diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..d1e48b6
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,13 @@
+* text=auto
+
+*.sh text eol=lf
+*.bash text eol=lf
+*.yaml text eol=lf
+*.yml text eol=lf
+*.service text eol=lf
+
+build_image.sh text eol=lf
+boot/kexec*.sh text eol=lf
+distros/**/grow-rootfs text eol=lf
+distros/shared/zz-update-boot* text eol=lf
+docker/** text eol=lf
diff --git a/.github/workflows/build-image.yml b/.github/workflows/build-image.yml
index 33e4e9e..1a7f7c6 100644
--- a/.github/workflows/build-image.yml
+++ b/.github/workflows/build-image.yml
@@ -8,7 +8,7 @@ on:
         description: 'Distribution'
         default: 'ubuntu2604'
         type: choice
-        options: [all, ubuntu2604, arch, cachyos]
+        options: [all, ubuntu2604, arch, cachyos, kali]
   workflow_call:
     inputs:
       distro:
@@ -176,6 +176,9 @@ jobs:
             echo "| Ubuntu 26.04 | [\`ps5-ubuntu2604.img.xz\`](https://pub-561df4012f1a46fbbdf618d5cc5941f6.r2.dev/ps5-ubuntu2604.img.xz) |"
             echo "| Arch | [\`ps5-arch.img.xz\`](https://pub-561df4012f1a46fbbdf618d5cc5941f6.r2.dev/ps5-arch.img.xz) |"
             echo "| CachyOS | [\`ps5-cachyos.img.xz\`](https://pub-561df4012f1a46fbbdf618d5cc5941f6.r2.dev/ps5-cachyos.img.xz) |"
+            if [ -f meta/kali.sha256 ]; then
+              echo "| Kali | [\`ps5-kali.img.xz\`](https://pub-561df4012f1a46fbbdf618d5cc5941f6.r2.dev/ps5-kali.img.xz) |"
+            fi
             echo ""
             echo "**SHA256 checksums:**"
             echo "\`\`\`"
diff --git a/README.md b/README.md
index b5d881b..c82e80a 100644
--- a/README.md
+++ b/README.md
@@ -1,11 +1,13 @@
 # PS5 Linux Image Builder
 
-Builds bootable Linux USB images for PlayStation 5 using Docker containers. Supports Ubuntu 26.04, Arch, and CachyOS (Gamescope + Steam), individually or as a multi-distro image with kexec switching.
+Builds bootable Linux USB images for PlayStation 5 using Docker containers. Supports Ubuntu 26.04, Arch, CachyOS (Gamescope + Steam), and full Kali Linux, individually or as a multi-distro image with kexec switching.
 
 ## Prerequisites
 
 - Docker (with permission to run `--privileged` containers) — install as per your distro's instructions
-- ~30GB free disk space
+- ~30GB free disk space for Ubuntu, Arch, or CachyOS; a full Kali build needs
+  substantial working space because it creates a 96GB image and a full rootfs
+  tree (`~150GB` free recommended for a clean Kali build)
 
 Once Docker is installed, add your user to the docker group and apply it without logging out:
 
@@ -27,6 +29,11 @@ OR
 
 OR
 
+# Build Kali Linux (XFCE + kali-linux-everything)
+./build_image.sh --distro kali
+
+OR
+
 # Build a multi-distro image (ubuntu2604 + arch + cachyos)
 ./build_image.sh --distro all
 ```
@@ -39,16 +46,75 @@ The script auto-clones the kernel source, applies PS5 patches, compiles, and bui
 sudo dd if=output/ps5-ubuntu2604.img of=/dev/sdX bs=4M status=progress
 ```
 
+## Kali First Boot Time Sync
+
+The Kali image uses UTC by default and enables `ntpsec`. PS5 hardware may boot
+Linux without a correct real-time clock, so the displayed time can be wrong
+until a network connection is available. The Kali recipe configures IPv4 NTP
+sources that were validated through Android USB tethering, because that
+connection may not provide usable IPv6 routing.
+
+The Xfce clock's **Time and Date** window is the legacy `time-admin` utility.
+On Kali it can report that NTP support is not installed even though `ntpsec`
+is installed and active. Verify or repair synchronization from a terminal:
+
+```bash
+systemctl --no-pager status ntpsec
+ntpq -pn
+timedatectl status
+```
+
+If the PS5 clock is still wrong after the internet connection is active, force
+one initial correction and restart continuous synchronization:
+
+```bash
+sudo systemctl stop ntpsec
+sudo ntpd -gq -c /etc/ntpsec/ntp.conf
+sudo systemctl start ntpsec
+date
+```
+
+To use a local timezone after boot, for example Kentucky:
+
+```bash
+sudo timedatectl set-timezone America/Kentucky/Louisville
+timedatectl status
+```
+
+The Kali desktop autologin is enabled for local first boot. SSH is installed
+but disabled by default because the initial local account is `kali` with
+password `kali`. Before enabling remote access, change that password:
+
+```bash
+passwd
+sudo systemctl enable --now ssh
+```
+
+The image holds its installed kernel packages and protects the boot-copy hook
+from deploying a generic Kali kernel. Do not replace or unhold the PS5 kernel
+unless you are intentionally testing a new PS5-patched kernel build.
+
+Ghidra is configured to use JDK 21, its documented supported runtime. Full
+Kali installations may also contain newer Java versions for other software.
+
+`kali-linux-everything` installs NFS client components, but the PS5-patched
+kernel has NFS disabled. A failed `run-rpc_pipefs.mount` unit can therefore be
+reported at boot; it only indicates that NFS mounts are unavailable. The Kali
+desktop and security tools are unaffected.
+
+The full Kali toolset also enables `chkrootkit.timer`; its daily integrity scan
+can use noticeable CPU time while it runs.
+
 ## Options
 
