diff --git a/iso/docker/Dockerfile.arm64 b/iso/docker/Dockerfile.arm64
index a171117..f5305ca 100644
--- a/iso/docker/Dockerfile.arm64
+++ b/iso/docker/Dockerfile.arm64
@@ -65,9 +65,13 @@ RUN git clone --depth=1 https://gitlab.archlinux.org/archlinux/archiso.git /tmp/
     cp -a /tmp/archiso/configs /usr/share/archiso/ && \
     rm -rf /tmp/archiso
 
-# Pre-download linux-aarch64 so mkarchiso can install it from local cache
-# even if the [alarm] mirror is unreliable at ISO-build time.
-RUN pacman -Sw --noconfirm linux-aarch64
+# Pre-download linux-aarch64 and create a local pacman repo so mkarchiso
+# can install the kernel without depending on the [alarm] mirror at build time.
+RUN pacman -Sw --noconfirm linux-aarch64 && \
+    mkdir -p /alarm-local-repo && \
+    find /var/cache/pacman/pkg -name "linux-aarch64-*.pkg.tar.*" ! -name "*.sig" \
+        -exec cp {} /alarm-local-repo/ \; && \
+    repo-add /alarm-local-repo/alarm-local.db.tar.gz /alarm-local-repo/linux-aarch64-*.pkg.tar.*
 
 WORKDIR /orionos
 COPY . .
diff --git a/iso/docker/entrypoint-arm64.sh b/iso/docker/entrypoint-arm64.sh
index c074af0..8f6e2eb 100755
--- a/iso/docker/entrypoint-arm64.sh
+++ b/iso/docker/entrypoint-arm64.sh
@@ -23,9 +23,15 @@ cat > "$PROFILE/pacman.conf" <<'PACMANCONF'
 [options]
 HoldPkg     = pacman glibc
 Architecture = aarch64
-# Mirrors occasionally lack .db.sig files — disable sig checks for reliability
 SigLevel    = Never
 
+# alarm-local is a file:// repo baked into the Docker image containing the
+# pre-downloaded linux-aarch64 package. It comes first so pacstrap can always
+# find the kernel even when the upstream [alarm] mirror is unreliable.
+[alarm-local]
+SigLevel = Never
+Server = file:///alarm-local-repo
+
 [core]
 Include = /etc/pacman.d/mirrorlist
 
@@ -651,6 +657,22 @@ echo "=== /usr/lib/modules/ ==="
 ls /usr/lib/modules/ 2>&1 || echo "(empty)"
 echo "=== end diagnostics ==="
 
+# ALARM aarch64 sometimes installs the kernel as /boot/Image (uncompressed EFI
+# stub) rather than /boot/vmlinuz-linux-aarch64. Archiso's vmlinuz glob and
+# systemd-boot both expect the vmlinuz-* naming — create a symlink when needed.
+if [[ ! -f /boot/vmlinuz-linux-aarch64 ]]; then
+    if [[ -f /boot/Image ]]; then
+        ln -sf Image /boot/vmlinuz-linux-aarch64
+        echo ">>> Symlinked /boot/Image -> vmlinuz-linux-aarch64"
+    elif [[ -f /boot/Image.gz ]]; then
+        ln -sf Image.gz /boot/vmlinuz-linux-aarch64
+        echo ">>> Symlinked /boot/Image.gz -> vmlinuz-linux-aarch64"
+    else
+        echo "WARNING: no kernel image found in /boot/ — build will likely fail"
+        ls /boot/ 2>&1 || true
+    fi
+fi
+
 useradd -m -G wheel,audio,video,storage,input -s /bin/bash orion 2>/dev/null || true
 echo "orion:orionos" | chpasswd