Login and UKI updates (#2242)

* Change DM to SDDM

* Move to custom named UKI

* Skip creation on Mac

* Add entry to make sure VSCode uses gnome keyring

* Fix order for UKI generation

* Limine only

* BTRFS only

* Add checks for possible issues

* Remove

* Add verification to omarchy-pkg-add and speed up installs

* Use omarchy-pkg-add

* Update files to include dirs

* Fix relaunch

bin/omarchy-install-vscode

@@ -0,0 +1,21 @@
+#!/bin/bash
+
+echo "Installing VSCode..."
+omarchy-pkg-add visual-studio-code-bin
+
+mkdir -p ~/.vscode
+
+cat > ~/.vscode/argv.json << 'EOF'
+// This configuration file allows you to pass permanent command line arguments to VS Code.
+// Only a subset of arguments is currently supported to reduce the likelihood of breaking
+// the installation.
+//
+// PLEASE DO NOT CHANGE WITHOUT UNDERSTANDING THE IMPACT
+//
+// NOTE: Changing this file requires a restart of VS Code.
+{
+  "password-store":"gnome-libsecret"
+}
+EOF
+
+setsid gtk-launch code

bin/omarchy-menu

@@ -260,7 +260,7 @@ show_install_service_menu() {
 
 show_install_editor_menu() {
   case $(menu "Install" "  VSCode\n  Cursor\n  Zed\n  Sublime Text\n  Helix\n  Emacs") in
-  *VSCode*) install_and_launch "VSCode" "visual-studio-code-bin" "code" ;;
+  *VSCode*) present_terminal omarchy-install-vscode ;;
   *Cursor*) install_and_launch "Cursor" "cursor-bin" "cursor" ;;
   *Zed*) install_and_launch "Zed" "zed" "dev.zed.Zed" ;;
   *Sublime*) aur_install_and_launch "Sublime Text" "sublime-text-4" "sublime_text" ;;
@@ -452,7 +452,7 @@ show_system_menu() {
   *Lock*) omarchy-lock-screen ;;
   *Screensaver*) omarchy-launch-screensaver force ;;
   *Suspend*) systemctl suspend ;;
-  *Relaunch*) omarchy-state clear relaunch-required && uwsm stop ;;
+  *Relaunch*) omarchy-state clear relaunch-required && sudo systemctl restart sddm ;;
   *Restart*) omarchy-state clear re*-required && systemctl reboot ;;
   *Shutdown*) omarchy-state clear re*-required && systemctl poweroff ;;
   *) back_to show_main_menu ;;

bin/omarchy-pkg-add

@@ -1,8 +1,12 @@
 #!/bin/bash
 
+sudo pacman -S --noconfirm --needed "$@" || exit 1
+
 for pkg in "$@"; do
+  # Secondary check to handle states where pacman doesn't actually register an error
   if ! pacman -Q "$pkg" &>/dev/null; then
-    sudo pacman -S --noconfirm "$pkg" || exit 1
+    echo -e "\033[31mError: Package '$pkg' did not install\033[0m" >&2
+    exit 1
   fi
 done
 

install/login/all.sh

@@ -1,4 +1,4 @@
 run_logged $OMARCHY_INSTALL/login/plymouth.sh
+run_logged $OMARCHY_INSTALL/login/default-keyring.sh
+run_logged $OMARCHY_INSTALL/login/sddm.sh
 run_logged $OMARCHY_INSTALL/login/limine-snapper.sh
-run_logged $OMARCHY_INSTALL/login/enable-mkinitcpio.sh
-run_logged $OMARCHY_INSTALL/login/alt-bootloaders.sh

