diff --git a/diskless.pkr.hcl b/diskless.pkr.hcl
index e82712d..0854930 100644
--- a/diskless.pkr.hcl
+++ b/diskless.pkr.hcl
@@ -459,7 +459,12 @@ build {
       # Largest files IN the initramfs (in-cpio size, before the outer zstd) — after
       # the firmware strip the .img is module-bound (the --no-hostonly DRM/net/crypto
       # set), so this surfaces the next trim targets (e.g. GPU driver kmods). See #18.
-      "echo '==> initramfs largest files:'; awk '/^-/{print $5, $NF}' /tmp/lsinitrd.txt | sort -rn | head -25",
+      # Sort into a FILE then head the file — NOT `sort | head`: head closes the pipe
+      # after 25 lines, sort dies of SIGPIPE (exit 141), and step 2's
+      # `set -euxo pipefail` turns that into a build failure (same trap as the
+      # lsinitrd `| grep -q` note above). (The kiosk step's rpm-manifest `| head` is
+      # safe only because that step runs plain `set -e`, no pipefail.)
+      "echo '==> initramfs largest files:'; awk '/^-/{print $5, $NF}' /tmp/lsinitrd.txt | sort -rn > /tmp/initrd-sizes.txt; head -25 /tmp/initrd-sizes.txt; rm -f /tmp/initrd-sizes.txt",
       "grep -E 'macsec|wpa_supplicant|tpm2_nvread|nvme.tcp|erofs|veritysetup' /tmp/lsinitrd.txt",
       # Assert NetworkManager is in the initramfs — the network-manager dracut
       # module is what renews the DHCP lease post-switch-root. A missing/renamed