 | Flag | Description | Default |
 |------|-------------|---------|
-| `--distro` | `ubuntu2604`, `arch`, `cachyos`, or `all` | `ubuntu2604` |
-| `--kernel` | Path to kernel source directory | auto-clone `v6.19.10` |
-| `--img-size` | Disk image size in MB | `12000` (`32000` for `all`) |
+| `--distro` | `ubuntu2604`, `arch`, `cachyos`, `kali`, or `all` | `ubuntu2604` |
+| `--kernel` | Path to kernel source directory | auto-clone version selected by PS5 patch set |
+| `--img-size` | Disk image size in MB | `12000` (`32000` for `all`, `98304` for `kali`) |
 | `--clean` | Remove all cached build artifacts and start fresh | off |
 | `--kernel-only` | Build and package the kernel only, then exit | off |
-| `--patches-ref` | Branch, tag, or commit SHA for patches | `v1.0` |
+| `--patches-ref` | Branch, tag, or commit SHA for patches | `v1.2` |
 
 ## Caching
 
@@ -91,6 +157,7 @@ All verbose output goes to `build.log`. The terminal shows a spinner with live p
 | Ubuntu 26.04 (Resolute) | GNOME | `.deb` | systemd |
 | Arch | Sway | `.pkg.tar.zst` | systemd |
 | CachyOS | Gamescope + Steam Big Picture (Arch + `[cachyos]` repo, no v3 migration in image build) | `.pkg.tar.zst` | systemd |
+| Kali Linux Rolling | XFCE + `kali-linux-everything` | `.deb` | systemd |
 
 ## Multi-distro Image
 
@@ -137,6 +204,7 @@ distros/
   ubuntu2604/                   # Ubuntu 26.04 (Resolute)
   arch/                         # Arch Linux
   cachyos/                      # CachyOS repos + Gamescope/Steam
+  kali/                         # Kali Linux Rolling
   shared/                       # Kernel postinst hooks (single + multi)
 boot/
   cmdline.txt                   # Kernel cmdline template (__DISTRO__ placeholder)
diff --git a/build_image.sh b/build_image.sh
index aa186f5..bc3dc5b 100755
--- a/build_image.sh
+++ b/build_image.sh
@@ -17,13 +17,13 @@ usage() {
     echo "Usage: $0 [--distro <distro>] [--kernel <path>] [--img-size <MB>] [--clean]"
     echo ""
     echo "Options:"
-    echo "  --distro     Distribution to build: ubuntu2604, arch, cachyos, all (default: ubuntu2604)"
+    echo "  --distro     Distribution to build: ubuntu2604, arch, cachyos, kali, all (default: ubuntu2604)"
     echo "  --kernel     Path to kernel source directory (default: auto-clone to work/linux/)"
-    echo "  --img-size   Disk image size in MB (default: 12000, 32000 for --distro all)"
+    echo "  --img-size   Disk image size in MB (default: 12000, 32000 for --distro all, 98304 for kali)"
     echo "  --clean      Remove all cached build artifacts and start from scratch"
     echo "  --clean-only Remove all cached build artifacts and exit"
     echo "  --kernel-only  Build and package the kernel only, then exit"
-    echo "  --patches-ref  Branch, tag, or commit SHA for patches (default: v1.0)"
+    echo "  --patches-ref  Branch, tag, or commit SHA for patches (default: v1.2)"
     exit 1
 }
 