install/login/alt-bootloaders.sh

@@ -1,115 +0,0 @@
-if ! command -v limine &>/dev/null; then
-  # Add kernel hooks
-  if ! grep -Eq '^HOOKS=.*plymouth' /etc/mkinitcpio.conf; then
-    # Backup original mkinitcpio.conf just in case
-    backup_timestamp=$(date +"%Y%m%d%H%M%S")
-    sudo cp /etc/mkinitcpio.conf "/etc/mkinitcpio.conf.bak.${backup_timestamp}"
-
-    # Add plymouth to HOOKS array after 'base udev' or 'base systemd'
-    if grep "^HOOKS=" /etc/mkinitcpio.conf | grep -q "base systemd"; then
-      sudo sed -i '/^HOOKS=/s/base systemd/base systemd plymouth/' /etc/mkinitcpio.conf
-    elif grep "^HOOKS=" /etc/mkinitcpio.conf | grep -q "base udev"; then
-      sudo sed -i '/^HOOKS=/s/base udev/base udev plymouth/' /etc/mkinitcpio.conf
-    else
-      echo "Couldn't add the Plymouth hook"
-    fi
-
-    # Regenerate initramfs
-    sudo mkinitcpio -P
-  fi
-
-  # Add kernel parameters for Plymouth
-  if [ -d "/boot/loader/entries" ]; then # systemd-boot
-    echo "Detected systemd-boot"
-
-    for entry in /boot/loader/entries/*.conf; do
-      if [ -f "$entry" ]; then
-        # Skip fallback entries
-        if [[ "$(basename "$entry")" == *"fallback"* ]]; then
-          echo "Skipped: $(basename "$entry") (fallback entry)"
-          continue
-        fi
-
-        # Skip if splash it already present for some reason
-        if ! grep -q "splash" "$entry"; then
-          sudo sed -i '/^options/ s/$/ splash quiet/' "$entry"
-        else
-          echo "Skipped: $(basename "$entry") (splash already present)"
-        fi
-      fi
-    done
-  elif [ -f "/etc/default/grub" ]; then # Grub
-    echo "Detected grub"
-
-    # Backup GRUB config before modifying
-    backup_timestamp=$(date +"%Y%m%d%H%M%S")
-    sudo cp /etc/default/grub "/etc/default/grub.bak.${backup_timestamp}"
-
-    # Check if splash is already in GRUB_CMDLINE_LINUX_DEFAULT
-    if ! grep -q "GRUB_CMDLINE_LINUX_DEFAULT.*splash" /etc/default/grub; then
-      # Get current GRUB_CMDLINE_LINUX_DEFAULT value
-      current_cmdline=$(grep "^GRUB_CMDLINE_LINUX_DEFAULT=" /etc/default/grub | cut -d'"' -f2)
-
-      # Add splash and quiet if not present
-      new_cmdline="$current_cmdline"
-      if [[ ! "$current_cmdline" =~ splash ]]; then
-        new_cmdline="$new_cmdline splash"
-      fi
-      if [[ ! "$current_cmdline" =~ quiet ]]; then
-        new_cmdline="$new_cmdline quiet"
-      fi
-
-      # Trim any leading/trailing spaces
-      new_cmdline=$(echo "$new_cmdline" | xargs)
-
-      sudo sed -i "s/^GRUB_CMDLINE_LINUX_DEFAULT=\".*\"/GRUB_CMDLINE_LINUX_DEFAULT=\"$new_cmdline\"/" /etc/default/grub
-
-      # Regenerate grub config
-      sudo grub-mkconfig -o /boot/grub/grub.cfg
-    else
-      echo "GRUB already configured with splash kernel parameters"
-    fi
-  elif [ -d "/etc/cmdline.d" ]; then # UKI
-    echo "Detected a UKI setup"
-    # Relying on mkinitcpio to assemble a UKI
-    # https://wiki.archlinux.org/title/Unified_kernel_image
-    if ! grep -q splash /etc/cmdline.d/*.conf; then
-      # Need splash, create the omarchy file
-      echo "splash" | sudo tee -a /etc/cmdline.d/omarchy.conf
-    fi
-    if ! grep -q quiet /etc/cmdline.d/*.conf; then
-      # Need quiet, create or append the omarchy file
-      echo "quiet" | sudo tee -a /etc/cmdline.d/omarchy.conf
-    fi
-  elif [ -f "/etc/kernel/cmdline" ]; then # UKI Alternate
-    # Alternate UKI kernel cmdline location
-    echo "Detected a UKI setup"
-
-    # Backup kernel cmdline config before modifying
-    backup_timestamp=$(date +"%Y%m%d%H%M%S")
-    sudo cp /etc/kernel/cmdline "/etc/kernel/cmdline.bak.${backup_timestamp}"
-
-    current_cmdline=$(cat /etc/kernel/cmdline)
-
-    # Add splash and quiet if not present
-    new_cmdline="$current_cmdline"
-    if [[ ! "$current_cmdline" =~ splash ]]; then
-      new_cmdline="$new_cmdline splash"
-    fi
-    if [[ ! "$current_cmdline" =~ quiet ]]; then
-      new_cmdline="$new_cmdline quiet"
-    fi
-
-    # Trim any leading/trailing spaces
-    new_cmdline=$(echo "$new_cmdline" | xargs)
-
-    # Write new file
-    echo $new_cmdline | sudo tee /etc/kernel/cmdline
-  else
-    echo ""
-    echo " None of systemd-boot, GRUB, or UKI detected. Please manually add these kernel parameters:"
-    echo "  - splash (to see the graphical splash screen)"
-    echo "  - quiet (for silent boot)"
-    echo ""
-  fi
-fi

