Repository: osbuild/osbuild-composer
Pull request #3178 (2022-12-11 14:15:01)

rhel8/9: make edge images properly sysroot.readonly=true
Cherry-picked and adapted from @runcom's #3053 on top of #3166.

achilleas-k: Thanks @thozza.  I added a new commit that just adds a comment to all the places where we set the `"rw"` kernel option explaining why it's needed since it's a bit counter-intuitive.

Patch:
diff --git a/internal/distro/fedora/images.go b/internal/distro/fedora/images.go
index b1c95c4c9..23e70e92c 100644
--- a/internal/distro/fedora/images.go
+++ b/internal/distro/fedora/images.go
@@ -365,6 +365,8 @@ func iotRawImage(workload workload.Workload,
 	img.Users = users.UsersFromBP(customizations.GetUsers())
 	img.Groups = users.GroupsFromBP(customizations.GetGroups())
 
+	// "rw" kernel option is required when /sysroot is mounted read-only to
+	// keep stateful parts of the filesystem writeable (/var/ and /etc)
 	img.KernelOptionsAppend = []string{"modprobe.blacklist=vc4", "rw"}
 	img.Keyboard = "us"
 	img.Locale = "C.UTF-8"
diff --git a/internal/distro/rhel8/pipelines.go b/internal/distro/rhel8/pipelines.go
index a125bcbe1..7293c2b9a 100644
--- a/internal/distro/rhel8/pipelines.go
+++ b/internal/distro/rhel8/pipelines.go
@@ -953,9 +953,12 @@ func ostreeDeployPipeline(
 			OSName: osname,
 		},
 	))
-	p.AddStage(osbuild.NewOSTreeConfigStage(ostreeConfigStageOptions(repoPath, false)))
+	p.AddStage(osbuild.NewOSTreeConfigStage(ostreeConfigStageOptions(repoPath, true)))
 	p.AddStage(osbuild.NewMkdirStage(efiMkdirStageOptions()))
 	kernelOpts := osbuild.GenImageKernelOptions(pt)
+	// "rw" kernel option is required when /sysroot is mounted read-only to
+	// keep stateful parts of the filesystem writeable (/var/ and /etc)
+	kernelOpts = append(kernelOpts, "rw")
 	p.AddStage(osbuild.NewOSTreeDeployStage(
 		&osbuild.OSTreeDeployStageOptions{
 			OsName: osname,
diff --git a/internal/distro/rhel9/images.go b/internal/distro/rhel9/images.go
index 37a8d7df2..b8e136fd5 100644
--- a/internal/distro/rhel9/images.go
+++ b/internal/distro/rhel9/images.go
@@ -326,9 +326,12 @@ func edgeRawImage(workload workload.Workload,
 	img.Users = users.UsersFromBP(customizations.GetUsers())
 	img.Groups = users.GroupsFromBP(customizations.GetGroups())
 
-	img.KernelOptionsAppend = []string{"modprobe.blacklist=vc4"}
+	// "rw" kernel option is required when /sysroot is mounted read-only to
+	// keep stateful parts of the filesystem writeable (/var/ and /etc)
+	img.KernelOptionsAppend = []string{"modprobe.blacklist=vc4", "rw"}
 	img.Keyboard = "us"
 	img.Locale = "C.UTF-8"
+	img.SysrootReadOnly = true
 
 	img.Platform = t.platform
 	img.Workload = workload
@@ -370,9 +373,12 @@ func edgeSimplifiedInstallerImage(workload workload.Workload,
 	rawImg.Users = users.UsersFromBP(customizations.GetUsers())
 	rawImg.Groups = users.GroupsFromBP(customizations.GetGroups())
 
-	rawImg.KernelOptionsAppend = []string{"modprobe.blacklist=vc4"}
+	// "rw" kernel option is required when /sysroot is mounted read-only to
+	// keep stateful parts of the filesystem writeable (/var/ and /etc)
+	rawImg.KernelOptionsAppend = []string{"modprobe.blacklist=vc4", "rw"}
 	rawImg.Keyboard = "us"
 	rawImg.Locale = "C.UTF-8"
+	rawImg.SysrootReadOnly = true
 
 	rawImg.Platform = t.platform
 	rawImg.Workload = workload
diff --git a/internal/image/image_installer.go b/internal/image/image_installer.go
index fc7babab1..da7117fbb 100644
--- a/internal/image/image_installer.go
+++ b/internal/image/image_installer.go
@@ -116,11 +116,9 @@ func (img *ImageInstaller) InstantiateManifest(m *manifest.Manifest,
 	bootTreePipeline.UEFIVendor = img.Platform.GetUEFIVendor()
 	bootTreePipeline.ISOLabel = isoLabel
 
-	kernelOpts := make([]string, 0)
+	kernelOpts := []string{fmt.Sprintf("inst.stage2=hd:LABEL=%s", isoLabel)}
 	if img.ISORootKickstart {
 		kernelOpts = append(kernelOpts, fmt.Sprintf("inst.ks=hd:LABEL=%s:%s", isoLabel, kspath))
-	} else {
-		kernelOpts = append(kernelOpts, fmt.Sprintf("inst.stage2=hd:LABEL=%s", isoLabel))
 	}
 	kernelOpts = append(kernelOpts, img.AdditionalKernelOpts...)
 	bootTreePipeline.KernelOpts = kernelOpts
diff --git a/internal/image/ostree_installer.go b/internal/image/ostree_installer.go
index 4df91ca34..6639a0a1c 100644
--- a/internal/image/ostree_installer.go
+++ b/internal/image/ostree_installer.go
@@ -93,7 +93,7 @@ func (img *OSTreeInstaller) InstantiateManifest(m *manifest.Manifest,
 	bootTreePipeline.Platform = img.Platform
 	bootTreePipeline.UEFIVendor = img.Platform.GetUEFIVendor()
 	bootTreePipeline.ISOLabel = isoLabel
-	bootTreePipeline.KernelOpts = []string{fmt.Sprintf("inst.ks=hd:LABEL=%s:%s", isoLabel, kspath)}
+	bootTreePipeline.KernelOpts = []string{fmt.Sprintf("inst.stage2=hd:LABEL=%s", isoLabel), fmt.Sprintf("inst.ks=hd:LABEL=%s:%s", isoLabel, kspath)}
 
 	isoTreePipeline := manifest.NewAnacondaISOTree(m,
 		buildPipeline,
diff --git a/internal/manifest/efi_boot_tree.go b/internal/manifest/efi_boot_tree.go
index 90e21f78b..61bd170fe 100644
--- a/internal/manifest/efi_boot_tree.go
+++ b/internal/manifest/efi_boot_tree.go
@@ -44,11 +44,6 @@ func (p *EFIBootTree) serialize() osbuild.Pipeline {
 		panic("unsupported architecture")
 	}
 
-	kernelOpts := []string{}
-	if len(p.KernelOpts) > 0 {
-		kernelOpts = append(kernelOpts, p.KernelOpts...)
-	}
-
 	grubOptions := &osbuild.GrubISOStageOptions{
 		Product: osbuild.Product{
 			Name:    p.product,
@@ -56,7 +51,7 @@ func (p *EFIBootTree) serialize() osbuild.Pipeline {
 		},
 		Kernel: osbuild.ISOKernel{
 			Dir:  "/images/pxeboot",
-			Opts: kernelOpts,
+			Opts: p.KernelOpts,
 		},
 		ISOLabel:      p.ISOLabel,
 		Architectures: architectures,
diff --git a/internal/manifest/iso_tree.go b/internal/manifest/iso_tree.go
index ac2a5b149..47557e0eb 100644
--- a/internal/manifest/iso_tree.go
+++ b/internal/manifest/iso_tree.go
@@ -112,10 +112,9 @@ func (p *AnacondaISOTree) serialize() osbuild.Pipeline {
 
 	kernelOpts := []string{}
 
+	kernelOpts = append(kernelOpts, fmt.Sprintf("inst.stage2=hd:LABEL=%s", p.isoLabel))
 	if p.KSPath != "" {
 		kernelOpts = append(kernelOpts, fmt.Sprintf("inst.ks=hd:LABEL=%s:%s", p.isoLabel, p.KSPath))
-	} else {
-		kernelOpts = append(kernelOpts, fmt.Sprintf("inst.stage2=hd:LABEL=%s", p.isoLabel))
 	}
 
 	if len(p.KernelOpts) > 0 {


Test patch:
diff --git a/test/cases/ostree-raw-image.sh b/test/cases/ostree-raw-image.sh
index 571715115..243307ed6 100755
--- a/test/cases/ostree-raw-image.sh
+++ b/test/cases/ostree-raw-image.sh
@@ -491,7 +491,7 @@ ansible_become_pass=${EDGE_USER_PASSWORD}
 EOF
 
     # Test IoT/Edge OS
-    sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type="${OSTREE_OSNAME}" -e ostree_commit="${INSTALL_HASH}" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0
+    sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type="${OSTREE_OSNAME}" -e edge_type=edge-raw-image -e ostree_commit="${INSTALL_HASH}" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0
     check_result
 
     # Clean up BIOS VM
@@ -567,7 +567,7 @@ ansible_become_pass=${EDGE_USER_PASSWORD}
 EOF
 
 # Test IoT/Edge OS
-sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type="${OSTREE_OSNAME}" -e ostree_commit="${INSTALL_HASH}" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0
+sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type="${OSTREE_OSNAME}" -e edge_type=edge-raw-image -e ostree_commit="${INSTALL_HASH}" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0
 check_result
 
 ##################################################################
@@ -721,7 +721,7 @@ ansible_become_pass=${EDGE_USER_PASSWORD}
 EOF
 
