diff --git a/diskless.pkr.hcl b/diskless.pkr.hcl
index 46d55ff..6edd4fa 100644
--- a/diskless.pkr.hcl
+++ b/diskless.pkr.hcl
@@ -941,6 +941,17 @@ build {
       # hard-needs it) and mask as a backstop against future weak-dep reinstalls.
       "dnf remove -y firewalld 2>/dev/null || true",
       "systemctl mask firewalld.service 2>/dev/null || true",
+      # nss-mdns: the mDNS/.local NSS resolver, and the ONLY reverse-dep of avahi
+      # (confirmed 2026-07-03: `rpm -e --test avahi` → "avahi is needed by nss-mdns",
+      # and avahi is absent from `ldd libavformat` so it's unrelated to Chromium's
+      # media stack — unlike samba/librabbitmq/librist/libsrt/libzmq, which ARE
+      # libavformat DT_NEEDED and must stay for future HTML5 media). This fleet
+      # resolves via DHCP/DNS (boot.fleet.lab), never .local, so mDNS is dead weight
+      # AND a network-listening service unwanted on a locked-down kiosk. Removing
+      # nss-mdns lets dnf's clean_requirements_on_remove reap avahi/avahi-glib/
+      # avahi-libs as orphans. (install_weak_deps=False may already drop nss-mdns if
+      # it's a Recommends; this is the belt-and-braces for the hard-dep case.)
+      "dnf remove -y nss-mdns 2>/dev/null || true",
       # (No Go toolchain to remove — fleet-hostapi + fleet-enrol are built OUT OF
       # the VM on the CI runner and file-provisioned in as static binaries.)
       # The build-time STIG reports must not ship inside the read-only rootfs.