS 7
+MENU VSHIFT 10
+MENU TABMSGROW 14
+MENU CMDLINEROW 14
+MENU HELPMSGROW 16
+MENU HELPMSGENDROW 29
+
+# Refer to https://wiki.syslinux.org/wiki/index.php/Comboot/menu.c32
+
+MENU COLOR border       30;44   #40ffffff #a0000000 std
+MENU COLOR title        1;36;44 #9033ccff #a0000000 std
+MENU COLOR sel          7;37;40 #e0ffffff #20ffffff all
+MENU COLOR unsel        37;44   #50ffffff #a0000000 std
+MENU COLOR help         37;40   #c0ffffff #a0000000 std
+MENU COLOR timeout_msg  37;40   #80ffffff #00000000 std
+MENU COLOR timeout      1;37;40 #c0ffffff #00000000 std
+MENU COLOR msg07        37;40   #90ffffff #a0000000 std
+MENU COLOR tabmsg       31;40   #30ffffff #00000000 std
+
+MENU CLEAR
+MENU IMMEDIATE
diff --git a/setup/linux/profile/syslinux/archiso_pxe-linux.cfg b/setup/linux/profile/syslinux/archiso_pxe-linux.cfg
new file mode 100644
index 00000000..305b8fd2
--- /dev/null
+++ b/setup/linux/profile/syslinux/archiso_pxe-linux.cfg
@@ -0,0 +1,32 @@
+LABEL arch64_nbd
+TEXT HELP
+Boot the Arch Linux install medium using NBD.
+It allows you to install Arch Linux or perform system maintenance.
+ENDTEXT
+MENU LABEL Arch Linux install medium (x86_64, NBD)
+LINUX ::/%INSTALL_DIR%/boot/x86_64/vmlinuz-linux
+INITRD ::/%INSTALL_DIR%/boot/intel-ucode.img,::/%INSTALL_DIR%/boot/amd-ucode.img,::/%INSTALL_DIR%/boot/x86_64/initramfs-linux.img
+APPEND archisobasedir=%INSTALL_DIR% archisodevice=UUID=%ARCHISO_UUID% archiso_nbd_srv=${pxeserver} cms_verify=y
+SYSAPPEND 3
+
+LABEL arch64_nfs
+TEXT HELP
+Boot the Arch Linux live medium using NFS.
+It allows you to install Arch Linux or perform system maintenance.
+ENDTEXT
+MENU LABEL Arch Linux install medium (x86_64, NFS)
+LINUX ::/%INSTALL_DIR%/boot/x86_64/vmlinuz-linux
+INITRD ::/%INSTALL_DIR%/boot/intel-ucode.img,::/%INSTALL_DIR%/boot/amd-ucode.img,::/%INSTALL_DIR%/boot/x86_64/initramfs-linux.img
+APPEND archisobasedir=%INSTALL_DIR% archiso_nfs_srv=${pxeserver}:/run/archiso/bootmnt cms_verify=y
+SYSAPPEND 3
+
+LABEL arch64_http
+TEXT HELP
+Boot the Arch Linux live medium using HTTP.
+It allows you to install Arch Linux or perform system maintenance.
+ENDTEXT
+MENU LABEL Arch Linux install medium (x86_64, HTTP)
+LINUX ::/%INSTALL_DIR%/boot/x86_64/vmlinuz-linux
+INITRD ::/%INSTALL_DIR%/boot/intel-ucode.img,::/%INSTALL_DIR%/boot/amd-ucode.img,::/%INSTALL_DIR%/boot/x86_64/initramfs-linux.img
+APPEND archisobasedir=%INSTALL_DIR% archiso_http_srv=http://${pxeserver}/ cms_verify=y
+SYSAPPEND 3
diff --git a/setup/linux/profile/syslinux/archiso_pxe.cfg b/setup/linux/profile/syslinux/archiso_pxe.cfg
new file mode 100644
index 00000000..b4c9a804
--- /dev/null
+++ b/setup/linux/profile/syslinux/archiso_pxe.cfg
@@ -0,0 +1,5 @@
+INCLUDE archiso_head.cfg
+
+INCLUDE archiso_pxe-linux.cfg
+
+INCLUDE archiso_tail.cfg
diff --git a/setup/linux/profile/syslinux/archiso_sys-linux.cfg b/setup/linux/profile/syslinux/archiso_sys-linux.cfg
new file mode 100644
index 00000000..950dc48c
--- /dev/null
+++ b/setup/linux/profile/syslinux/archiso_sys-linux.cfg
@@ -0,0 +1,20 @@
+LABEL arch64
+TEXT HELP
+Boot the Arch Linux install medium on BIOS.