 # Test IoT/Edge OS
-sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type="${OSTREE_OSNAME}" -e ostree_commit="${UPGRADE_HASH}" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0
+sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type="${OSTREE_OSNAME}" -e edge_type=edge-raw-image -e ostree_commit="${UPGRADE_HASH}" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0
 check_result
 
 # Final success clean up
diff --git a/test/cases/ostree-simplified-installer.sh b/test/cases/ostree-simplified-installer.sh
index ed8409608..f4d21b19f 100755
--- a/test/cases/ostree-simplified-installer.sh
+++ b/test/cases/ostree-simplified-installer.sh
@@ -519,7 +519,7 @@ ansible_become_pass=${EDGE_USER_PASSWORD}
 EOF
 
 # Test IoT/Edge OS
-sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=redhat -e ostree_commit="${INSTALL_HASH}" -e fdo_credential="true" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0
+sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=redhat -e ostree_commit="${INSTALL_HASH}" -e edge_type=edge-simplified-installer -e fdo_credential="true" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0
 check_result
 
 # Clean up BIOS VM
@@ -643,7 +643,7 @@ ansible_become_pass=${EDGE_USER_PASSWORD}
 EOF
 
 # Test IoT/Edge OS
-sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=redhat -e ostree_commit="${INSTALL_HASH}" -e fdo_credential="true" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0
+sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=redhat -e ostree_commit="${INSTALL_HASH}" -e edge_type=edge-simplified-installer -e fdo_credential="true" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0
 check_result
 
 # Clean up BIOS VM
@@ -765,7 +765,7 @@ ansible_become_pass=${EDGE_USER_PASSWORD}
 EOF
 
 # Test IoT/Edge OS
-sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=redhat -e ostree_commit="${INSTALL_HASH}" -e fdo_credential="true" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0
+sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=redhat -e ostree_commit="${INSTALL_HASH}" -e edge_type=edge-simplified-installer -e fdo_credential="true" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0
 check_result
 
 greenprint "🧹 Clean up VM"
@@ -882,7 +882,7 @@ ansible_become_pass=${EDGE_USER_PASSWORD}
 EOF
 
 # Test IoT/Edge OS
-sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=redhat -e ostree_commit="${INSTALL_HASH}" -e fdo_credential="false" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0
+sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=redhat -e ostree_commit="${INSTALL_HASH}" -e edge_type=edge-simplified-installer -e fdo_credential="false" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0
 check_result
 
 ########################
@@ -1016,7 +1016,7 @@ ansible_become_pass=${EDGE_USER_PASSWORD}
 EOF
 
 # Test IoT/Edge OS
-sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=redhat -e ostree_commit="${UPGRADE_HASH}" -e fdo_credential="false" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0
+sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=redhat -e ostree_commit="${UPGRADE_HASH}" -e edge_type=edge-simplified-installer -e fdo_credential="false" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0
 check_result
 
 # Final success clean up
diff --git a/test/data/ansible/check_ostree.yaml b/test/data/ansible/check_ostree.yaml
index 96919b737..c8313c4d1 100644
--- a/test/data/ansible/check_ostree.yaml
+++ b/test/data/ansible/check_ostree.yaml
@@ -5,6 +5,7 @@
     workspace: "{{ lookup('env', 'WORKSPACE') }}"
     skip_rollback_test: "false"
     fdo_credential: "false"
+    edge_type: "none"
     embeded_container: "false"
     total_counter: "0"
     failed_counter: "0"
@@ -232,7 +233,28 @@
       shell: findmnt -r -o OPTIONS -n /sysroot | awk -F "," '{print $1}'
       register: result_sysroot_mount_status
 
-    - name: /sysroot should be mount with rw permission
+    # https://fedoraproject.org/wiki/Changes/Silverblue_Kinoite_readonly_sysroot
+    # There are three checks here for /sysroot permission based on pr https://github.com/osbuild/osbuild-composer/pull/3053
+    # 1. for edge-commit and edge-installer, check ro when fedora >= 37
+    # 2. for edge-commit and edge-installer, check rw for other os.
+    # 3. for edge-simplified-installer and edge-raw-image, check ro for all os.
+    - name: /sysroot should be mount with ro permission for edge-commit and edge-installer on Fedora >= 37
+      block:
+        - assert:
+            that:
+              - result_sysroot_mount_status.stdout == "ro"
+            fail_msg: "/sysroot is not mounted with ro permission"
+            success_msg: "/sysroot is mounted with ro permission"
+      always:
+        - set_fact:
+            total_counter: "{{ total_counter | int + 1 }}"
+      rescue:
+        - name: failed count + 1
+          set_fact:
+            failed_counter: "{{ failed_counter | int + 1 }}"
+      when: (edge_type == "none") and (ansible_facts['distribution'] == 'Fedora' and ansible_facts['distribution_version'] is version('37', '>='))
+
+    - name: /sysroot should be mount with rw permission for edge-commit and edge-installer on all OS except Fedora >= 37
       block:
         - assert:
             that:
@@ -246,11 +268,10 @@
         - name: failed count + 1
           set_fact:
             failed_counter: "{{ failed_counter | int + 1 }}"
-      when: (ansible_facts['distribution'] == 'Fedora' and ansible_facts['distribution_version'] is version('37', '<')) or
-            (ansible_facts['distribution'] == 'CentOS') or (ansible_facts['distribution'] == 'RedHat')
+      when: (edge_type == "none") and ((ansible_facts['distribution'] == 'Fedora' and ansible_facts['distribution_version'] is version('37', '<')) or
+            (ansible_facts['distribution'] == 'CentOS') or (ansible_facts['distribution'] == 'RedHat'))
 
-    # https://fedoraproject.org/wiki/Changes/Silverblue_Kinoite_readonly_sysroot
-    - name: /sysroot should be mount with ro permission since Fedora 37
+    - name: /sysroot should be mount with ro permission for edge-simplified-installer and edge-raw-image
       block:
         - assert:
             that:
@@ -264,7 +285,7 @@
         - name: failed count + 1
           set_fact:
             failed_counter: "{{ failed_counter | int + 1 }}"
-      when: ansible_facts['distribution'] == 'Fedora' and ansible_facts['distribution_version'] is version('37', '>=')
+      when: edge_type == "edge-simplified-installer" or edge_type == "edge-raw-image"
 
     # case: check /var mount point
     - name: check /var mount point
@@ -397,8 +418,8 @@
         - name: failed count + 1
           set_fact:
             failed_counter: "{{ failed_counter | int + 1 }}"
-      when: (ansible_facts['distribution'] == 'Fedora' and ansible_facts['distribution_version'] is version('37', '<')) or
-            (ansible_facts['distribution'] == 'CentOS') or (ansible_facts['distribution'] == 'RedHat')
+      when: (edge_type == "none") and ((ansible_facts['distribution'] == 'Fedora' and ansible_facts['distribution_version'] is version('37', '<')) or
+            (ansible_facts['distribution'] == 'CentOS') or (ansible_facts['distribution'] == 'RedHat'))
 