install/login/default-keyring.sh

@@ -0,0 +1,20 @@
+KEYRING_DIR="$HOME/.local/share/keyrings"
+KEYRING_FILE="$KEYRING_DIR/Default_keyring.keyring"
+DEFAULT_FILE="$KEYRING_DIR/default"
+
+cat << EOF | tee "$KEYRING_FILE"
+[keyring]
+display-name=Default keyring
+ctime=$(date +%s)
+mtime=0
+lock-on-idle=false
+lock-after=false
+EOF
+
+cat << EOF | tee "$DEFAULT_FILE"
+Default_keyring
+EOF
+
+chmod 700 "$KEYRING_DIR"
+chmod 600 "$KEYRING_FILE"
+chmod 644 "$DEFAULT_FILE"

install/login/enable-mkinitcpio.sh

@@ -1,18 +0,0 @@
-echo "Re-enabling mkinitcpio hooks..."
-
-# Restore the specific mkinitcpio pacman hooks
-if [ -f /usr/share/libalpm/hooks/90-mkinitcpio-install.hook.disabled ]; then
-  sudo mv /usr/share/libalpm/hooks/90-mkinitcpio-install.hook.disabled /usr/share/libalpm/hooks/90-mkinitcpio-install.hook
-fi
-
-if [ -f /usr/share/libalpm/hooks/60-mkinitcpio-remove.hook.disabled ]; then
-  sudo mv /usr/share/libalpm/hooks/60-mkinitcpio-remove.hook.disabled /usr/share/libalpm/hooks/60-mkinitcpio-remove.hook
-fi
-
-echo "mkinitcpio hooks re-enabled"
-
-if command -v limine &>/dev/null; then
-  sudo limine-update
-else
-  sudo mkinitcpio -P
-fi

install/login/limine-snapper.sh

@@ -1,4 +1,6 @@
 if command -v limine &>/dev/null; then
+  sudo pacman -S --noconfirm --needed limine-snapper-sync limine-mkinitcpio-hook
+
   sudo tee /etc/mkinitcpio.conf.d/omarchy_hooks.conf <<EOF >/dev/null
 HOOKS=(base udev plymouth keyboard autodetect microcode modconf kms keymap consolefont block encrypt filesystems fsck btrfs-overlayfs)
 EOF
@@ -34,6 +36,7 @@ KERNEL_CMDLINE[default]="$CMDLINE"
 KERNEL_CMDLINE[default]+="quiet splash"
 
 ENABLE_UKI=yes
+CUSTOM_UKI_NAME="omarchy"
 
 ENABLE_LIMINE_FALLBACK=yes
 
@@ -75,7 +78,6 @@ term_background_bright: 24283b
  
 EOF
 
-  sudo pacman -S --noconfirm --needed limine-snapper-sync limine-mkinitcpio-hook
 
   # Match Snapper configs if not installing from the ISO
   if [[ -z ${OMARCHY_CHROOT_INSTALL:-} ]]; then
@@ -96,13 +98,39 @@ EOF
   chrootable_systemctl_enable limine-snapper-sync.service
 fi
 