+It allows you to install Arch Linux or perform system maintenance.
+ENDTEXT
+MENU LABEL Arch Linux install medium (x86_64, BIOS)
+LINUX /%INSTALL_DIR%/boot/x86_64/vmlinuz-linux
+INITRD /%INSTALL_DIR%/boot/intel-ucode.img,/%INSTALL_DIR%/boot/amd-ucode.img,/%INSTALL_DIR%/boot/x86_64/initramfs-linux.img
+APPEND archisobasedir=%INSTALL_DIR% archisodevice=UUID=%ARCHISO_UUID%
+
+# Accessibility boot option
+LABEL arch64speech
+TEXT HELP
+Boot the Arch Linux install medium on BIOS with speakup screen reader.
+It allows you to install Arch Linux or perform system maintenance with speech feedback.
+ENDTEXT
+MENU LABEL Arch Linux install medium (x86_64, BIOS) with ^speech
+LINUX /%INSTALL_DIR%/boot/x86_64/vmlinuz-linux
+INITRD /%INSTALL_DIR%/boot/intel-ucode.img,/%INSTALL_DIR%/boot/amd-ucode.img,/%INSTALL_DIR%/boot/x86_64/initramfs-linux.img
+APPEND archisobasedir=%INSTALL_DIR% archisodevice=UUID=%ARCHISO_UUID% accessibility=on
diff --git a/setup/linux/profile/syslinux/archiso_sys.cfg b/setup/linux/profile/syslinux/archiso_sys.cfg
new file mode 100644
index 00000000..d93bcfe6
--- /dev/null
+++ b/setup/linux/profile/syslinux/archiso_sys.cfg
@@ -0,0 +1,8 @@
+INCLUDE archiso_head.cfg
+
+DEFAULT arch64
+TIMEOUT 150
+
+INCLUDE archiso_sys-linux.cfg
+
+INCLUDE archiso_tail.cfg
diff --git a/setup/linux/profile/syslinux/archiso_tail.cfg b/setup/linux/profile/syslinux/archiso_tail.cfg
new file mode 100644
index 00000000..e84897c5
--- /dev/null
+++ b/setup/linux/profile/syslinux/archiso_tail.cfg
@@ -0,0 +1,35 @@
+LABEL existing
+TEXT HELP
+Boot an existing operating system.
+Press TAB to edit the disk and partition number to boot.
+ENDTEXT
+MENU LABEL Boot existing OS
+COM32 chain.c32
+APPEND hd0 0
+
+# https://www.memtest.org/
+LABEL memtest
+MENU LABEL Run Memtest86+ (RAM test)
+LINUX /boot/memtest86+/memtest
+
+# https://wiki.syslinux.org/wiki/index.php/Hdt_(Hardware_Detection_Tool)
+LABEL hdt
+MENU LABEL Hardware Information (HDT)
+COM32 hdt.c32
+APPEND modules_alias=hdt/modalias.gz pciids=hdt/pciids.gz
+
+LABEL reboot
+TEXT HELP
+Reboot computer.
+The computer's firmware must support APM.
+ENDTEXT
+MENU LABEL Reboot
+COM32 reboot.c32
+
+LABEL poweroff
+TEXT HELP
+Power off computer.
+The computer's firmware must support APM.