@@ -64,6 +64,9 @@ DOCKER_NAME="ps5-build-$$"
 if [ "$DISTRO" = "all" ] && [ "$IMG_SIZE" = "12000" ]; then
     IMG_SIZE=32000
 fi
+if [ "$DISTRO" = "kali" ] && [ "$IMG_SIZE" = "12000" ]; then
+    IMG_SIZE=98304
+fi
 
 if [ -z "$FORMAT" ]; then
     case "$DISTRO" in arch|cachyos) FORMAT="arch" ;; all) FORMAT="all" ;; *) FORMAT="deb" ;; esac
diff --git a/distros/kali/cmdline.txt b/distros/kali/cmdline.txt
new file mode 100644
index 0000000..6660afc
--- /dev/null
+++ b/distros/kali/cmdline.txt
@@ -0,0 +1 @@
+root=LABEL=__DISTRO__ rw rootwait console=ttyTitania0 console=tty0 mitigations=off idle=halt preempt=full
diff --git a/distros/kali/grow-rootfs b/distros/kali/grow-rootfs
new file mode 100644
index 0000000..8c24f17
--- /dev/null
+++ b/distros/kali/grow-rootfs
@@ -0,0 +1,19 @@
+#!/bin/bash
+# Grows the root partition and filesystem to fill the disk.
+# Runs once on first boot, then disables itself.
+# If resize fails, the service stays enabled and retries next boot.
+
+ROOT_DEV=$(findmnt -no SOURCE /) || { echo "Cannot find root device"; exit 1; }
+DISK=$(lsblk -ndo PKNAME "$ROOT_DEV")
+PART_NUM=$(cat /sys/class/block/$(basename "$ROOT_DEV")/partition 2>/dev/null)
+
+if [ -z "$DISK" ] || [ -z "$PART_NUM" ]; then
+    echo "Cannot determine disk layout (DISK=$DISK PART_NUM=$PART_NUM)"
+    exit 1
+fi
+
+growpart "/dev/$DISK" "$PART_NUM" || true
+partprobe "/dev/$DISK"
+resize2fs "$ROOT_DEV"
+
+systemctl disable grow-rootfs.service
diff --git a/distros/kali/grow-rootfs.service b/distros/kali/grow-rootfs.service
new file mode 100644
index 0000000..dc5350a
--- /dev/null
+++ b/distros/kali/grow-rootfs.service
@@ -0,0 +1,10 @@
+[Unit]
+Description=Grow root filesystem to fill disk
+After=local-fs.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/grow-rootfs
+
+[Install]
+WantedBy=multi-user.target
diff --git a/distros/kali/image.yaml b/distros/kali/image.yaml
new file mode 100644
index 0000000..5b7d580
--- /dev/null
+++ b/distros/kali/image.yaml
@@ -0,0 +1,286 @@
+image:
+  name: ps5-kali
+  distribution: debian
+  release: kali-rolling
+  description: Kali Linux XFCE desktop
+  architecture: x86_64
+
+source:
+  downloader: debootstrap
+  url: https://kali.download/kali
+  variant: minbase
+  keyserver: keyserver.ubuntu.com
+  keys:
+  - 0x827C8569F2518CC677FECA1AED65462EC8D5E4C5
+
+packages:
+  manager: apt
+  update: true
+  cleanup: true
+
+  repositories:
+  - name: sources.list
+    url: |-
+      deb https://kali.download/kali kali-rolling main contrib non-free non-free-firmware
+    architectures:
+    - amd64
+
+  sets:
+  - packages:
+    # Full Kali desktop and toolset
+    - kali-desktop-xfce
+    - kali-linux-everything
+    - kali-defaults
+    - kali-defaults-desktop
+    - kali-themes
+    - kali-wallpapers-2026
+    - kali-wallpapers-all
+    - kali-menu
+    - kali-tweaks
+    - kali-undercover
+
+    # Display / GPU / audio
+    - lightdm
+    - lightdm-gtk-greeter
+    - xserver-xorg
+    - xserver-xorg-video-amdgpu
+    - dbus-x11
+    - x11-xserver-utils
+    - mesa-vulkan-drivers
+    - pipewire
+    - pipewire-pulse
+    - wireplumber
+    - pavucontrol
+
+    # Networking and remote access
+    - network-manager
+    - network-manager-gnome
+    - openssh-server
+    - iputils-ping
+    - ntpsec
+    - iw
+    - wpasupplicant
+    - wireless-regdb
+
+    # Firmware and PS5 boot support
+    - firmware-linux
+    - firmware-linux-nonfree
+    - firmware-amd-graphics
+    - firmware-realtek
+    - firmware-atheros
+    - firmware-mediatek
+    - firmware-misc-nonfree
+    - initramfs-tools
+    - kexec-tools
+    - kmod
+    - busybox
+    - zstd
+    - systemd-zram-generator
+
+    # Base system utilities
+    - sudo
+    - cloud-guest-utils
+    - parted
