diff --git a/scripts/deploy b/scripts/deploy
index 6afb64f..722e179 100755
--- a/scripts/deploy
+++ b/scripts/deploy
@@ -360,11 +360,17 @@ local_install_prepare_and_reboot() {
   fi
 
   echo ">> building installer-iso (kernel + initrd + iso image)"
-  local kernel initrd isodir iso mnt_point iso_relpath boot_src boot_partuuid
+  local kernel initrd isodir iso toplevel mnt_point iso_relpath boot_src boot_partuuid
   kernel="$(nix build --no-link --print-out-paths .#nixosConfigurations.installer-iso.config.system.build.kernel)/bzImage"
   initrd="$(nix build --no-link --print-out-paths .#nixosConfigurations.installer-iso.config.system.build.initialRamdisk)/initrd"
   isodir="$(nix build --no-link --print-out-paths .#nixosConfigurations.installer-iso.config.system.build.isoImage)"
   iso="$(one_match 'installer iso' "$isodir"/iso/*.iso)"
+  # The live ISO's root is a tmpfs; stage 1 finds the real system's init via
+  # init=<toplevel>/init, which the grub/isolinux menu supplies on a normal
+  # boot (iso-image.nix). EFI-stub-booting our own cmdline, we must pass it too
+  # — omit it and stage 1 loop-mounts the iso fine, then dies on
+  # "stage 2 init script (/mnt-root//init) not found".
+  toplevel="$(nix build --no-link --print-out-paths .#nixosConfigurations.installer-iso.config.system.build.toplevel)"
 
   # A short write is not visible until the reboot, when findiso finds a
   # truncated iso and drops to an emergency shell. Check first — `install`
@@ -413,8 +419,13 @@ local_install_prepare_and_reboot() {
 
   # Identical either way — only the mechanism that gets the kernel booted with
   # it differs.
-  local cmdline
-  cmdline="nohibernate root=fstab loglevel=4 lsm=landlock,yama,bpf findiso=$iso_relpath homelab.install=$config homelab.keypart=$boot_partuuid"
+  # root=LABEL=<volumeID> matches what the ISO menu passes; findiso overwrites
+  # /dev/root with the loop-mounted iso regardless, but keep it honest.
+  # boot.shell_on_fail gives a shell instead of the reboot/ignore prompt if
+  # stage 1 ever fails again. init= is the one that actually made this work.
+  local cmdline volumeID
+  volumeID="$(nix eval --raw .#nixosConfigurations.installer-iso.config.isoImage.volumeID)"
+  cmdline="init=$toplevel/init nohibernate root=LABEL=$volumeID boot.shell_on_fail loglevel=4 lsm=landlock,yama,bpf findiso=$iso_relpath homelab.install=$config homelab.keypart=$boot_partuuid"
 
   case "$boot_mode" in
     systemd-boot)