     # case: check dmesg error and failed log
     - name: check dmesg output
diff --git a/test/data/manifests/centos_8-aarch64-edge_raw_image-boot.json b/test/data/manifests/centos_8-aarch64-edge_raw_image-boot.json
index c27193efb..96d1be02c 100644
--- a/test/data/manifests/centos_8-aarch64-edge_raw_image-boot.json
+++ b/test/data/manifests/centos_8-aarch64-edge_raw_image-boot.json
@@ -2467,7 +2467,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -2498,7 +2498,8 @@
                 "label": "root"
               },
               "kernel_opts": [
-                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75"
+                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
+                "rw"
               ]
             }
           },
diff --git a/test/data/manifests/centos_8-aarch64-edge_simplified_installer-boot.json b/test/data/manifests/centos_8-aarch64-edge_simplified_installer-boot.json
index 8fb76e15e..d19531bbd 100644
--- a/test/data/manifests/centos_8-aarch64-edge_simplified_installer-boot.json
+++ b/test/data/manifests/centos_8-aarch64-edge_simplified_installer-boot.json
@@ -2507,7 +2507,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -2538,7 +2538,8 @@
                 "label": "root"
               },
               "kernel_opts": [
-                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75"
+                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
+                "rw"
               ]
             }
           },
diff --git a/test/data/manifests/centos_8-x86_64-edge_raw_image-boot.json b/test/data/manifests/centos_8-x86_64-edge_raw_image-boot.json
index f4ce8cc61..21342de9f 100644
--- a/test/data/manifests/centos_8-x86_64-edge_raw_image-boot.json
+++ b/test/data/manifests/centos_8-x86_64-edge_raw_image-boot.json
@@ -2515,7 +2515,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -2546,7 +2546,8 @@
                 "label": "root"
               },
               "kernel_opts": [
-                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75"
+                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
+                "rw"
               ]
             }
           },
diff --git a/test/data/manifests/centos_8-x86_64-edge_simplified_installer-boot.json b/test/data/manifests/centos_8-x86_64-edge_simplified_installer-boot.json
index 8d3308d12..599b45277 100644
--- a/test/data/manifests/centos_8-x86_64-edge_simplified_installer-boot.json
+++ b/test/data/manifests/centos_8-x86_64-edge_simplified_installer-boot.json
@@ -2571,7 +2571,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -2602,7 +2602,8 @@
                 "label": "root"
               },
               "kernel_opts": [
-                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75"
+                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
+                "rw"
               ]
             }
           },
diff --git a/test/data/manifests/centos_9-aarch64-edge_installer-boot.json b/test/data/manifests/centos_9-aarch64-edge_installer-boot.json
index 70343aae4..8b81a54f7 100644
--- a/test/data/manifests/centos_9-aarch64-edge_installer-boot.json
+++ b/test/data/manifests/centos_9-aarch64-edge_installer-boot.json
@@ -9512,6 +9512,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=CentOS-Stream-9-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=CentOS-Stream-9-BaseOS-aarch64:/osbuild.ks"
                 ]
               },
@@ -9605,6 +9606,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=CentOS-Stream-9-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=CentOS-Stream-9-BaseOS-aarch64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/centos_9-aarch64-edge_installer_with_users-boot.json b/test/data/manifests/centos_9-aarch64-edge_installer_with_users-boot.json
index 1ca632023..1c94ee4d1 100644
--- a/test/data/manifests/centos_9-aarch64-edge_installer_with_users-boot.json
+++ b/test/data/manifests/centos_9-aarch64-edge_installer_with_users-boot.json
@@ -9541,6 +9541,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=CentOS-Stream-9-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=CentOS-Stream-9-BaseOS-aarch64:/osbuild.ks"
                 ]
               },
@@ -9634,6 +9635,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=CentOS-Stream-9-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=CentOS-Stream-9-BaseOS-aarch64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/centos_9-aarch64-edge_raw_image-boot.json b/test/data/manifests/centos_9-aarch64-edge_raw_image-boot.json
index bb434bb3e..e9c6337f4 100644
--- a/test/data/manifests/centos_9-aarch64-edge_raw_image-boot.json
+++ b/test/data/manifests/centos_9-aarch64-edge_raw_image-boot.json
@@ -2223,7 +2223,8 @@
               },
               "kernel_opts": [
                 "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
-                "modprobe.blacklist=vc4"
+                "modprobe.blacklist=vc4",
+                "rw"
               ]
             }
           },
@@ -2254,7 +2255,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -2380,7 +2381,7 @@
             "options": {
               "root_fs_uuid": "fb180daf-48a7-4ee0-b10d-394651850fd4",
               "boot_fs_uuid": "0194fdc2-fa2f-4cc0-81d3-ff12045b73c8",
-              "kernel_opts": "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75,modprobe.blacklist=vc4",
+              "kernel_opts": "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75,modprobe.blacklist=vc4,rw",
               "uefi": {
                 "vendor": "centos",
                 "install": true,
diff --git a/test/data/manifests/centos_9-aarch64-edge_simplified_installer-boot.json b/test/data/manifests/centos_9-aarch64-edge_simplified_installer-boot.json
index d06bf5958..22d1c39c3 100644
--- a/test/data/manifests/centos_9-aarch64-edge_simplified_installer-boot.json
+++ b/test/data/manifests/centos_9-aarch64-edge_simplified_installer-boot.json
@@ -2607,7 +2607,8 @@
               },
               "kernel_opts": [
                 "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
-                "modprobe.blacklist=vc4"
+                "modprobe.blacklist=vc4",
+                "rw"
               ]
             }
           },
@@ -2638,7 +2639,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -2764,7 +2765,7 @@
             "options": {
               "root_fs_uuid": "fb180daf-48a7-4ee0-b10d-394651850fd4",
               "boot_fs_uuid": "0194fdc2-fa2f-4cc0-81d3-ff12045b73c8",
-              "kernel_opts": "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75,modprobe.blacklist=vc4",
+              "kernel_opts": "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75,modprobe.blacklist=vc4,rw",
               "uefi": {
                 "vendor": "centos",
                 "install": true,
diff --git a/test/data/manifests/centos_9-aarch64-image_installer-boot.json b/test/data/manifests/centos_9-aarch64-image_installer-boot.json
index b6b2ebdb0..519af8e6d 100644
--- a/test/data/manifests/centos_9-aarch64-image_installer-boot.json
+++ b/test/data/manifests/centos_9-aarch64-image_installer-boot.json
@@ -9290,6 +9290,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=CentOS-Stream-9-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=CentOS-Stream-9-BaseOS-aarch64:/osbuild.ks"
                 ]
               },
@@ -13185,6 +13186,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=CentOS-Stream-9-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=CentOS-Stream-9-BaseOS-aarch64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/centos_9-aarch64-image_installer_with_users-boot.json b/test/data/manifests/centos_9-aarch64-image_installer_with_users-boot.json
index dd3e934a0..eba3ac384 100644
--- a/test/data/manifests/centos_9-aarch64-image_installer_with_users-boot.json
+++ b/test/data/manifests/centos_9-aarch64-image_installer_with_users-boot.json
@@ -9325,6 +9325,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=CentOS-Stream-9-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=CentOS-Stream-9-BaseOS-aarch64:/osbuild.ks"
                 ]
               },
@@ -13372,6 +13373,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=CentOS-Stream-9-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=CentOS-Stream-9-BaseOS-aarch64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/centos_9-x86_64-edge_installer-boot.json b/test/data/manifests/centos_9-x86_64-edge_installer-boot.json
index 4e450b4d8..651444ec1 100644
--- a/test/data/manifests/centos_9-x86_64-edge_installer-boot.json
+++ b/test/data/manifests/centos_9-x86_64-edge_installer-boot.json
@@ -9673,6 +9673,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=CentOS-Stream-9-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=CentOS-Stream-9-BaseOS-x86_64:/osbuild.ks"
                 ]
               },
@@ -9766,6 +9767,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=CentOS-Stream-9-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=CentOS-Stream-9-BaseOS-x86_64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/centos_9-x86_64-edge_installer_with_users-boot.json b/test/data/manifests/centos_9-x86_64-edge_installer_with_users-boot.json
index 1894d60f3..cb295be23 100644
--- a/test/data/manifests/centos_9-x86_64-edge_installer_with_users-boot.json
+++ b/test/data/manifests/centos_9-x86_64-edge_installer_with_users-boot.json
@@ -9702,6 +9702,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=CentOS-Stream-9-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=CentOS-Stream-9-BaseOS-x86_64:/osbuild.ks"
                 ]
               },
@@ -9795,6 +9796,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=CentOS-Stream-9-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=CentOS-Stream-9-BaseOS-x86_64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/centos_9-x86_64-edge_raw_image-boot.json b/test/data/manifests/centos_9-x86_64-edge_raw_image-boot.json
index c4e98f466..b9a133113 100644
--- a/test/data/manifests/centos_9-x86_64-edge_raw_image-boot.json
+++ b/test/data/manifests/centos_9-x86_64-edge_raw_image-boot.json
@@ -2350,7 +2350,8 @@
               },
               "kernel_opts": [
                 "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
-                "modprobe.blacklist=vc4"
+                "modprobe.blacklist=vc4",
+                "rw"
               ]
             }
           },
@@ -2381,7 +2382,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -2507,7 +2508,7 @@
             "options": {
               "root_fs_uuid": "fb180daf-48a7-4ee0-b10d-394651850fd4",
               "boot_fs_uuid": "0194fdc2-fa2f-4cc0-81d3-ff12045b73c8",
-              "kernel_opts": "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75,modprobe.blacklist=vc4",
+              "kernel_opts": "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75,modprobe.blacklist=vc4,rw",
               "legacy": "i386-pc",
               "uefi": {
                 "vendor": "centos",
diff --git a/test/data/manifests/centos_9-x86_64-edge_simplified_installer-boot.json b/test/data/manifests/centos_9-x86_64-edge_simplified_installer-boot.json
index e3fc2788a..a1875944e 100644
--- a/test/data/manifests/centos_9-x86_64-edge_simplified_installer-boot.json
+++ b/test/data/manifests/centos_9-x86_64-edge_simplified_installer-boot.json
@@ -2662,7 +2662,8 @@
