diff --git a/docker/kernel-builder-rpm/build.sh b/docker/kernel-builder-rpm/build.sh
index 500b6fb..92dddc4 100644
--- a/docker/kernel-builder-rpm/build.sh
+++ b/docker/kernel-builder-rpm/build.sh
@@ -37,6 +37,20 @@ if [ -d "/out/staging/headers/lib/modules/$KVER/build" ]; then
           "$STAGE/usr/lib/modules/$KVER/build"
 fi
 
+# Userspace bits staged by kernel-builder at /out/staging/{etc,usr/local}:
+# ps5-stage-firmware.service + ps5-bt-quiet.service + their /usr/local/sbin
+# helpers + /etc/modprobe.d/moal.conf + /etc/modules-load.d/moal. Without
+# these, moal loads but request_firmware() returns -2 (firmware still on
+# ESP, never staged) and there's no boot-time BT phantom-hci cleanup. The
+# .deb and .pkg.tar.zst packagers already copy these; this was the missing
+# symmetric step on the rpm side.
+for d in etc usr/local; do
+    if [ -d "/out/staging/$d" ]; then
+        mkdir -p "$STAGE/$d"
+        cp -a "/out/staging/$d/." "$STAGE/$d/"
+    fi
+done
+
 rpmbuild -bb \
     --define "_topdir $RPMROOT/rpmbuild" \
     --define "stagedir $STAGE" \
diff --git a/docker/kernel-builder-rpm/linux-ps5.spec b/docker/kernel-builder-rpm/linux-ps5.spec
index af03a53..60b2014 100644
--- a/docker/kernel-builder-rpm/linux-ps5.spec
+++ b/docker/kernel-builder-rpm/linux-ps5.spec
@@ -31,6 +31,14 @@ cp -a %{stagedir}/. %{buildroot}/
 /boot/System.map-%{kver}
 /boot/config-%{kver}
 /usr/lib/modules/%{kver}
+%config(noreplace) /etc/modprobe.d/moal.conf
+%config(noreplace) /etc/modules-load.d/moal
+/etc/systemd/system/ps5-stage-firmware.service
+/etc/systemd/system/ps5-bt-quiet.service
+/etc/systemd/system/sysinit.target.wants/ps5-stage-firmware.service
+/etc/systemd/system/multi-user.target.wants/ps5-bt-quiet.service
+/usr/local/sbin/ps5-stage-firmware
+/usr/local/sbin/ps5-bt-quiet
 
 %post
 echo ">> linux-ps5 post-install: kernel %{kver}"