+ENDTEXT
+MENU LABEL Power Off
+COM32 poweroff.c32
diff --git a/setup/linux/profile/syslinux/linux.cfg b/setup/linux/profile/syslinux/linux.cfg
deleted file mode 100644
index 49864347..00000000
--- a/setup/linux/profile/syslinux/linux.cfg
+++ /dev/null
@@ -1,21 +0,0 @@
-LABEL wk_linux
-TEXT HELP
-A live Linux environment
-  * HW diagnostics, file-based backups, data recovery, etc
-ENDTEXT
-MENU LABEL Linux
-LINUX /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux
-INITRD /%INSTALL_DIR%/boot/intel-ucode.img,/%INSTALL_DIR%/boot/amd-ucode.img,/%INSTALL_DIR%/boot/x86_64/initramfs-linux.img
-APPEND archisobasedir=%INSTALL_DIR% archisolabel=%ARCHISO_LABEL% copytoram loglevel=3
-
-LABEL wk_linux_cli
-TEXT HELP
-A live Linux environment (CLI)
-  * HW diagnostics, file-based backups, data recovery, etc
-ENDTEXT
-MENU LABEL Linux (CLI)
-LINUX /%INSTALL_DIR%/boot/x86_64/vmlinuz-linux
-INITRD /%INSTALL_DIR%/boot/intel-ucode.img,/%INSTALL_DIR%/boot/amd-ucode.img,/%INSTALL_DIR%/boot/x86_64/initramfs-linux.img
-APPEND archisobasedir=%INSTALL_DIR% archisolabel=%ARCHISO_LABEL% copytoram nox
-SYSAPPEND 3
-
diff --git a/setup/linux/profile/syslinux/memtest.cfg b/setup/linux/profile/syslinux/memtest.cfg
deleted file mode 100644
index 624e526b..00000000
--- a/setup/linux/profile/syslinux/memtest.cfg
+++ /dev/null
@@ -1,8 +0,0 @@
-# http://www.memtest.org/
-LABEL memtest
-MENU LABEL Memtest86+
-TEXT HELP
-Perform RAM diagnostics
-  * This utility is not recommended for testing DDR4 RAM
-ENDTEXT
-LINUX /%INSTALL_DIR%/boot/memtest
diff --git a/setup/linux/profile/syslinux/splash.png b/setup/linux/profile/syslinux/splash.png
index e69de29b..64b959a6 100644
Binary files a/setup/linux/profile/syslinux/splash.png and b/setup/linux/profile/syslinux/splash.png differ
diff --git a/setup/linux/profile/syslinux/syslinux.cfg b/setup/linux/profile/syslinux/syslinux.cfg
index 06a33949..cbda72f2 100644
--- a/setup/linux/profile/syslinux/syslinux.cfg
+++ b/setup/linux/profile/syslinux/syslinux.cfg
@@ -1,53 +1,11 @@
-SERIAL 0 115200
-UI vesamenu.c32
-MENU TITLE _______
-MENU BACKGROUND syslinux.png
+DEFAULT select
 
-MENU WIDTH 80
-MENU MARGIN 10
-MENU ROWS 15
-MENU VSHIFT 2
-MENU TABMSGROW 22
-MENU CMDLINEROW 22
-MENU HELPMSGROW 24
-MENU HELPMSGENDROW -1
-MENU TABMSG
+LABEL select
+COM32 whichsys.c32
+APPEND -pxe- pxe -sys- sys -iso- sys
 
-# Refer to http://syslinux.zytor.com/wiki/index.php/Doc/menu
+LABEL pxe
+CONFIG archiso_pxe.cfg
 
-MENU COLOR screen       30;44   #a0000000 #a0000000 none
-MENU COLOR border       30;44   #a0000000 #a0000000 none
-MENU COLOR title        1;36;44 #9033ccff #a0000000 none
-MENU COLOR sel          7;37;40 #e0ffffff #a0000000 std
-MENU COLOR disabled     37;44   #50ffffff #a0000000 none
-MENU COLOR unsel        37;44   #50ffffff #a0000000 none
-MENU COLOR help         37;40   #c0ffffff #a0000000 none
-MENU COLOR tabmsg       30;44   #a0000000 #a0000000 none
-MENU COLOR cmdmark      1;36;44 #9033ccff #a0000000 none
-MENU COLOR cmdline      37;40   #c0ffffff #a0000000 none
-MENU COLOR timeout_msg  37;40   #80ffffff #a0000000 none
-MENU COLOR timeout      1;37;40 #c0ffffff #a0000000 none
-MENU COLOR msg07        37;40   #90ffffff #a0000000 none
-MENU COLOR tabmsg       31;40   #30ffffff #a0000000 none
-
-# Start entries
-MENU SEPARATOR
-
-MENU CLEAR
-
-DEFAULT wk_linux
-TIMEOUT 0
-
-INCLUDE linux.cfg
-INCLUDE memtest.cfg
-#UFD-WINPE#INCLUDE winpe.cfg
-
-MENU SEPARATOR
-
-LABEL reboot
-MENU LABEL Reboot
-COM32 reboot.c32
-
-LABEL poweroff
-MENU LABEL Power Off
-COM32 poweroff.c32
+LABEL sys
+CONFIG archiso_sys.cfg
diff --git a/setup/linux/profile/syslinux/winpe.cfg b/setup/linux/profile/syslinux/winpe.cfg
deleted file mode 100644
index 7665a77d..00000000
--- a/setup/linux/profile/syslinux/winpe.cfg
+++ /dev/null
@@ -1,8 +0,0 @@
-LABEL wk_winpe
-TEXT HELP
-A live Windows environment
-  * Create partition backups, Install Windows, etc
-ENDTEXT
-MENU LABEL Windows PE
-COM32 linux.c32
-APPEND wimboot/wimboot gui initrdfile=/sources/bootmgr,/sources/BCD,/sources/boot.sdi,/sources/boot.wim