               },
               "kernel_opts": [
                 "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
-                "modprobe.blacklist=vc4"
+                "modprobe.blacklist=vc4",
+                "rw"
               ]
             }
           },
@@ -2693,7 +2694,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -2819,7 +2820,7 @@
             "options": {
               "root_fs_uuid": "fb180daf-48a7-4ee0-b10d-394651850fd4",
               "boot_fs_uuid": "0194fdc2-fa2f-4cc0-81d3-ff12045b73c8",
-              "kernel_opts": "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75,modprobe.blacklist=vc4",
+              "kernel_opts": "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75,modprobe.blacklist=vc4,rw",
               "uefi": {
                 "vendor": "centos",
                 "install": true,
diff --git a/test/data/manifests/centos_9-x86_64-image_installer-boot.json b/test/data/manifests/centos_9-x86_64-image_installer-boot.json
index 51c6e8ca8..2230db5ed 100644
--- a/test/data/manifests/centos_9-x86_64-image_installer-boot.json
+++ b/test/data/manifests/centos_9-x86_64-image_installer-boot.json
@@ -9451,6 +9451,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=CentOS-Stream-9-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=CentOS-Stream-9-BaseOS-x86_64:/osbuild.ks"
                 ]
               },
@@ -13411,6 +13412,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=CentOS-Stream-9-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=CentOS-Stream-9-BaseOS-x86_64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/centos_9-x86_64-image_installer_with_users-boot.json b/test/data/manifests/centos_9-x86_64-image_installer_with_users-boot.json
index 3d4eca30b..9b80fca34 100644
--- a/test/data/manifests/centos_9-x86_64-image_installer_with_users-boot.json
+++ b/test/data/manifests/centos_9-x86_64-image_installer_with_users-boot.json
@@ -9486,6 +9486,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=CentOS-Stream-9-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=CentOS-Stream-9-BaseOS-x86_64:/osbuild.ks"
                 ]
               },
@@ -13598,6 +13599,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=CentOS-Stream-9-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=CentOS-Stream-9-BaseOS-x86_64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/fedora_35-aarch64-iot_installer-boot.json b/test/data/manifests/fedora_35-aarch64-iot_installer-boot.json
index 59b6d7ae7..9c01a3276 100644
--- a/test/data/manifests/fedora_35-aarch64-iot_installer-boot.json
+++ b/test/data/manifests/fedora_35-aarch64-iot_installer-boot.json
@@ -10079,6 +10079,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=Fedora-35-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=Fedora-35-BaseOS-aarch64:/osbuild.ks"
                 ]
               },
@@ -10169,6 +10170,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=Fedora-35-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=Fedora-35-BaseOS-aarch64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/fedora_35-aarch64-iot_installer_with_users-boot.json b/test/data/manifests/fedora_35-aarch64-iot_installer_with_users-boot.json
index 83cd6c630..eef38d6c7 100644
--- a/test/data/manifests/fedora_35-aarch64-iot_installer_with_users-boot.json
+++ b/test/data/manifests/fedora_35-aarch64-iot_installer_with_users-boot.json
@@ -10108,6 +10108,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=Fedora-35-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=Fedora-35-BaseOS-aarch64:/osbuild.ks"
                 ]
               },
@@ -10198,6 +10199,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=Fedora-35-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=Fedora-35-BaseOS-aarch64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/fedora_35-x86_64-iot_installer-boot.json b/test/data/manifests/fedora_35-x86_64-iot_installer-boot.json
index 350c128c4..afa698084 100644
--- a/test/data/manifests/fedora_35-x86_64-iot_installer-boot.json
+++ b/test/data/manifests/fedora_35-x86_64-iot_installer-boot.json
@@ -10272,6 +10272,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=Fedora-35-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=Fedora-35-BaseOS-x86_64:/osbuild.ks"
                 ]
               },
@@ -10362,6 +10363,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=Fedora-35-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=Fedora-35-BaseOS-x86_64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/fedora_35-x86_64-iot_installer_with_users-boot.json b/test/data/manifests/fedora_35-x86_64-iot_installer_with_users-boot.json
index 24052d44a..713df42a5 100644
--- a/test/data/manifests/fedora_35-x86_64-iot_installer_with_users-boot.json
+++ b/test/data/manifests/fedora_35-x86_64-iot_installer_with_users-boot.json
@@ -10301,6 +10301,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=Fedora-35-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=Fedora-35-BaseOS-x86_64:/osbuild.ks"
                 ]
               },
@@ -10391,6 +10392,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=Fedora-35-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=Fedora-35-BaseOS-x86_64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/fedora_36-aarch64-iot_installer-boot.json b/test/data/manifests/fedora_36-aarch64-iot_installer-boot.json
index d2c355fc7..92c72c27e 100644
--- a/test/data/manifests/fedora_36-aarch64-iot_installer-boot.json
+++ b/test/data/manifests/fedora_36-aarch64-iot_installer-boot.json
@@ -10600,6 +10600,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=Fedora-36-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=Fedora-36-BaseOS-aarch64:/osbuild.ks"
                 ]
               },
@@ -10690,6 +10691,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=Fedora-36-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=Fedora-36-BaseOS-aarch64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/fedora_36-aarch64-iot_installer_with_users-boot.json b/test/data/manifests/fedora_36-aarch64-iot_installer_with_users-boot.json
index f70befd8b..901671d2a 100644
--- a/test/data/manifests/fedora_36-aarch64-iot_installer_with_users-boot.json
+++ b/test/data/manifests/fedora_36-aarch64-iot_installer_with_users-boot.json
@@ -10629,6 +10629,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=Fedora-36-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=Fedora-36-BaseOS-aarch64:/osbuild.ks"
                 ]
               },
@@ -10719,6 +10720,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=Fedora-36-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=Fedora-36-BaseOS-aarch64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/fedora_36-x86_64-iot_installer-boot.json b/test/data/manifests/fedora_36-x86_64-iot_installer-boot.json
index f961565ee..b8ef96ed7 100644
--- a/test/data/manifests/fedora_36-x86_64-iot_installer-boot.json
+++ b/test/data/manifests/fedora_36-x86_64-iot_installer-boot.json
@@ -10785,6 +10785,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=Fedora-36-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=Fedora-36-BaseOS-x86_64:/osbuild.ks"
                 ]
               },
@@ -10875,6 +10876,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=Fedora-36-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=Fedora-36-BaseOS-x86_64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/fedora_36-x86_64-iot_installer_with_users-boot.json b/test/data/manifests/fedora_36-x86_64-iot_installer_with_users-boot.json
index a61a5a066..7aeb97f03 100644
--- a/test/data/manifests/fedora_36-x86_64-iot_installer_with_users-boot.json
+++ b/test/data/manifests/fedora_36-x86_64-iot_installer_with_users-boot.json
@@ -10814,6 +10814,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=Fedora-36-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=Fedora-36-BaseOS-x86_64:/osbuild.ks"
                 ]
               },
@@ -10904,6 +10905,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=Fedora-36-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=Fedora-36-BaseOS-x86_64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/fedora_37-aarch64-iot_installer-boot.json b/test/data/manifests/fedora_37-aarch64-iot_installer-boot.json
index 9b695c5bd..e8cdd1ef2 100644
--- a/test/data/manifests/fedora_37-aarch64-iot_installer-boot.json
+++ b/test/data/manifests/fedora_37-aarch64-iot_installer-boot.json
@@ -10726,6 +10726,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=Fedora-37-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=Fedora-37-BaseOS-aarch64:/osbuild.ks"
                 ]
               },
@@ -10816,6 +10817,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=Fedora-37-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=Fedora-37-BaseOS-aarch64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/fedora_37-aarch64-iot_installer_with_users-boot.json b/test/data/manifests/fedora_37-aarch64-iot_installer_with_users-boot.json
index 08bf3e09c..977f21e16 100644
--- a/test/data/manifests/fedora_37-aarch64-iot_installer_with_users-boot.json
+++ b/test/data/manifests/fedora_37-aarch64-iot_installer_with_users-boot.json
@@ -10755,6 +10755,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=Fedora-37-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=Fedora-37-BaseOS-aarch64:/osbuild.ks"
                 ]
               },
@@ -10845,6 +10846,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=Fedora-37-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=Fedora-37-BaseOS-aarch64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/fedora_37-x86_64-iot_installer-boot.json b/test/data/manifests/fedora_37-x86_64-iot_installer-boot.json
index 8b9d94964..5b8b8a99e 100644
--- a/test/data/manifests/fedora_37-x86_64-iot_installer-boot.json
+++ b/test/data/manifests/fedora_37-x86_64-iot_installer-boot.json
@@ -10919,6 +10919,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=Fedora-37-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=Fedora-37-BaseOS-x86_64:/osbuild.ks"
                 ]
               },
@@ -11009,6 +11010,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=Fedora-37-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=Fedora-37-BaseOS-x86_64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/fedora_37-x86_64-iot_installer_with_users-boot.json b/test/data/manifests/fedora_37-x86_64-iot_installer_with_users-boot.json
index cc8bf9d3b..114838e87 100644
--- a/test/data/manifests/fedora_37-x86_64-iot_installer_with_users-boot.json
+++ b/test/data/manifests/fedora_37-x86_64-iot_installer_with_users-boot.json
@@ -10948,6 +10948,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=Fedora-37-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=Fedora-37-BaseOS-x86_64:/osbuild.ks"
                 ]
               },
@@ -11038,6 +11039,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=Fedora-37-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=Fedora-37-BaseOS-x86_64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/fedora_38-aarch64-iot_installer-boot.json b/test/data/manifests/fedora_38-aarch64-iot_installer-boot.json
index 604338ae3..57326ac45 100644
--- a/test/data/manifests/fedora_38-aarch64-iot_installer-boot.json
+++ b/test/data/manifests/fedora_38-aarch64-iot_installer-boot.json