-# Add UKI entry to UEFI machines to skip bootloader showing on normal boot
-if [[ -n $EFI ]] && efibootmgr &>/dev/null && ! efibootmgr | grep -q Omarchy &&
+echo "Re-enabling mkinitcpio hooks..."
+
+# Restore the specific mkinitcpio pacman hooks
+if [ -f /usr/share/libalpm/hooks/90-mkinitcpio-install.hook.disabled ]; then
+  sudo mv /usr/share/libalpm/hooks/90-mkinitcpio-install.hook.disabled /usr/share/libalpm/hooks/90-mkinitcpio-install.hook
+fi
+
+if [ -f /usr/share/libalpm/hooks/60-mkinitcpio-remove.hook.disabled ]; then
+  sudo mv /usr/share/libalpm/hooks/60-mkinitcpio-remove.hook.disabled /usr/share/libalpm/hooks/60-mkinitcpio-remove.hook
+fi
+
+echo "mkinitcpio hooks re-enabled"
+
+sudo limine-update
+
+if [[ -n $EFI ]] && efibootmgr &>/dev/null; then
+    # Remove the archinstall-created Limine entry
+  while IFS= read -r bootnum; do
+    sudo efibootmgr -b "$bootnum" -B >/dev/null 2>&1
+  done < <(efibootmgr | grep -E "^Boot[0-9]{4}\*? Arch Linux Limine" | sed 's/^Boot\([0-9]\{4\}\).*/\1/')
+fi
+
+if [[ -n $EFI ]] && efibootmgr &>/dev/null &&
   ! cat /sys/class/dmi/id/bios_vendor 2>/dev/null | grep -qi "American Megatrends" &&
   ! cat /sys/class/dmi/id/bios_vendor 2>/dev/null | grep -qi "Apple"; then
-  sudo efibootmgr --create \
-    --disk "$(findmnt -n -o SOURCE /boot | sed 's/p\?[0-9]*$//')" \
-    --part "$(findmnt -n -o SOURCE /boot | grep -o 'p\?[0-9]*$' | sed 's/^p//')" \
-    --label "Omarchy" \
-    --loader "\\EFI\\Linux\\$(cat /etc/machine-id)_linux.efi"
+
+  uki_file=$(find /boot/EFI/Linux/ -name "omarchy*.efi" -printf "%f\n" 2>/dev/null | head -1)
+
+  if [[ -n "$uki_file" ]]; then
+    sudo efibootmgr --create \
+      --disk "$(findmnt -n -o SOURCE /boot | sed 's/p\?[0-9]*$//')" \
+      --part "$(findmnt -n -o SOURCE /boot | grep -o 'p\?[0-9]*$' | sed 's/^p//')" \
+      --label "Omarchy" \
+      --loader "\\EFI\\Linux\\$uki_file"
+  fi
 fi

