diff --git a/diskless.pkr.hcl b/diskless.pkr.hcl
index a7bf004..a6ca4f7 100644
--- a/diskless.pkr.hcl
+++ b/diskless.pkr.hcl
@@ -37,13 +37,13 @@ packer {
 
 variable "iso_url" {
   type        = string
-  description = "RHEL 9 / Rocky 9 / Alma 9 DVD ISO URL or local path"
-  default     = "https://download.rockylinux.org/pub/rocky/9/isos/x86_64/Rocky-9-latest-x86_64-dvd.iso"
+  description = "RHEL 9 / Rocky 9 / Alma 9 install ISO URL or local path. The minimal ISO is sufficient: ks.cfg installs only core+sshd from it and the provisioner pulls the diskless tooling from the online repos."
+  default     = "https://download.rockylinux.org/pub/rocky/9/isos/x86_64/Rocky-9-latest-x86_64-minimal.iso"
 }
 
 variable "iso_checksum" {
   type        = string
-  description = "ISO checksum, e.g. file:.../CHECKSUM or sha256:<hex>"
+  description = "ISO checksum. The CHECKSUM manifest covers every variant (minimal/dvd/boot); Packer matches the entry by iso_url's filename, so this stays the same when switching variants."
   default     = "file:https://download.rockylinux.org/pub/rocky/9/isos/x86_64/CHECKSUM"
 }
 
diff --git a/http/ks.cfg b/http/ks.cfg
index dfc4f02..cab41f3 100644
--- a/http/ks.cfg
+++ b/http/ks.cfg
@@ -22,14 +22,15 @@ bootloader --location=mbr
 reboot
 
 %packages --excludedocs
+# Install-time set kept to what the minimal ISO's BaseOS repo reliably carries
+# (core + sshd + chrony). The diskless tooling — wpa_supplicant, tpm2-tools,
+# tpm2-tss, nvme-cli, cryptsetup, dracut-network, openssl — is installed by the
+# Packer shell provisioner from the online repos *before* the initramfs is
+# built, so the build does not depend on those packages being bundled on
+# whichever ISO variant (minimal or dvd) is used here.
 @^minimal-environment
 kernel
-dracut-network
 openssh-server
-wpa_supplicant
-tpm2-tools
-nvme-cli
-cryptsetup
 chrony
 -plymouth
 -firewalld