@@ -10365,6 +10365,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=Fedora-38-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=Fedora-38-BaseOS-aarch64:/osbuild.ks"
                 ]
               },
@@ -10455,6 +10456,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=Fedora-38-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=Fedora-38-BaseOS-aarch64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/fedora_38-aarch64-iot_installer_with_users-boot.json b/test/data/manifests/fedora_38-aarch64-iot_installer_with_users-boot.json
index 982f90bf0..9bfe2b9d0 100644
--- a/test/data/manifests/fedora_38-aarch64-iot_installer_with_users-boot.json
+++ b/test/data/manifests/fedora_38-aarch64-iot_installer_with_users-boot.json
@@ -10394,6 +10394,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=Fedora-38-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=Fedora-38-BaseOS-aarch64:/osbuild.ks"
                 ]
               },
@@ -10484,6 +10485,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=Fedora-38-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=Fedora-38-BaseOS-aarch64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/fedora_38-x86_64-iot_installer-boot.json b/test/data/manifests/fedora_38-x86_64-iot_installer-boot.json
index ff7b4fbcb..60eddd1be 100644
--- a/test/data/manifests/fedora_38-x86_64-iot_installer-boot.json
+++ b/test/data/manifests/fedora_38-x86_64-iot_installer-boot.json
@@ -10542,6 +10542,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=Fedora-38-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=Fedora-38-BaseOS-x86_64:/osbuild.ks"
                 ]
               },
@@ -10632,6 +10633,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=Fedora-38-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=Fedora-38-BaseOS-x86_64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/fedora_38-x86_64-iot_installer_with_users-boot.json b/test/data/manifests/fedora_38-x86_64-iot_installer_with_users-boot.json
index 09a9db5f6..b37d93933 100644
--- a/test/data/manifests/fedora_38-x86_64-iot_installer_with_users-boot.json
+++ b/test/data/manifests/fedora_38-x86_64-iot_installer_with_users-boot.json
@@ -10571,6 +10571,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=Fedora-38-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=Fedora-38-BaseOS-x86_64:/osbuild.ks"
                 ]
               },
@@ -10661,6 +10662,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=Fedora-38-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=Fedora-38-BaseOS-x86_64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/rhel_8-aarch64-edge_raw_image-boot.json b/test/data/manifests/rhel_8-aarch64-edge_raw_image-boot.json
index bcc51f508..c9debe8d0 100644
--- a/test/data/manifests/rhel_8-aarch64-edge_raw_image-boot.json
+++ b/test/data/manifests/rhel_8-aarch64-edge_raw_image-boot.json
@@ -985,7 +985,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -1016,7 +1016,8 @@
                 "label": "root"
               },
               "kernel_opts": [
-                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75"
+                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
+                "rw"
               ]
             }
           },
diff --git a/test/data/manifests/rhel_8-aarch64-edge_simplified_installer-boot.json b/test/data/manifests/rhel_8-aarch64-edge_simplified_installer-boot.json
index 1053c27da..aafaab760 100644
--- a/test/data/manifests/rhel_8-aarch64-edge_simplified_installer-boot.json
+++ b/test/data/manifests/rhel_8-aarch64-edge_simplified_installer-boot.json
@@ -1005,7 +1005,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -1036,7 +1036,8 @@
                 "label": "root"
               },
               "kernel_opts": [
-                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75"
+                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
+                "rw"
               ]
             }
           },
diff --git a/test/data/manifests/rhel_8-x86_64-edge_raw_image-boot.json b/test/data/manifests/rhel_8-x86_64-edge_raw_image-boot.json
index 330895a47..6f6e3bc6a 100644
--- a/test/data/manifests/rhel_8-x86_64-edge_raw_image-boot.json
+++ b/test/data/manifests/rhel_8-x86_64-edge_raw_image-boot.json
@@ -1003,7 +1003,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -1034,7 +1034,8 @@
                 "label": "root"
               },
               "kernel_opts": [
-                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75"
+                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
+                "rw"
               ]
             }
           },
diff --git a/test/data/manifests/rhel_8-x86_64-edge_simplified_installer-boot.json b/test/data/manifests/rhel_8-x86_64-edge_simplified_installer-boot.json
index f329608e9..c13677306 100644
--- a/test/data/manifests/rhel_8-x86_64-edge_simplified_installer-boot.json
+++ b/test/data/manifests/rhel_8-x86_64-edge_simplified_installer-boot.json
@@ -1029,7 +1029,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -1060,7 +1060,8 @@
                 "label": "root"
               },
               "kernel_opts": [
-                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75"
+                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
+                "rw"
               ]
             }
           },
diff --git a/test/data/manifests/rhel_86-aarch64-edge_raw_image-boot.json b/test/data/manifests/rhel_86-aarch64-edge_raw_image-boot.json
index 703761f9c..95bc5fd0d 100644
--- a/test/data/manifests/rhel_86-aarch64-edge_raw_image-boot.json
+++ b/test/data/manifests/rhel_86-aarch64-edge_raw_image-boot.json
@@ -985,7 +985,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -1016,7 +1016,8 @@
                 "label": "root"
               },
               "kernel_opts": [
-                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75"
+                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
+                "rw"
               ]
             }
           },
diff --git a/test/data/manifests/rhel_86-aarch64-edge_simplified_installer-boot.json b/test/data/manifests/rhel_86-aarch64-edge_simplified_installer-boot.json
index 14d70f0b9..93334fbcf 100644
--- a/test/data/manifests/rhel_86-aarch64-edge_simplified_installer-boot.json
+++ b/test/data/manifests/rhel_86-aarch64-edge_simplified_installer-boot.json
@@ -1005,7 +1005,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -1036,7 +1036,8 @@
                 "label": "root"
               },
               "kernel_opts": [
-                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75"
+                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
+                "rw"
               ]
             }
           },
diff --git a/test/data/manifests/rhel_86-x86_64-edge_raw_image-boot.json b/test/data/manifests/rhel_86-x86_64-edge_raw_image-boot.json
index 6630dc886..a9229d227 100644
--- a/test/data/manifests/rhel_86-x86_64-edge_raw_image-boot.json
+++ b/test/data/manifests/rhel_86-x86_64-edge_raw_image-boot.json
@@ -1003,7 +1003,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -1034,7 +1034,8 @@
                 "label": "root"
               },
               "kernel_opts": [
-                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75"
+                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
+                "rw"
               ]
             }
           },
diff --git a/test/data/manifests/rhel_86-x86_64-edge_simplified_installer-boot.json b/test/data/manifests/rhel_86-x86_64-edge_simplified_installer-boot.json
index 139bd2ef4..46e9b49f6 100644
--- a/test/data/manifests/rhel_86-x86_64-edge_simplified_installer-boot.json
+++ b/test/data/manifests/rhel_86-x86_64-edge_simplified_installer-boot.json
@@ -1029,7 +1029,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -1060,7 +1060,8 @@
                 "label": "root"
               },
               "kernel_opts": [
-                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75"
+                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
+                "rw"
               ]
             }
           },
diff --git a/test/data/manifests/rhel_87-aarch64-edge_raw_image-boot.json b/test/data/manifests/rhel_87-aarch64-edge_raw_image-boot.json
index 8c3e1eeae..f95df312e 100644
--- a/test/data/manifests/rhel_87-aarch64-edge_raw_image-boot.json
+++ b/test/data/manifests/rhel_87-aarch64-edge_raw_image-boot.json
@@ -982,7 +982,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -1013,7 +1013,8 @@
                 "label": "root"
               },
               "kernel_opts": [
-                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75"
+                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
+                "rw"
               ]
             }
           },
diff --git a/test/data/manifests/rhel_87-aarch64-edge_simplified_installer-boot.json b/test/data/manifests/rhel_87-aarch64-edge_simplified_installer-boot.json
index 7ea32ff23..351685742 100644
--- a/test/data/manifests/rhel_87-aarch64-edge_simplified_installer-boot.json
+++ b/test/data/manifests/rhel_87-aarch64-edge_simplified_installer-boot.json
@@ -1002,7 +1002,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -1033,7 +1033,8 @@
                 "label": "root"
               },
               "kernel_opts": [
-                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75"
+                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
+                "rw"
               ]
             }
           },
diff --git a/test/data/manifests/rhel_87-x86_64-edge_raw_image-boot.json b/test/data/manifests/rhel_87-x86_64-edge_raw_image-boot.json
index 1a0977da3..1614329e3 100644
--- a/test/data/manifests/rhel_87-x86_64-edge_raw_image-boot.json
+++ b/test/data/manifests/rhel_87-x86_64-edge_raw_image-boot.json
@@ -1000,7 +1000,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -1031,7 +1031,8 @@
                 "label": "root"
               },
               "kernel_opts": [
-                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75"
+                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
+                "rw"
               ]
             }
           },
diff --git a/test/data/manifests/rhel_87-x86_64-edge_simplified_installer-boot.json b/test/data/manifests/rhel_87-x86_64-edge_simplified_installer-boot.json
index eda70a6c0..494f54eac 100644
--- a/test/data/manifests/rhel_87-x86_64-edge_simplified_installer-boot.json
+++ b/test/data/manifests/rhel_87-x86_64-edge_simplified_installer-boot.json
@@ -1026,7 +1026,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -1057,7 +1057,8 @@
                 "label": "root"
               },
               "kernel_opts": [
-                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75"
+                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
+                "rw"
               ]
             }
           },
diff --git a/test/data/manifests/rhel_88-aarch64-edge_raw_image-boot.json b/test/data/manifests/rhel_88-aarch64-edge_raw_image-boot.json
index 8093c39c3..fccbbe4be 100644
--- a/test/data/manifests/rhel_88-aarch64-edge_raw_image-boot.json
+++ b/test/data/manifests/rhel_88-aarch64-edge_raw_image-boot.json
@@ -982,7 +982,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -1013,7 +1013,8 @@