+    - e2fsprogs
+    - usbutils
+    - pciutils
+    - rfkill
+    - util-linux
+    - curl
+    - wget
+    - git
+    - vim
+    - nano
+    - tmux
+    - firefox-esr
+    # Ghidra 12.1 requires JDK 21. The full Kali set also installs newer JDKs.
+    - openjdk-21-jdk
+    action: install
+
+files:
+- path: /etc/hostname
+  generator: hostname
+
+- path: /etc/hosts
+  generator: hosts
+
+- path: /etc/machine-id
+  generator: dump
+
+- path: /etc/kernel/postinst.d/zz-update-boot
+  generator: copy
+  source: /tmp/build-staging/zz-update-boot
+  mode: "0755"
+
+- path: /etc/fstab
+  generator: copy
+  source: /tmp/build-staging/fstab
+
+- path: /etc/apt/trusted.gpg.d/kali-archive-keyring.asc
+  generator: copy
+  source: /tmp/build-staging/kali-archive-keyring.asc
+
+- path: /usr/local/sbin/grow-rootfs
+  generator: copy
+  source: /tmp/build-staging/grow-rootfs
+  mode: "0755"
+
+- path: /etc/systemd/system/grow-rootfs.service
+  generator: copy
+  source: /tmp/build-staging/grow-rootfs.service
+
+- path: /opt/debs/
+  generator: copy
+  source: /tmp/build-staging/debs
+
+actions:
+- trigger: post-unpack
+  action: |-
+    #!/bin/bash
+    set -eux
+    rm -f /var/lib/apt/lists/*InRelease /var/lib/apt/lists/*Release /var/lib/apt/lists/*Packages* || true
+    echo 'Acquire::Retries "10";' > /etc/apt/apt.conf.d/80retry
+    cat > /etc/apt/trusted.gpg.d/kali-archive-keyring.asc <<'EOF'
+    -----BEGIN PGP PUBLIC KEY BLOCK-----
+
+    mQINBGgBJJUBEADlMTZVDCjrSXIAuYfL3VZt8OoplUdw3mSPlhIjZQmIo2sdzvAF
+    EMSCQ+vWeD4VqV9tBtiVx6j8VSfyW18YHHAkvajWDRg5hPLf80wGxrtXYu+vj3Ri
+    5dOMhrl9fHKIifPOoV3pFTtOk0dB9lkcmtNzjWgwOJduLbjjraE1BBKqc0uaXDCa
+    RJnPYkQuJQcZxmZVFAo9NP7KSAL1zMvutAd0R3WeMaWpT22nGa3rJj4kj25zV6Kn
+    qGnv5kQaY2cTlQHnp6EbiLe5sCE7zIOp5CjwIJhyCyn4zT8KqGB8Sw8PEi9mYlSY
+    wbGzzfAAbBk7Y8xbmvRrkrHzU74jH0iMK566QVu2yl3Dz0hrlliV6vGn2ZWu7qmh
+    lwXSb+q4u46tDbFjdUjYJG2upx5vOm5SewD9snLB4YN2e2qDeQgY16AfpkJa51+u
+    PwTeDCbfuQu3irLWcGRZgpOBgsxqCtpZBmF6ED7L8tntoyjZ9WeB8FnTcv7hx5J1
+    IPCO4K5TvW0SX6ZKp1Jusbkn5hrrFTjOJHhIDVdioM/wYDKkqJ9e25oGAqPkJYRY
+    euonU1teK+EOLM7ZIbalhukrw0bgYl9UJRxQMLEhZzoiiCLLiv3oWHAQGFclP+1E
+    zXgbLBviFAU4+DMXfhA6vy8BmS9oTpleS1p3/EOwf2rX/yt4qF7IW9ZXuQARAQAB
+    tEBLYWxpIExpbnV4IEFyY2hpdmUgQXV0b21hdGljIFNpZ25pbmcgS2V5ICgyMDI1
+    KSA8ZGV2ZWxAa2FsaS5vcmc+iQJUBBMBCgA+FiEEgnyFafJRjMZ3/soa7WVGLsjV
+    5MUFAmgF7tkCGwMFCQWkfeUFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQ7WVG
+    LsjV5MXcjw//XeI6OXY7VcH+hXRcT7W49AwqRfmSaSEWs474G2DQR9UppzvkFCab
+    uiWl5jrlkeGbVFsiBruJfIlCdYMMnPk8gEm/SEhVRqcZVOjYCWcMlSVB6oU+6tgW
+    jKPPRDELiq7mTl8S4sEdvUxpsWoMqEQZ1+CsJsw+p+TARGNIrUUdL9hTOoOUpvue
+    nKNEEfzbKvLk2gj2tKOgr1HcDmVbbmRsL87+UYq1JvA0OzJ0KrhBdTZHJWchAJwa
+    p+UUog2XrzvXYXWBPfQLsNVkFirmVd1B5vonj3OeNlVU51YriRQ4P4onLrwlfha8
+    vUGeNJw/ihXTQFpvmF7fFSRa7Pr5YfWkDZ4BGuEB+kSycu2PMWCXXHdY++cMIlRf
+    uUg/wvzcwAkS99DJ0EAiOun0oypE5+r5HwfaI9IrJlgZMPlFctyBIGVg2DFZCdLH
+    VHG1Voq/CU2tgWvWyuHXHVlUiZiWJoj7BbVa88Gj+VyvB/md1xBh0ScmfH4uGgnX
+    hpLFPIVuR1SJYarovVmtFhAjbqbrAA4Q9utpOeOOVDMD5tuq856/lLh+SWPkRsUy
+    ZJTwz1Nh0rJ/UJOMSo4ljkkr53iR/IM4woAAaP+0hkZoIDSbVVW5Im1Yj461exl4
+    0ltMBMym2KZk/IFOTloSfW7hMmGlqaLfQEH1ryHefIIpkgKJa6WgVxA=
+    =f+tz
+    -----END PGP PUBLIC KEY BLOCK-----
+    EOF
+    apt-get update
+
+- trigger: post-update
+  action: |-
+    #!/bin/bash
+    set -eux
+    passwd -l root
+
+- trigger: post-packages
+  action: |-
+    #!/bin/bash
+    set -eux
+
+    # Default user (kali/kali)
+    useradd -m -G sudo -s /bin/bash kali
+    echo "kali:kali" | chpasswd
+
+    # The image is assembled inside Docker, where the generated hostname is
+    # otherwise the temporary container ID. Use a stable PS5 hostname.
+    printf 'ps5\n' > /etc/hostname