install/login/plymouth.sh

@@ -1,151 +1,4 @@
-# Hyprland launched via UWSM and login directly as user, rely on disk encryption + hyprlock for security
-
-# ==============================================================================
-# PLYMOUTH SETUP
-# ==============================================================================
-
 if [ "$(plymouth-set-default-theme)" != "omarchy" ]; then
   sudo cp -r "$HOME/.local/share/omarchy/default/plymouth" /usr/share/plymouth/themes/omarchy/
   sudo plymouth-set-default-theme omarchy
 fi
-
-# ==============================================================================
-# SEAMLESS LOGIN
-# ==============================================================================
-
-if [ ! -x /usr/local/bin/seamless-login ]; then
-  # Compile the seamless login helper -- needed to prevent seeing terminal between loader and desktop
-  cat <<'CCODE' >/tmp/seamless-login.c
-/*
-* Seamless Login - Minimal SDDM-style Plymouth transition
-* Replicates SDDM's VT management for seamless auto-login
-*/
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <fcntl.h>
-#include <sys/ioctl.h>
-#include <linux/kd.h>
-#include <linux/vt.h>
-#include <sys/wait.h>
-#include <string.h>
-
-int main(int argc, char *argv[]) {
-    int vt_fd;
-    int vt_num = 1; // TTY1
-    char vt_path[32];
-    
-    if (argc < 2) {
-        fprintf(stderr, "Usage: %s <session_command>\n", argv[0]);
-        return 1;
-    }
-    
-    // Open the VT (simple approach like SDDM)
-    snprintf(vt_path, sizeof(vt_path), "/dev/tty%d", vt_num);
-    vt_fd = open(vt_path, O_RDWR);
-    if (vt_fd < 0) {
-        perror("Failed to open VT");
-        return 1;
-    }
-    
-    // Activate the VT
-    if (ioctl(vt_fd, VT_ACTIVATE, vt_num) < 0) {
-        perror("VT_ACTIVATE failed");
-        close(vt_fd);
-        return 1;
-    }
-    
-    // Wait for VT to be active
-    if (ioctl(vt_fd, VT_WAITACTIVE, vt_num) < 0) {
-        perror("VT_WAITACTIVE failed");
-        close(vt_fd);
-        return 1;
-    }
-    
-    // Critical: Set graphics mode to prevent console text
-    if (ioctl(vt_fd, KDSETMODE, KD_GRAPHICS) < 0) {
-        perror("KDSETMODE KD_GRAPHICS failed");
-        close(vt_fd);
-        return 1;
-    }
-    
-    // Clear VT and close (like SDDM does)
-    const char *clear_seq = "\33[H\33[2J";
-    if (write(vt_fd, clear_seq, strlen(clear_seq)) < 0) {
-        perror("Failed to clear VT");
-    }
-    
-    close(vt_fd);
-    
-    // Set working directory to user's home
-    const char *home = getenv("HOME");
-    if (home) chdir(home);
-    
-    // Now execute the session command
-    execvp(argv[1], &argv[1]);
-    perror("Failed to exec session");
-    return 1;
-}
-CCODE
-
-  gcc -o /tmp/seamless-login /tmp/seamless-login.c
-  sudo mv /tmp/seamless-login /usr/local/bin/seamless-login
-  sudo chmod +x /usr/local/bin/seamless-login
-  rm /tmp/seamless-login.c
-fi
-
-if [ ! -f /etc/systemd/system/omarchy-seamless-login.service ]; then
-  cat <<EOF | sudo tee /etc/systemd/system/omarchy-seamless-login.service
-[Unit]
-Description=Omarchy Seamless Auto-Login
-Documentation=https://github.com/basecamp/omarchy
-Conflicts=getty@tty1.service
-After=systemd-user-sessions.service getty@tty1.service plymouth-quit.service systemd-logind.service
-PartOf=graphical.target
-
-[Service]
-Type=simple
-ExecStart=/usr/local/bin/seamless-login uwsm start -- hyprland.desktop
-Restart=always
-RestartSec=2
-StartLimitIntervalSec=30
-StartLimitBurst=2
-User=$USER
-TTYPath=/dev/tty1
-TTYReset=yes
-TTYVHangup=yes
-TTYVTDisallocate=yes
-StandardInput=tty
-StandardOutput=journal
-StandardError=journal+console
-PAMName=login
-
-[Install]
-WantedBy=graphical.target
-EOF
-fi
-
-if [ ! -f /etc/systemd/system/plymouth-quit.service.d/wait-for-graphical.conf ]; then
-  # Make plymouth remain until graphical.target
-  sudo mkdir -p /etc/systemd/system/plymouth-quit.service.d
-  sudo tee /etc/systemd/system/plymouth-quit.service.d/wait-for-graphical.conf <<'EOF'
-[Unit]
-After=multi-user.target
-EOF
-fi
-
-# Mask plymouth-quit-wait.service only if not already masked
-if ! systemctl is-enabled plymouth-quit-wait.service | grep -q masked; then
-  sudo systemctl mask plymouth-quit-wait.service
-  sudo systemctl daemon-reload
-fi
-
-# Enable omarchy-seamless-login.service only if not already enabled
-if ! systemctl is-enabled omarchy-seamless-login.service | grep -q enabled; then
-  sudo systemctl enable omarchy-seamless-login.service
-fi
-
-# Disable getty@tty1.service only if not already disabled
-if ! systemctl is-enabled getty@tty1.service | grep -q disabled; then
-  sudo systemctl disable getty@tty1.service
-fi

install/login/sddm.sh

@@ -0,0 +1,16 @@
+sudo mkdir -p /etc/sddm.conf.d
+
+if [ ! -f /etc/sddm.conf.d/autologin.conf ]; then
+  cat <<EOF | sudo tee /etc/sddm.conf.d/autologin.conf
+[Autologin]
+User=$USER
+Session=hyprland-uwsm
+
+[Theme]
+Current=breeze
+EOF
+fi
+
+echo "$USER ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart sddm" | sudo tee /etc/sudoers.d/allow-passwordless-restart-sddm
+
+chrootable_systemctl_enable sddm.service

install/omarchy-base.packages

@@ -56,6 +56,7 @@ kvantum-qt5
 lazydocker
 lazygit
 less
+libsecret
 libyaml
 libqalculate
 libreoffice
@@ -93,6 +94,7 @@ python-terminaltexteffects
 qt5-wayland
 ripgrep
 satty
+sddm
 signal-desktop
 slurp
 spotify

install/preflight/guard.sh

@@ -36,5 +36,11 @@ if pacman -Qe gnome-shell &>/dev/null || pacman -Qe plasma-desktop &>/dev/null;
   abort "Fresh + Vanilla Arch"
 fi
 