                 "label": "root"
               },
               "kernel_opts": [
-                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75"
+                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
+                "rw"
               ]
             }
           },
diff --git a/test/data/manifests/rhel_88-aarch64-edge_simplified_installer-boot.json b/test/data/manifests/rhel_88-aarch64-edge_simplified_installer-boot.json
index 5a686f519..f9aa352e0 100644
--- a/test/data/manifests/rhel_88-aarch64-edge_simplified_installer-boot.json
+++ b/test/data/manifests/rhel_88-aarch64-edge_simplified_installer-boot.json
@@ -1002,7 +1002,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -1033,7 +1033,8 @@
                 "label": "root"
               },
               "kernel_opts": [
-                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75"
+                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
+                "rw"
               ]
             }
           },
diff --git a/test/data/manifests/rhel_88-x86_64-edge_raw_image-boot.json b/test/data/manifests/rhel_88-x86_64-edge_raw_image-boot.json
index 2efc705ef..1cac71432 100644
--- a/test/data/manifests/rhel_88-x86_64-edge_raw_image-boot.json
+++ b/test/data/manifests/rhel_88-x86_64-edge_raw_image-boot.json
@@ -1000,7 +1000,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -1031,7 +1031,8 @@
                 "label": "root"
               },
               "kernel_opts": [
-                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75"
+                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
+                "rw"
               ]
             }
           },
diff --git a/test/data/manifests/rhel_88-x86_64-edge_simplified_installer-boot.json b/test/data/manifests/rhel_88-x86_64-edge_simplified_installer-boot.json
index fe297307e..767eebac7 100644
--- a/test/data/manifests/rhel_88-x86_64-edge_simplified_installer-boot.json
+++ b/test/data/manifests/rhel_88-x86_64-edge_simplified_installer-boot.json
@@ -1026,7 +1026,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -1057,7 +1057,8 @@
                 "label": "root"
               },
               "kernel_opts": [
-                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75"
+                "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
+                "rw"
               ]
             }
           },
diff --git a/test/data/manifests/rhel_90-aarch64-edge_installer-boot.json b/test/data/manifests/rhel_90-aarch64-edge_installer-boot.json
index d4003fd85..f5c3135af 100644
--- a/test/data/manifests/rhel_90-aarch64-edge_installer-boot.json
+++ b/test/data/manifests/rhel_90-aarch64-edge_installer-boot.json
@@ -3647,6 +3647,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-0-0-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=RHEL-9-0-0-BaseOS-aarch64:/osbuild.ks"
                 ]
               },
@@ -3740,6 +3741,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-0-0-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=RHEL-9-0-0-BaseOS-aarch64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/rhel_90-aarch64-edge_installer_with_users-boot.json b/test/data/manifests/rhel_90-aarch64-edge_installer_with_users-boot.json
index 3f526cdd4..2264cf904 100644
--- a/test/data/manifests/rhel_90-aarch64-edge_installer_with_users-boot.json
+++ b/test/data/manifests/rhel_90-aarch64-edge_installer_with_users-boot.json
@@ -3676,6 +3676,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-0-0-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=RHEL-9-0-0-BaseOS-aarch64:/osbuild.ks"
                 ]
               },
@@ -3769,6 +3770,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-0-0-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=RHEL-9-0-0-BaseOS-aarch64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/rhel_90-aarch64-edge_raw_image-boot.json b/test/data/manifests/rhel_90-aarch64-edge_raw_image-boot.json
index 22ac86d95..304bbb931 100644
--- a/test/data/manifests/rhel_90-aarch64-edge_raw_image-boot.json
+++ b/test/data/manifests/rhel_90-aarch64-edge_raw_image-boot.json
@@ -836,7 +836,8 @@
               },
               "kernel_opts": [
                 "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
-                "modprobe.blacklist=vc4"
+                "modprobe.blacklist=vc4",
+                "rw"
               ]
             }
           },
@@ -867,7 +868,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -993,7 +994,7 @@
             "options": {
               "root_fs_uuid": "fb180daf-48a7-4ee0-b10d-394651850fd4",
               "boot_fs_uuid": "0194fdc2-fa2f-4cc0-81d3-ff12045b73c8",
-              "kernel_opts": "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75,modprobe.blacklist=vc4",
+              "kernel_opts": "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75,modprobe.blacklist=vc4,rw",
               "uefi": {
                 "vendor": "redhat",
                 "install": true,
diff --git a/test/data/manifests/rhel_90-aarch64-edge_simplified_installer-boot.json b/test/data/manifests/rhel_90-aarch64-edge_simplified_installer-boot.json
index 36fc60626..95f97c2b2 100644
--- a/test/data/manifests/rhel_90-aarch64-edge_simplified_installer-boot.json
+++ b/test/data/manifests/rhel_90-aarch64-edge_simplified_installer-boot.json
@@ -985,7 +985,8 @@
               },
               "kernel_opts": [
                 "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
-                "modprobe.blacklist=vc4"
+                "modprobe.blacklist=vc4",
+                "rw"
               ]
             }
           },
@@ -1016,7 +1017,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -1142,7 +1143,7 @@
             "options": {
               "root_fs_uuid": "fb180daf-48a7-4ee0-b10d-394651850fd4",
               "boot_fs_uuid": "0194fdc2-fa2f-4cc0-81d3-ff12045b73c8",
-              "kernel_opts": "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75,modprobe.blacklist=vc4",
+              "kernel_opts": "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75,modprobe.blacklist=vc4,rw",
               "uefi": {
                 "vendor": "redhat",
                 "install": true,
diff --git a/test/data/manifests/rhel_90-aarch64-image_installer-boot.json b/test/data/manifests/rhel_90-aarch64-image_installer-boot.json
index 5a686c338..cecca38c2 100644
--- a/test/data/manifests/rhel_90-aarch64-image_installer-boot.json
+++ b/test/data/manifests/rhel_90-aarch64-image_installer-boot.json
@@ -3627,6 +3627,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-0-0-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=RHEL-9-0-0-BaseOS-aarch64:/osbuild.ks"
                 ]
               },
@@ -5205,6 +5206,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-0-0-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=RHEL-9-0-0-BaseOS-aarch64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/rhel_90-aarch64-image_installer_with_users-boot.json b/test/data/manifests/rhel_90-aarch64-image_installer_with_users-boot.json
index 24c105f6b..5436c24a0 100644
--- a/test/data/manifests/rhel_90-aarch64-image_installer_with_users-boot.json
+++ b/test/data/manifests/rhel_90-aarch64-image_installer_with_users-boot.json
@@ -3662,6 +3662,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-0-0-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=RHEL-9-0-0-BaseOS-aarch64:/osbuild.ks"
                 ]
               },
@@ -5300,6 +5301,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-0-0-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=RHEL-9-0-0-BaseOS-aarch64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/rhel_90-x86_64-edge_installer-boot.json b/test/data/manifests/rhel_90-x86_64-edge_installer-boot.json
index a22939ce7..3b5ddad0b 100644
--- a/test/data/manifests/rhel_90-x86_64-edge_installer-boot.json
+++ b/test/data/manifests/rhel_90-x86_64-edge_installer-boot.json
@@ -3711,6 +3711,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-0-0-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=RHEL-9-0-0-BaseOS-x86_64:/osbuild.ks"
                 ]
               },
@@ -3804,6 +3805,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-0-0-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=RHEL-9-0-0-BaseOS-x86_64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/rhel_90-x86_64-edge_installer_with_users-boot.json b/test/data/manifests/rhel_90-x86_64-edge_installer_with_users-boot.json
index 84dc6ea06..f2496307f 100644
--- a/test/data/manifests/rhel_90-x86_64-edge_installer_with_users-boot.json
+++ b/test/data/manifests/rhel_90-x86_64-edge_installer_with_users-boot.json
@@ -3740,6 +3740,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-0-0-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=RHEL-9-0-0-BaseOS-x86_64:/osbuild.ks"
                 ]
               },
@@ -3833,6 +3834,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-0-0-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=RHEL-9-0-0-BaseOS-x86_64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/rhel_90-x86_64-edge_raw_image-boot.json b/test/data/manifests/rhel_90-x86_64-edge_raw_image-boot.json
index 733feba94..d8bcaace9 100644
--- a/test/data/manifests/rhel_90-x86_64-edge_raw_image-boot.json
+++ b/test/data/manifests/rhel_90-x86_64-edge_raw_image-boot.json
@@ -884,7 +884,8 @@
               },
               "kernel_opts": [
                 "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
-                "modprobe.blacklist=vc4"
+                "modprobe.blacklist=vc4",
+                "rw"
               ]
             }
           },
@@ -915,7 +916,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -1041,7 +1042,7 @@
             "options": {
               "root_fs_uuid": "fb180daf-48a7-4ee0-b10d-394651850fd4",
               "boot_fs_uuid": "0194fdc2-fa2f-4cc0-81d3-ff12045b73c8",
-              "kernel_opts": "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75,modprobe.blacklist=vc4",
+              "kernel_opts": "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75,modprobe.blacklist=vc4,rw",
               "legacy": "i386-pc",
               "uefi": {
                 "vendor": "redhat",
diff --git a/test/data/manifests/rhel_90-x86_64-edge_simplified_installer-boot.json b/test/data/manifests/rhel_90-x86_64-edge_simplified_installer-boot.json
index 70828f36e..dae48d840 100644
--- a/test/data/manifests/rhel_90-x86_64-edge_simplified_installer-boot.json
+++ b/test/data/manifests/rhel_90-x86_64-edge_simplified_installer-boot.json
@@ -1006,7 +1006,8 @@
               },
               "kernel_opts": [
                 "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
-                "modprobe.blacklist=vc4"
+                "modprobe.blacklist=vc4",
+                "rw"
               ]
             }
           },
@@ -1037,7 +1038,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -1163,7 +1164,7 @@
             "options": {
               "root_fs_uuid": "fb180daf-48a7-4ee0-b10d-394651850fd4",
               "boot_fs_uuid": "0194fdc2-fa2f-4cc0-81d3-ff12045b73c8",
-              "kernel_opts": "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75,modprobe.blacklist=vc4",
+              "kernel_opts": "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75,modprobe.blacklist=vc4,rw",