+    if grep -q '^127\.0\.1\.1' /etc/hosts; then
+      sed -i 's/^127\.0\.1\.1.*/127.0.1.1 ps5/' /etc/hosts
+    else
+      printf '127.0.1.1 ps5\n' >> /etc/hosts
+    fi
+
+    # Ghidra 12.1 requires JDK 21, while Kali Rolling may select a newer Java
+    # as the system default. Keep its desktop launcher on the supported JDK.
+    test -x /usr/lib/jvm/java-21-openjdk-amd64/bin/java
+    sed -i 's|^JAVA_HOME_OVERRIDE=.*|JAVA_HOME_OVERRIDE=/usr/lib/jvm/java-21-openjdk-amd64|' /usr/share/ghidra/support/launch.properties
+
+    # LightDM autologin into XFCE
+    mkdir -p /etc/lightdm/lightdm.conf.d
+    cat > /etc/lightdm/lightdm.conf.d/50-ps5-autologin.conf <<'EOF'
+    [Seat:*]
+    autologin-user=kali
+    autologin-user-timeout=0
+    user-session=xfce
+    EOF
+
+    # SSH is installed for opt-in remote access. Keep it disabled while the
+    # distributed image still has public default local credentials.
+    sed -i 's/^#*PermitRootLogin.*/PermitRootLogin no/'               /etc/ssh/sshd_config
+    sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config
+
+    systemctl set-default graphical.target
+    systemctl disable ssh.service || true
+    systemctl disable ssh.socket || true
+    systemctl enable NetworkManager
+    systemctl enable lightdm
+
+    # PS5 systems may boot without a useful hardware clock. Keep the shared
+    # image timezone-neutral and synchronize after a network connection exists.
+    ln -sf /usr/share/zoneinfo/Etc/UTC /etc/localtime
+    printf 'Etc/UTC\n' > /etc/timezone
+    # Android USB tethering may provide IPv4 only. The default pool returned
+    # one unreachable IPv4 peer in PS5 testing; these independent IPv4 peers
+    # responded and preserve multi-source time validation.
+    sed -i '/^pool [0-3]\.debian\.pool\.ntp\.org /s/^/# PS5 replaced: /' /etc/ntpsec/ntp.conf
+    cat >> /etc/ntpsec/ntp.conf <<'EOF'
+
+    # PS5 USB-tether-friendly IPv4 time sources
+    server -4 time.cloudflare.com iburst
+    server -4 time.google.com iburst
+    server -4 time.apple.com iburst
+    server -4 time.windows.com iburst
+    EOF
+    systemctl enable ntpsec.service
+
+    # zram swap: half of RAM, zstd compressed
+    printf '[zram0]\nzram-size = ram / 2\ncompression-algorithm = zstd\n' > /etc/systemd/zram-generator.conf
+
+    # Avoid PS5 display sleep/blanking during first boot demos.
+    install -d -m 0755 /home/kali/.config/autostart
+    cat > /home/kali/.config/autostart/ps5-display.desktop <<'EOF'
+    [Desktop Entry]
+    Type=Application
+    Name=PS5 Display Defaults
+    Exec=sh -c 'xset s off -dpms; xset s noblank'
+    X-GNOME-Autostart-enabled=true
+    EOF
+    chown -R kali:kali /home/kali
+
+- trigger: post-files
+  action: |-
+    #!/bin/bash
+    set -eux
+    systemctl enable grow-rootfs.service
+    mkdir -p /boot/efi
+
+    # This USB image uses zram, not a disk-backed hibernation device. Avoid
+    # embedding a temporary build-container device as a resume target.
+    mkdir -p /etc/initramfs-tools/conf.d
+    printf 'RESUME=none\n' > /etc/initramfs-tools/conf.d/resume
+
+    dpkg -i /opt/debs/*.deb
+    rm -rf /opt/debs
+    # kali-linux-everything installs a generic Kali kernel. Keep updates from
+    # replacing the PS5-patched kernel used by the loader.
+    dpkg-query -W -f='${binary:Package} ${db:Status-Status}\n' 'linux-image-*' 2>/dev/null \
+      | awk '$2 == "installed" { print $1 }' \
+      | xargs -r apt-mark hold
+    apt-mark hold linux-ps5 || true
+
+    KVER=$(ls -1t /lib/modules | head -1)
+    depmod -a "$KVER"
+    grep -qxF amdgpu /etc/initramfs-tools/modules || printf '\namdgpu\n' >> /etc/initramfs-tools/modules
+    printf 'MODULES=most\nBUSYBOX=y\n' > /etc/initramfs-tools/conf.d/ps5-amdgpu