+# Must have limine installed
+command -v limine &>/dev/null || abort "Limine bootloader"
+
+# Must have btrfs root filesystem
+[ "$(findmnt -n -o FSTYPE /)" = "btrfs" ] || abort "Btrfs root filesystem" 
+
 # Cleared all guards
 echo "Guards: OK"

migrations/1758487660_change_dm_to_sddm.sh

@@ -0,0 +1,57 @@
+#!/bin/bash
+set -e
+
+error_exit() {
+  echo -e "\033[31mERROR: Migration failed! Manual intervention required.\033[0m" >&2
+  echo -e "\033[31mDO NOT REBOOT - System may be in inconsistent state until the error is fixed.\033[0m" >&2
+  exit 1
+}
+
+trap error_exit ERR
+
+echo "Change display manager to SDDM"
+
+omarchy-pkg-add sddm libsecret gnome-keyring || error_exit
+
+sudo mkdir -p /etc/sddm.conf.d
+
+cat <<EOF | sudo tee /etc/sddm.conf.d/autologin.conf
+[Autologin]
+User=$USER
+Session=hyprland-uwsm
+
+[Theme]
+Current=breeze
+EOF
+
+sudo systemctl disable omarchy-seamless-login.service
+sudo systemctl unmask plymouth-quit-wait.service
+sudo systemctl enable getty@tty1.service
+sudo systemctl enable sddm.service
+sudo systemctl daemon-reload
+
+if systemctl is-enabled omarchy-seamless-login.service >/dev/null 2>&1; then
+  echo -e "\033[31mError: omarchy-seamless-login.service is still enabled\033[0m" >&2
+  error_exit
+fi
+
+if systemctl is-masked plymouth-quit-wait.service >/dev/null 2>&1; then
+  echo -e "\033[31mError: plymouth-quit-wait.service is still masked\033[0m" >&2
+  error_exit
+fi
+
+if ! systemctl is-enabled getty@tty1.service >/dev/null 2>&1; then
+  echo -e "\033[31mError: getty@tty1.service is not enabled\033[0m" >&2
+  error_exit
+fi
+
+if ! systemctl is-enabled sddm.service >/dev/null 2>&1; then
+  echo -e "\033[31mError: sddm.service is not enabled\033[0m" >&2
+  error_exit
+fi
+
+sudo rm -f /usr/local/bin/seamless-login
+sudo rm -f /etc/systemd/system/plymouth-quit.service.d/wait-for-graphical.conf
+sudo rm -f /etc/systemd/system/omarchy-seamless-login.service
+
+echo "Migration completed successfully"

migrations/1758487662_move_to_custom_uki.sh

@@ -0,0 +1,38 @@
+echo "Update UKI to custom named entry"
+
+if command -v limine &>/dev/null && [[ -f /etc/default/limine ]]; then
+  if grep -q "^ENABLE_UKI=yes" /etc/default/limine; then
+    if ! grep -q "^CUSTOM_UKI_NAME=" /etc/default/limine; then
+      sudo sed -i '/^ENABLE_UKI=yes/a CUSTOM_UKI_NAME="omarchy"' /etc/default/limine
+    fi
+
+    # Remove the archinstall-created Limine entry
+    while IFS= read -r bootnum; do
+      sudo efibootmgr -b "$bootnum" -B >/dev/null 2>&1
+    done < <(efibootmgr | grep -E "^Boot[0-9]{4}\*? Arch Linux Limine" | sed 's/^Boot\([0-9]\{4\}\).*/\1/')
+
+    sudo limine-update
+
+    uki_file=$(find /boot/EFI/Linux/ -name "omarchy*.efi" -printf "%f\n" 2>/dev/null | head -1)
+
+    if [[ -n "$uki_file" ]]; then
+      while IFS= read -r bootnum; do
+        sudo efibootmgr -b "$bootnum" -B >/dev/null 2>&1
+      done < <(efibootmgr | grep -E "^Boot[0-9]{4}\*? Omarchy" | sed 's/^Boot\([0-9]\{4\}\).*/\1/')
+
+      # Skip EFI entry creation on Apple hardware
+      if ! cat /sys/class/dmi/id/bios_vendor 2>/dev/null | grep -qi "Apple"; then
+        sudo efibootmgr --create \
+          --disk "$(findmnt -n -o SOURCE /boot | sed 's/p\?[0-9]*$//')" \
+          --part "$(findmnt -n -o SOURCE /boot | grep -o 'p\?[0-9]*$' | sed 's/^p//')" \
+          --label "Omarchy" \
+          --loader "\\EFI\\Linux\\$uki_file"
+      fi
+    fi
+  else
+    echo "Not using UKI. Not making any changes."
+  fi
+else
+  echo "Boot config is non-standard. Not making any changes."
+fi
+