               "uefi": {
                 "vendor": "redhat",
                 "install": true,
diff --git a/test/data/manifests/rhel_90-x86_64-image_installer-boot.json b/test/data/manifests/rhel_90-x86_64-image_installer-boot.json
index 5afb128c0..de44cc56f 100644
--- a/test/data/manifests/rhel_90-x86_64-image_installer-boot.json
+++ b/test/data/manifests/rhel_90-x86_64-image_installer-boot.json
@@ -3691,6 +3691,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-0-0-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=RHEL-9-0-0-BaseOS-x86_64:/osbuild.ks"
                 ]
               },
@@ -5296,6 +5297,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-0-0-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=RHEL-9-0-0-BaseOS-x86_64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/rhel_90-x86_64-image_installer_with_users-boot.json b/test/data/manifests/rhel_90-x86_64-image_installer_with_users-boot.json
index af825c419..857fc9b56 100644
--- a/test/data/manifests/rhel_90-x86_64-image_installer_with_users-boot.json
+++ b/test/data/manifests/rhel_90-x86_64-image_installer_with_users-boot.json
@@ -3726,6 +3726,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-0-0-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=RHEL-9-0-0-BaseOS-x86_64:/osbuild.ks"
                 ]
               },
@@ -5391,6 +5392,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-0-0-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=RHEL-9-0-0-BaseOS-x86_64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/rhel_91-aarch64-edge_installer-boot.json b/test/data/manifests/rhel_91-aarch64-edge_installer-boot.json
index f6bedaefd..b446d5567 100644
--- a/test/data/manifests/rhel_91-aarch64-edge_installer-boot.json
+++ b/test/data/manifests/rhel_91-aarch64-edge_installer-boot.json
@@ -9624,6 +9624,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-1-0-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=RHEL-9-1-0-BaseOS-aarch64:/osbuild.ks"
                 ]
               },
@@ -9717,6 +9718,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-1-0-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=RHEL-9-1-0-BaseOS-aarch64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/rhel_91-aarch64-edge_installer_with_users-boot.json b/test/data/manifests/rhel_91-aarch64-edge_installer_with_users-boot.json
index 906ad8bad..78393cdf0 100644
--- a/test/data/manifests/rhel_91-aarch64-edge_installer_with_users-boot.json
+++ b/test/data/manifests/rhel_91-aarch64-edge_installer_with_users-boot.json
@@ -9653,6 +9653,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-1-0-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=RHEL-9-1-0-BaseOS-aarch64:/osbuild.ks"
                 ]
               },
@@ -9746,6 +9747,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-1-0-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=RHEL-9-1-0-BaseOS-aarch64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/rhel_91-aarch64-edge_raw_image-boot.json b/test/data/manifests/rhel_91-aarch64-edge_raw_image-boot.json
index 90e6eb67e..253f995ef 100644
--- a/test/data/manifests/rhel_91-aarch64-edge_raw_image-boot.json
+++ b/test/data/manifests/rhel_91-aarch64-edge_raw_image-boot.json
@@ -2231,7 +2231,8 @@
               },
               "kernel_opts": [
                 "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
-                "modprobe.blacklist=vc4"
+                "modprobe.blacklist=vc4",
+                "rw"
               ]
             }
           },
@@ -2262,7 +2263,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -2388,7 +2389,7 @@
             "options": {
               "root_fs_uuid": "fb180daf-48a7-4ee0-b10d-394651850fd4",
               "boot_fs_uuid": "0194fdc2-fa2f-4cc0-81d3-ff12045b73c8",
-              "kernel_opts": "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75,modprobe.blacklist=vc4",
+              "kernel_opts": "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75,modprobe.blacklist=vc4,rw",
               "uefi": {
                 "vendor": "redhat",
                 "install": true,
diff --git a/test/data/manifests/rhel_91-aarch64-edge_simplified_installer-boot.json b/test/data/manifests/rhel_91-aarch64-edge_simplified_installer-boot.json
index f3000f74f..ff2ea3e2f 100644
--- a/test/data/manifests/rhel_91-aarch64-edge_simplified_installer-boot.json
+++ b/test/data/manifests/rhel_91-aarch64-edge_simplified_installer-boot.json
@@ -2615,7 +2615,8 @@
               },
               "kernel_opts": [
                 "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
-                "modprobe.blacklist=vc4"
+                "modprobe.blacklist=vc4",
+                "rw"
               ]
             }
           },
@@ -2646,7 +2647,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -2772,7 +2773,7 @@
             "options": {
               "root_fs_uuid": "fb180daf-48a7-4ee0-b10d-394651850fd4",
               "boot_fs_uuid": "0194fdc2-fa2f-4cc0-81d3-ff12045b73c8",
-              "kernel_opts": "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75,modprobe.blacklist=vc4",
+              "kernel_opts": "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75,modprobe.blacklist=vc4,rw",
               "uefi": {
                 "vendor": "redhat",
                 "install": true,
diff --git a/test/data/manifests/rhel_91-aarch64-image_installer-boot.json b/test/data/manifests/rhel_91-aarch64-image_installer-boot.json
index 68934d5f7..31cbb4591 100644
--- a/test/data/manifests/rhel_91-aarch64-image_installer-boot.json
+++ b/test/data/manifests/rhel_91-aarch64-image_installer-boot.json
@@ -9402,6 +9402,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-1-0-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=RHEL-9-1-0-BaseOS-aarch64:/osbuild.ks"
                 ]
               },
@@ -13401,6 +13402,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-1-0-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=RHEL-9-1-0-BaseOS-aarch64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/rhel_91-aarch64-image_installer_with_users-boot.json b/test/data/manifests/rhel_91-aarch64-image_installer_with_users-boot.json
index f8fa1395e..83d580a22 100644
--- a/test/data/manifests/rhel_91-aarch64-image_installer_with_users-boot.json
+++ b/test/data/manifests/rhel_91-aarch64-image_installer_with_users-boot.json
@@ -9437,6 +9437,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-1-0-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=RHEL-9-1-0-BaseOS-aarch64:/osbuild.ks"
                 ]
               },
@@ -13588,6 +13589,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-1-0-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=RHEL-9-1-0-BaseOS-aarch64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/rhel_91-x86_64-edge_installer-boot.json b/test/data/manifests/rhel_91-x86_64-edge_installer-boot.json
index 7e0fe33e9..03b727035 100644
--- a/test/data/manifests/rhel_91-x86_64-edge_installer-boot.json
+++ b/test/data/manifests/rhel_91-x86_64-edge_installer-boot.json
@@ -9769,6 +9769,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-1-0-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=RHEL-9-1-0-BaseOS-x86_64:/osbuild.ks"
                 ]
               },
@@ -9862,6 +9863,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-1-0-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=RHEL-9-1-0-BaseOS-x86_64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/rhel_91-x86_64-edge_installer_with_users-boot.json b/test/data/manifests/rhel_91-x86_64-edge_installer_with_users-boot.json
index 53545c5d6..8a16010b1 100644
--- a/test/data/manifests/rhel_91-x86_64-edge_installer_with_users-boot.json
+++ b/test/data/manifests/rhel_91-x86_64-edge_installer_with_users-boot.json
@@ -9798,6 +9798,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-1-0-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=RHEL-9-1-0-BaseOS-x86_64:/osbuild.ks"
                 ]
               },
@@ -9891,6 +9892,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-1-0-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=RHEL-9-1-0-BaseOS-x86_64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/rhel_91-x86_64-edge_raw_image-boot.json b/test/data/manifests/rhel_91-x86_64-edge_raw_image-boot.json
index fdda7d85d..6ed58d201 100644
--- a/test/data/manifests/rhel_91-x86_64-edge_raw_image-boot.json
+++ b/test/data/manifests/rhel_91-x86_64-edge_raw_image-boot.json
@@ -2351,7 +2351,8 @@
               },
               "kernel_opts": [
                 "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
-                "modprobe.blacklist=vc4"
+                "modprobe.blacklist=vc4",
+                "rw"
               ]
             }
           },
@@ -2382,7 +2383,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -2508,7 +2509,7 @@
             "options": {
               "root_fs_uuid": "fb180daf-48a7-4ee0-b10d-394651850fd4",
               "boot_fs_uuid": "0194fdc2-fa2f-4cc0-81d3-ff12045b73c8",
-              "kernel_opts": "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75,modprobe.blacklist=vc4",
+              "kernel_opts": "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75,modprobe.blacklist=vc4,rw",
               "legacy": "i386-pc",
               "uefi": {
                 "vendor": "redhat",
diff --git a/test/data/manifests/rhel_91-x86_64-edge_simplified_installer-boot.json b/test/data/manifests/rhel_91-x86_64-edge_simplified_installer-boot.json
index 4645facc7..8fd3ccd75 100644
--- a/test/data/manifests/rhel_91-x86_64-edge_simplified_installer-boot.json
+++ b/test/data/manifests/rhel_91-x86_64-edge_simplified_installer-boot.json
@@ -2663,7 +2663,8 @@
               },
               "kernel_opts": [
                 "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
-                "modprobe.blacklist=vc4"
+                "modprobe.blacklist=vc4",
+                "rw"
               ]
             }
           },
@@ -2694,7 +2695,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -2820,7 +2821,7 @@
             "options": {
               "root_fs_uuid": "fb180daf-48a7-4ee0-b10d-394651850fd4",
               "boot_fs_uuid": "0194fdc2-fa2f-4cc0-81d3-ff12045b73c8",
-              "kernel_opts": "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75,modprobe.blacklist=vc4",
+              "kernel_opts": "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75,modprobe.blacklist=vc4,rw",
               "uefi": {
                 "vendor": "redhat",
                 "install": true,
diff --git a/test/data/manifests/rhel_91-x86_64-image_installer-boot.json b/test/data/manifests/rhel_91-x86_64-image_installer-boot.json
index fed5b3a30..4ca462ab9 100644
--- a/test/data/manifests/rhel_91-x86_64-image_installer-boot.json
+++ b/test/data/manifests/rhel_91-x86_64-image_installer-boot.json
@@ -9547,6 +9547,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-1-0-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=RHEL-9-1-0-BaseOS-x86_64:/osbuild.ks"
                 ]
               },
@@ -13602,6 +13603,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-1-0-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=RHEL-9-1-0-BaseOS-x86_64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/rhel_91-x86_64-image_installer_with_users-boot.json b/test/data/manifests/rhel_91-x86_64-image_installer_with_users-boot.json