+    update-initramfs -c -k "$KVER"
+    /etc/kernel/postinst.d/zz-update-boot "$KVER"
+
+mappings:
+  architecture_map: debian
diff --git a/distros/kali/kali-archive-keyring.asc b/distros/kali/kali-archive-keyring.asc
new file mode 100644
index 0000000..5ded9f7
--- /dev/null
+++ b/distros/kali/kali-archive-keyring.asc
@@ -0,0 +1,29 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGgBJJUBEADlMTZVDCjrSXIAuYfL3VZt8OoplUdw3mSPlhIjZQmIo2sdzvAF
+EMSCQ+vWeD4VqV9tBtiVx6j8VSfyW18YHHAkvajWDRg5hPLf80wGxrtXYu+vj3Ri
+5dOMhrl9fHKIifPOoV3pFTtOk0dB9lkcmtNzjWgwOJduLbjjraE1BBKqc0uaXDCa
+RJnPYkQuJQcZxmZVFAo9NP7KSAL1zMvutAd0R3WeMaWpT22nGa3rJj4kj25zV6Kn
+qGnv5kQaY2cTlQHnp6EbiLe5sCE7zIOp5CjwIJhyCyn4zT8KqGB8Sw8PEi9mYlSY
+wbGzzfAAbBk7Y8xbmvRrkrHzU74jH0iMK566QVu2yl3Dz0hrlliV6vGn2ZWu7qmh
+lwXSb+q4u46tDbFjdUjYJG2upx5vOm5SewD9snLB4YN2e2qDeQgY16AfpkJa51+u
+PwTeDCbfuQu3irLWcGRZgpOBgsxqCtpZBmF6ED7L8tntoyjZ9WeB8FnTcv7hx5J1
+IPCO4K5TvW0SX6ZKp1Jusbkn5hrrFTjOJHhIDVdioM/wYDKkqJ9e25oGAqPkJYRY
+euonU1teK+EOLM7ZIbalhukrw0bgYl9UJRxQMLEhZzoiiCLLiv3oWHAQGFclP+1E
+zXgbLBviFAU4+DMXfhA6vy8BmS9oTpleS1p3/EOwf2rX/yt4qF7IW9ZXuQARAQAB
+tEBLYWxpIExpbnV4IEFyY2hpdmUgQXV0b21hdGljIFNpZ25pbmcgS2V5ICgyMDI1
+KSA8ZGV2ZWxAa2FsaS5vcmc+iQJUBBMBCgA+FiEEgnyFafJRjMZ3/soa7WVGLsjV
+5MUFAmgF7tkCGwMFCQWkfeUFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQ7WVG
+LsjV5MXcjw//XeI6OXY7VcH+hXRcT7W49AwqRfmSaSEWs474G2DQR9UppzvkFCab
+uiWl5jrlkeGbVFsiBruJfIlCdYMMnPk8gEm/SEhVRqcZVOjYCWcMlSVB6oU+6tgW
+jKPPRDELiq7mTl8S4sEdvUxpsWoMqEQZ1+CsJsw+p+TARGNIrUUdL9hTOoOUpvue
+nKNEEfzbKvLk2gj2tKOgr1HcDmVbbmRsL87+UYq1JvA0OzJ0KrhBdTZHJWchAJwa
+p+UUog2XrzvXYXWBPfQLsNVkFirmVd1B5vonj3OeNlVU51YriRQ4P4onLrwlfha8
+vUGeNJw/ihXTQFpvmF7fFSRa7Pr5YfWkDZ4BGuEB+kSycu2PMWCXXHdY++cMIlRf
+uUg/wvzcwAkS99DJ0EAiOun0oypE5+r5HwfaI9IrJlgZMPlFctyBIGVg2DFZCdLH
+VHG1Voq/CU2tgWvWyuHXHVlUiZiWJoj7BbVa88Gj+VyvB/md1xBh0ScmfH4uGgnX
+hpLFPIVuR1SJYarovVmtFhAjbqbrAA4Q9utpOeOOVDMD5tuq856/lLh+SWPkRsUy
+ZJTwz1Nh0rJ/UJOMSo4ljkkr53iR/IM4woAAaP+0hkZoIDSbVVW5Im1Yj461exl4
+0ltMBMym2KZk/IFOTloSfW7hMmGlqaLfQEH1ryHefIIpkgKJa6WgVxA=
+=f+tz
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/distros/shared/zz-update-boot b/distros/shared/zz-update-boot
index 8f4b224..d003b3a 100755
--- a/distros/shared/zz-update-boot
+++ b/distros/shared/zz-update-boot
@@ -5,8 +5,23 @@ set -e
 BOOT_PART="/boot/efi"
 KVER="$1"
 [ -z "$KVER" ] && KVER="$(ls -1t /lib/modules | head -1)"
-mv "$BOOT_PART/bzImage"     "$BOOT_PART/bzImage.old"
-mv "$BOOT_PART/initrd.img"  "$BOOT_PART/initrd.img.old"
-cp "/boot/vmlinuz-$KVER"    "$BOOT_PART/bzImage"
-cp "/boot/initrd.img-$KVER" "$BOOT_PART/initrd.img"
+
+# Debian-based desktop metapackages may also install a generic kernel. Once
+# linux-ps5 is present, never deploy another kernel to the PS5 boot partition.
+if command -v dpkg-query >/dev/null 2>&1 && dpkg-query -W linux-ps5 >/dev/null 2>&1; then
+    PS5_KVER="$(dpkg-query -L linux-ps5 | sed -n 's#^/boot/vmlinuz-##p' | head -1)"
+    if [ -n "$PS5_KVER" ] && [ "$KVER" != "$PS5_KVER" ]; then
+        echo ">> Ignoring non-PS5 kernel $KVER (PS5 kernel is $PS5_KVER)"
+        exit 0
+    fi
+fi
+
+if [ -f "$BOOT_PART/bzImage" ]; then
+    mv "$BOOT_PART/bzImage" "$BOOT_PART/bzImage.old"
+fi
+if [ -f "$BOOT_PART/initrd.img" ]; then
+    mv "$BOOT_PART/initrd.img" "$BOOT_PART/initrd.img.old"
+fi
+cp "/boot/vmlinuz-$KVER"        "$BOOT_PART/bzImage"
+cp "/boot/initrd.img-$KVER"     "$BOOT_PART/initrd.img"
 echo ">> Kernel $KVER deployed to $BOOT_PART"
diff --git a/distros/shared/zz-update-boot-multi b/distros/shared/zz-update-boot-multi
index 19a4753..765e9d0 100644
--- a/distros/shared/zz-update-boot-multi
+++ b/distros/shared/zz-update-boot-multi
@@ -9,14 +9,30 @@ KVER="$1"
 DISTRO="unknown"
 [ -f /etc/ps5-distro ] && DISTRO="$(cat /etc/ps5-distro)"
 
