diff --git a/README.md b/README.md
index 43f81c8..c1cbf93 100644
--- a/README.md
+++ b/README.md
@@ -112,20 +112,20 @@ values. Nothing to fill in — just run it.
 > `lsblk -o NAME,SERIAL,SIZE,MODEL` before proceeding if the box's disks have
 > changed since `disk-config.nix` was written.
 
-1. Build the installer ISO and write it to a USB stick (from your laptop):
+1. Build the installer ISO and write it to a USB stick (from your laptop —
+   this only needs to be done once; the ISO clones current `master` fresh on
+   every boot, so the same stick stays useful indefinitely):
    ```
    nix build .#nixosConfigurations.installer-iso.config.system.build.isoImage
    sudo dd if=result/iso/*.iso of=/dev/sdX bs=4M status=progress conv=fsync
    ```
 2. Boot terra from the USB stick. It comes up with sshd + DHCP + your laptop
-   pubkey authorized for root, hostname `homelab-installer`.
-3. From your laptop, copy the repo onto the booted installer (it doesn't have
-   its own credentials for the private gitea repo, so push it over instead of
-   cloning from there):
-   ```
-   rsync -av /mnt/hdd_01/data/Dev/homelab/ root@<terra-installer-ip>:/root/homelab/
-   ```
-4. On terra (ssh'd in as root, or at the physical console):
+   pubkey authorized for root, hostname `homelab-installer`, and a
+   `homelab-checkout.service` that clones the (public) repo to
+   `/root/homelab` once network is up. If you ssh in before that finishes,
+   `systemctl status homelab-checkout` tells you; retry with
+   `systemctl restart homelab-checkout` if DHCP was still coming up at boot.
+3. SSH in (or use the physical console) and run the install directly:
    ```
    cd /root/homelab
    ./scripts/deploy install terra localhost
@@ -133,7 +133,7 @@ values. Nothing to fill in — just run it.
    `localhost`/`127.0.0.1` skips nixos-anywhere/ssh and runs disko +
    `nixos-install` directly against `/mnt`. Ships terra's pre-generated host
    key so `/run/secrets/*` decrypts on boot #1.
-5. Reboot into NixOS (remove the USB stick first). Then, same as any other
+4. Reboot into NixOS (remove the USB stick first). Then, same as any other
    host:
    ```
    ssh darman@terra sudo -v          # DO NOT SKIP — see below
diff --git a/flake.nix b/flake.nix
index 809720c..c36e4d4 100644
--- a/flake.nix
+++ b/flake.nix
@@ -162,7 +162,12 @@
           ];
         };
 
-        # Bootable USB recovery installer with our SSH key + sshd + DHCP.
+        # Bootable USB recovery installer with our SSH key + sshd + DHCP. Clones
+        # the (now public) homelab repo fresh at every boot to /root/homelab —
+        # always current master, so the same USB stick stays useful across
+        # install/rescue occasions without ever needing a rebuild. No
+        # rsync/copy-the-repo-over step: boot it, ssh in,
+        # `cd /root/homelab && ./scripts/deploy install ...`.
         # Reusable for any host's manual-USB install path (jupiter, terra, ...).
         # Build the ISO:
         #   nix build .#nixosConfigurations.installer-iso.config.system.build.isoImage
@@ -179,6 +184,27 @@
               ];
               networking.hostName = "homelab-installer";
               environment.systemPackages = [ pkgs.git ];
+
+              # Fresh clone of a PUBLIC repo — no credentials baked into the
+              # ISO. require_tracked() in scripts/deploy still works fine here
+              # (this IS a real git checkout, unlike the old baked-`self`
+              # approach), but retry manually with `systemctl restart
+              # homelab-checkout` if DHCP was still coming up at boot.
+              systemd.services.homelab-checkout = {
+                description = "Clone the homelab repo to /root/homelab";
+                after = [ "network-online.target" ];
+                wants = [ "network-online.target" ];
+                wantedBy = [ "multi-user.target" ];
+                path = [ pkgs.git ];
+                serviceConfig = {
+                  Type = "oneshot";
+                  RemainAfterExit = true;
+                };
+                script = ''
+                  rm -rf /root/homelab
+                  git clone --depth 1 https://git.mgaction.town/darman/homelab.git /root/homelab
+                '';
+              };
             })
           ];
         };
diff --git a/scripts/deploy b/scripts/deploy
index 4998d24..c8851b3 100755
--- a/scripts/deploy
+++ b/scripts/deploy
@@ -98,6 +98,10 @@ kexec_artifacts() {
 require_tracked() {
   local config="$1" cfgfile="hosts/$1/configuration.nix"
   [ -e "$cfgfile" ] || die "no $cfgfile in the repo"
+  # No .git at all (e.g. a tarball export of the repo, no working tree) means
+  # there's nothing that CAN be untracked — nothing to check. Only skip on a
+  # MISSING .git, not on any other git failure.
+  git -C "$REPO" rev-parse --is-inside-work-tree >/dev/null 2>&1 || return 0
   git -C "$REPO" ls-files --error-unmatch "$cfgfile" >/dev/null 2>&1 \
     || die "$cfgfile is untracked — 'git add hosts/$config' first (flakes ignore untracked files)"
 }