diff --git a/diskless.pkr.hcl b/diskless.pkr.hcl
index d422378..5160bbe 100644
--- a/diskless.pkr.hcl
+++ b/diskless.pkr.hcl
@@ -173,7 +173,13 @@ build {
     inline = [
       "set -euxo pipefail",
 
-      "dnf -y install wpa_supplicant tpm2-tools tpm2-tss nvme-cli cryptsetup dracut-network openssl",
+      # dhcp-client provides dhclient, which the dracut 'network-legacy' module
+      # (and therefore the 95dot1x-macsec hook's ifup step) requires. RHEL9
+      # deprecated dhclient in favour of NetworkManager, so the minimal ISO
+      # omits it; without it network-legacy fails dracut's check() and the
+      # diskless module 'cannot be installed'. (Strategic path: port the hook to
+      # the 'network-manager' dracut module — see CLAUDE.md bench-verify notes.)
+      "dnf -y install wpa_supplicant tpm2-tools tpm2-tss nvme-cli cryptsetup dracut-network dhcp-client openssl",
 
       # Stage etc files into place
       "install -D -m0644 /tmp/etc-stage/dot1x/radius-ca.pem            /etc/dot1x/radius-ca.pem",