-mv "$BOOT_PART/bzImage"              "$BOOT_PART/bzImage.old"
-mv "$BOOT_PART/initrd-${DISTRO}.img" "$BOOT_PART/initrd-${DISTRO}.img.old"
-cp "/boot/vmlinuz-$KVER"             "$BOOT_PART/bzImage"
-cp "/boot/initrd.img-$KVER"          "$BOOT_PART/initrd-${DISTRO}.img"
+# Debian-based desktop metapackages may also install a generic kernel. Once
+# linux-ps5 is present, never deploy another kernel to the PS5 boot partition.
+if command -v dpkg-query >/dev/null 2>&1 && dpkg-query -W linux-ps5 >/dev/null 2>&1; then
+    PS5_KVER="$(dpkg-query -L linux-ps5 | sed -n 's#^/boot/vmlinuz-##p' | head -1)"
+    if [ -n "$PS5_KVER" ] && [ "$KVER" != "$PS5_KVER" ]; then
+        echo ">> Ignoring non-PS5 kernel $KVER (PS5 kernel is $PS5_KVER)"
+        exit 0
+    fi
+fi
+
+if [ -f "$BOOT_PART/bzImage" ]; then
+    mv "$BOOT_PART/bzImage" "$BOOT_PART/bzImage.old"
+fi
+if [ -f "$BOOT_PART/initrd-${DISTRO}.img" ]; then
+    mv "$BOOT_PART/initrd-${DISTRO}.img" "$BOOT_PART/initrd-${DISTRO}.img.old"
+fi
+cp "/boot/vmlinuz-$KVER"    "$BOOT_PART/bzImage"
+cp "/boot/initrd.img-$KVER" "$BOOT_PART/initrd-${DISTRO}.img"
 