index 58fcd3e1b..f3161ffa9 100644
--- a/test/data/manifests/rhel_91-x86_64-image_installer_with_users-boot.json
+++ b/test/data/manifests/rhel_91-x86_64-image_installer_with_users-boot.json
@@ -9582,6 +9582,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-1-0-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=RHEL-9-1-0-BaseOS-x86_64:/osbuild.ks"
                 ]
               },
@@ -13789,6 +13790,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-1-0-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=RHEL-9-1-0-BaseOS-x86_64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/rhel_92-aarch64-edge_installer-boot.json b/test/data/manifests/rhel_92-aarch64-edge_installer-boot.json
index e288834b6..fa38ebc41 100644
--- a/test/data/manifests/rhel_92-aarch64-edge_installer-boot.json
+++ b/test/data/manifests/rhel_92-aarch64-edge_installer-boot.json
@@ -9640,6 +9640,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-2-0-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=RHEL-9-2-0-BaseOS-aarch64:/osbuild.ks"
                 ]
               },
@@ -9733,6 +9734,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-2-0-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=RHEL-9-2-0-BaseOS-aarch64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/rhel_92-aarch64-edge_installer_with_users-boot.json b/test/data/manifests/rhel_92-aarch64-edge_installer_with_users-boot.json
index 67b39a6e9..ab3c99b84 100644
--- a/test/data/manifests/rhel_92-aarch64-edge_installer_with_users-boot.json
+++ b/test/data/manifests/rhel_92-aarch64-edge_installer_with_users-boot.json
@@ -9669,6 +9669,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-2-0-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=RHEL-9-2-0-BaseOS-aarch64:/osbuild.ks"
                 ]
               },
@@ -9762,6 +9763,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-2-0-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=RHEL-9-2-0-BaseOS-aarch64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/rhel_92-aarch64-edge_raw_image-boot.json b/test/data/manifests/rhel_92-aarch64-edge_raw_image-boot.json
index 295d622b8..5c1c573f9 100644
--- a/test/data/manifests/rhel_92-aarch64-edge_raw_image-boot.json
+++ b/test/data/manifests/rhel_92-aarch64-edge_raw_image-boot.json
@@ -2231,7 +2231,8 @@
               },
               "kernel_opts": [
                 "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
-                "modprobe.blacklist=vc4"
+                "modprobe.blacklist=vc4",
+                "rw"
               ]
             }
           },
@@ -2262,7 +2263,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -2388,7 +2389,7 @@
             "options": {
               "root_fs_uuid": "fb180daf-48a7-4ee0-b10d-394651850fd4",
               "boot_fs_uuid": "0194fdc2-fa2f-4cc0-81d3-ff12045b73c8",
-              "kernel_opts": "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75,modprobe.blacklist=vc4",
+              "kernel_opts": "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75,modprobe.blacklist=vc4,rw",
               "uefi": {
                 "vendor": "redhat",
                 "install": true,
diff --git a/test/data/manifests/rhel_92-aarch64-edge_simplified_installer-boot.json b/test/data/manifests/rhel_92-aarch64-edge_simplified_installer-boot.json
index 9f77a4677..d018a868b 100644
--- a/test/data/manifests/rhel_92-aarch64-edge_simplified_installer-boot.json
+++ b/test/data/manifests/rhel_92-aarch64-edge_simplified_installer-boot.json
@@ -2615,7 +2615,8 @@
               },
               "kernel_opts": [
                 "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
-                "modprobe.blacklist=vc4"
+                "modprobe.blacklist=vc4",
+                "rw"
               ]
             }
           },
@@ -2646,7 +2647,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -2772,7 +2773,7 @@
             "options": {
               "root_fs_uuid": "fb180daf-48a7-4ee0-b10d-394651850fd4",
               "boot_fs_uuid": "0194fdc2-fa2f-4cc0-81d3-ff12045b73c8",
-              "kernel_opts": "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75,modprobe.blacklist=vc4",
+              "kernel_opts": "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75,modprobe.blacklist=vc4,rw",
               "uefi": {
                 "vendor": "redhat",
                 "install": true,
diff --git a/test/data/manifests/rhel_92-aarch64-image_installer-boot.json b/test/data/manifests/rhel_92-aarch64-image_installer-boot.json
index 60f0128ac..c346272b8 100644
--- a/test/data/manifests/rhel_92-aarch64-image_installer-boot.json
+++ b/test/data/manifests/rhel_92-aarch64-image_installer-boot.json
@@ -9418,6 +9418,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-2-0-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=RHEL-9-2-0-BaseOS-aarch64:/osbuild.ks"
                 ]
               },
@@ -13425,6 +13426,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-2-0-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=RHEL-9-2-0-BaseOS-aarch64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/rhel_92-aarch64-image_installer_with_users-boot.json b/test/data/manifests/rhel_92-aarch64-image_installer_with_users-boot.json
index 54c0ad150..eff42dc68 100644
--- a/test/data/manifests/rhel_92-aarch64-image_installer_with_users-boot.json
+++ b/test/data/manifests/rhel_92-aarch64-image_installer_with_users-boot.json
@@ -9453,6 +9453,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-2-0-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=RHEL-9-2-0-BaseOS-aarch64:/osbuild.ks"
                 ]
               },
@@ -13612,6 +13613,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-2-0-BaseOS-aarch64",
                   "inst.ks=hd:LABEL=RHEL-9-2-0-BaseOS-aarch64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/rhel_92-x86_64-edge_installer-boot.json b/test/data/manifests/rhel_92-x86_64-edge_installer-boot.json
index d431160c0..c17fa7e5c 100644
--- a/test/data/manifests/rhel_92-x86_64-edge_installer-boot.json
+++ b/test/data/manifests/rhel_92-x86_64-edge_installer-boot.json
@@ -9785,6 +9785,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-2-0-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=RHEL-9-2-0-BaseOS-x86_64:/osbuild.ks"
                 ]
               },
@@ -9878,6 +9879,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-2-0-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=RHEL-9-2-0-BaseOS-x86_64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/rhel_92-x86_64-edge_installer_with_users-boot.json b/test/data/manifests/rhel_92-x86_64-edge_installer_with_users-boot.json
index f78b9d895..3de71b8c6 100644
--- a/test/data/manifests/rhel_92-x86_64-edge_installer_with_users-boot.json
+++ b/test/data/manifests/rhel_92-x86_64-edge_installer_with_users-boot.json
@@ -9814,6 +9814,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-2-0-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=RHEL-9-2-0-BaseOS-x86_64:/osbuild.ks"
                 ]
               },
@@ -9907,6 +9908,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-2-0-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=RHEL-9-2-0-BaseOS-x86_64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/rhel_92-x86_64-edge_raw_image-boot.json b/test/data/manifests/rhel_92-x86_64-edge_raw_image-boot.json
index d32d0de2f..7ff318fed 100644
--- a/test/data/manifests/rhel_92-x86_64-edge_raw_image-boot.json
+++ b/test/data/manifests/rhel_92-x86_64-edge_raw_image-boot.json
@@ -2351,7 +2351,8 @@
               },
               "kernel_opts": [
                 "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
-                "modprobe.blacklist=vc4"
+                "modprobe.blacklist=vc4",
+                "rw"
               ]
             }
           },
@@ -2382,7 +2383,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -2508,7 +2509,7 @@
             "options": {
               "root_fs_uuid": "fb180daf-48a7-4ee0-b10d-394651850fd4",
               "boot_fs_uuid": "0194fdc2-fa2f-4cc0-81d3-ff12045b73c8",
-              "kernel_opts": "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75,modprobe.blacklist=vc4",
+              "kernel_opts": "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75,modprobe.blacklist=vc4,rw",
               "legacy": "i386-pc",
               "uefi": {
                 "vendor": "redhat",
diff --git a/test/data/manifests/rhel_92-x86_64-edge_simplified_installer-boot.json b/test/data/manifests/rhel_92-x86_64-edge_simplified_installer-boot.json
index ab56ec959..3eba7ff1e 100644
--- a/test/data/manifests/rhel_92-x86_64-edge_simplified_installer-boot.json
+++ b/test/data/manifests/rhel_92-x86_64-edge_simplified_installer-boot.json
@@ -2663,7 +2663,8 @@
               },
               "kernel_opts": [
                 "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
-                "modprobe.blacklist=vc4"
+                "modprobe.blacklist=vc4",
+                "rw"
               ]
             }
           },
@@ -2694,7 +2695,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": false,
+                  "readonly": true,
                   "bootloader": "none"
                 }
               }
@@ -2820,7 +2821,7 @@
             "options": {
               "root_fs_uuid": "fb180daf-48a7-4ee0-b10d-394651850fd4",
               "boot_fs_uuid": "0194fdc2-fa2f-4cc0-81d3-ff12045b73c8",
-              "kernel_opts": "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75,modprobe.blacklist=vc4",
+              "kernel_opts": "luks.uuid=6e4ff95f-f662-45ee-a82a-bdf44a2d0b75,modprobe.blacklist=vc4,rw",
               "uefi": {
                 "vendor": "redhat",
                 "install": true,
diff --git a/test/data/manifests/rhel_92-x86_64-image_installer-boot.json b/test/data/manifests/rhel_92-x86_64-image_installer-boot.json
index a03026b72..4b0363aca 100644
--- a/test/data/manifests/rhel_92-x86_64-image_installer-boot.json
+++ b/test/data/manifests/rhel_92-x86_64-image_installer-boot.json
@@ -9563,6 +9563,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-2-0-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=RHEL-9-2-0-BaseOS-x86_64:/osbuild.ks"
                 ]
               },
@@ -13626,6 +13627,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-2-0-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=RHEL-9-2-0-BaseOS-x86_64:/osbuild.ks"
                 ]
               }
diff --git a/test/data/manifests/rhel_92-x86_64-image_installer_with_users-boot.json b/test/data/manifests/rhel_92-x86_64-image_installer_with_users-boot.json
index b93f386a0..ed7f9a307 100644
--- a/test/data/manifests/rhel_92-x86_64-image_installer_with_users-boot.json
+++ b/test/data/manifests/rhel_92-x86_64-image_installer_with_users-boot.json
@@ -9598,6 +9598,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-2-0-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=RHEL-9-2-0-BaseOS-x86_64:/osbuild.ks"
                 ]
               },
@@ -13813,6 +13814,7 @@
               "kernel": {
                 "dir": "/images/pxeboot",
                 "opts": [
+                  "inst.stage2=hd:LABEL=RHEL-9-2-0-BaseOS-x86_64",
                   "inst.ks=hd:LABEL=RHEL-9-2-0-BaseOS-x86_64:/osbuild.ks"
                 ]
               }