 # Ubuntu 26.04 is default boot — also update the generic initrd.img
 if [ "$DISTRO" = "ubuntu2604" ]; then
-    mv "$BOOT_PART/initrd.img"  "$BOOT_PART/initrd.img.old"
+    if [ -f "$BOOT_PART/initrd.img" ]; then
+        mv "$BOOT_PART/initrd.img" "$BOOT_PART/initrd.img.old"
+    fi
     cp "/boot/initrd.img-$KVER" "$BOOT_PART/initrd.img"
 fi
 
diff --git a/docker/image-builder/entrypoint.sh b/docker/image-builder/entrypoint.sh
index 7a78100..f7eab7d 100755
--- a/docker/image-builder/entrypoint.sh
+++ b/docker/image-builder/entrypoint.sh
@@ -10,6 +10,10 @@ EFI_LABEL="boot"
 CHROOT="/build/chroot"
 IMG="/output/ps5-${DISTRO}.img"
 
+if [ "$DISTRO" = "kali" ]; then
+    ROOT_LABEL="kali-root"
+fi
+
 if [ "$SKIP_CHROOT" = "true" ] && [ -d "$CHROOT/bin" ]; then
     echo "=== Reusing cached $DISTRO rootfs ==="
 else
@@ -34,6 +38,12 @@ EOF
             cp /repo/distros/${DISTRO}/grow-rootfs.service "$STAGING/"
             cp /kernel-debs/*.deb                          "$STAGING/debs/"
             ;;
+        kali)
+            cp /repo/distros/${DISTRO}/grow-rootfs          "$STAGING/"
+            cp /repo/distros/${DISTRO}/grow-rootfs.service  "$STAGING/"
+            cp /repo/distros/${DISTRO}/kali-archive-keyring.asc "$STAGING/"
+            cp /kernel-debs/*.deb                           "$STAGING/debs/"
+            ;;
         arch)
             cp /repo/distros/${DISTRO}/grow-rootfs         "$STAGING/"
             cp /repo/distros/arch/grow-rootfs.service      "$STAGING/"
@@ -58,6 +68,11 @@ EOF
             ;;
     esac
 
+    find "$STAGING" -type f \
+        ! -path "$STAGING/debs/*" \
+        ! -path "$STAGING/pkgs/*" \
+        -exec sed -i 's/\r$//' {} +
+
     # --- Build rootfs ---
     rm -rf "$CHROOT"/* "$CHROOT"/.[!.]* 2>/dev/null || true
 
@@ -75,8 +90,10 @@ esac
 
 # --- Create GPT disk image ---
 echo "=== Creating ${IMG_SIZE}MB disk image ==="
-TMPIMG="/build/ps5-${DISTRO}.img"
-dd if=/dev/zero of="$TMPIMG" bs=1M count=$IMG_SIZE conv=fsync status=progress
+TMPIMG="/output/.ps5-${DISTRO}.img.tmp"
+rm -f "$TMPIMG"
+truncate -s "${IMG_SIZE}M" "$TMPIMG"
+sync
 
 parted -s "$TMPIMG" mklabel gpt
 parted -s "$TMPIMG" mkpart primary ext4  500MiB 100%
@@ -115,7 +132,9 @@ sync
 
 echo "=== Assembling boot partition ==="
 mv /tmp/usb_root/boot/efi/* /tmp/usb_efi/ 2>/dev/null || true
-sed "s|__DISTRO__|$ROOT_LABEL|" /repo/boot/cmdline.txt > /tmp/usb_efi/cmdline.txt
+CMDLINE_TEMPLATE="/repo/distros/${DISTRO}/cmdline.txt"
+[ -f "$CMDLINE_TEMPLATE" ] || CMDLINE_TEMPLATE="/repo/boot/cmdline.txt"
+sed "s|__DISTRO__|$ROOT_LABEL|" "$CMDLINE_TEMPLATE" > /tmp/usb_efi/cmdline.txt
 cp /repo/boot/vram.txt     /tmp/usb_efi/
 cp /repo/boot/kexec.sh     /tmp/usb_efi/
 sync