diff --git a/diskless.pkr.hcl b/diskless.pkr.hcl
index 6edd4fa..e82712d 100644
--- a/diskless.pkr.hcl
+++ b/diskless.pkr.hcl
@@ -417,16 +417,23 @@ build {
       # plymouth's `drm` dep instmods a broad DRM set (i915/amdgpu/radeon/…) and
       # dracut bundles each module's firmware into the initramfs (amdgpu fw is the
       # classic UKI bloater), so trimming FIRST shrinks BOTH the rootfs erofs AND
-      # the UKI's initramfs. Keep i915 (all Intel gens) + intel/ (ice DDP for the
-      # ice/mlx5 server-NIC build variant + small Intel blobs) + mellanox +
-      # intel-ucode; strip the rest (~600 MB). Safe for the initramfs: the fleet
+      # the UKI's initramfs. Keep i915 (all Intel gens — the fleet's only
+      # firmware-loading GPU) + intel/ice (the ice server-NIC DDP, the SOLE intel/
+      # blob any host needs — ish/sof/ibt are sensor-hub/audio/bluetooth, none
+      # loaded at boot) + intel-ucode; strip the rest (~600 MB). NOT mellanox/ —
+      # those are mlxsw_spectrum SWITCH-ASIC blobs, not NIC firmware (mlx5 NIC fw is
+      # on-card, never request_firmware'd from /usr/lib/firmware), so they're dead
+      # weight even for an mlx5 build. Safe for the initramfs: the fleet
       # splash GPU (i915) fw is kept and the build-VM splash uses virtio-gpu/bochs
       # (no fw) — dracut just warns "firmware not found" for the removed drm modules
       # and continues. Risk asymmetry: missing NIC fw would brick the fleet (none
       # needed), missing GPU fw only degrades a display. BENCH-VERIFY the kiosk
       # renders on the 820. Strip-in-place (rm, not rpm -e): linux-firmware can't be
       # dropped as a package without also losing i915. See docs/TODO #18.
-      "if [ -d /usr/lib/firmware ]; then find /usr/lib/firmware -mindepth 1 -maxdepth 1 ! -name i915 ! -name intel ! -name mellanox ! -name intel-ucode -exec rm -rf {} + ; fi",
+      "if [ -d /usr/lib/firmware ]; then find /usr/lib/firmware -mindepth 1 -maxdepth 1 ! -name i915 ! -name intel ! -name intel-ucode -exec rm -rf {} + ; fi",
+      # Narrow intel/ to just ice (NIC DDP); drop ish (sensor hub), sof (audio DSP),
+      # ibt (bluetooth) etc. — none are loaded on this fleet (audit 2026-07-03).
+      "[ -d /usr/lib/firmware/intel ] && find /usr/lib/firmware/intel -mindepth 1 -maxdepth 1 ! -name ice -exec rm -rf {} + || true",
       # Wi-Fi firmware: wired-only fleet (no iwlwifi). Remove the packages cleanly
       # so the rpmdb stays honest (the find above dropped their iwlwifi-*.ucode).
       "dnf remove -y 'iwl*-firmware' 2>/dev/null || true",
@@ -449,6 +456,10 @@ build {
       # before dracut. See docs/TODO #18.
       "echo \"==> initramfs size: $(du -h /boot/initramfs-generic.img | cut -f1)\"",
       "echo '==> firmware bundled in initramfs (expect i915 only):'; grep -i '/firmware/' /tmp/lsinitrd.txt || echo '  (none)'",
+      # Largest files IN the initramfs (in-cpio size, before the outer zstd) — after
+      # the firmware strip the .img is module-bound (the --no-hostonly DRM/net/crypto
+      # set), so this surfaces the next trim targets (e.g. GPU driver kmods). See #18.
+      "echo '==> initramfs largest files:'; awk '/^-/{print $5, $NF}' /tmp/lsinitrd.txt | sort -rn | head -25",
       "grep -E 'macsec|wpa_supplicant|tpm2_nvread|nvme.tcp|erofs|veritysetup' /tmp/lsinitrd.txt",
       # Assert NetworkManager is in the initramfs — the network-manager dracut
       # module is what renews the DHCP lease post-switch-root. A missing/renamed
diff --git a/docs/TODO.md b/docs/TODO.md
index c9b0e1f..328db7a 100644
--- a/docs/TODO.md
+++ b/docs/TODO.md
@@ -1504,11 +1504,31 @@ load — the one real risk); (b) if any host has a non-Intel GPU or an `ice`/`ml
 widen the keep-list before trusting fleet-wide. Audited models so far: HP-820-class
 (i915 + e1000e + iwlwifi-dropped) and virtio VMs.
 
+**Build-verified 2026-07-03:** firmware **678 MB → 147 MB**; the initramfs diagnostic
+confirms only the keep-list is bundled (i915 all-gens + intel/ice + intel/ish + mellanox)
+— proving the pre-dracut ordering works. But the initramfs came out **97 MB**, and it's
+now **kernel-MODULE-bound, not firmware** (~10 MB fw): the `--no-hostonly` + plymouth
+`drm` set pulls every GPU driver (`amdgpu.ko` etc.) even though the fleet is i915-only.
+
+**[x] DONE — follow-on trims (2026-07-03):**
+- **`omit_drivers+=" amdgpu radeon nouveau "`** in `90-diskless.conf` — drops the
+  discrete-GPU kmods plymouth's `drm` dep would instmod (amdgpu.ko is the biggest single
+  module); keeps i915 + virtio-gpu/bochs for the splash. Targets the 97 MB initramfs/UKI.
+- **Firmware keep-list tightened**: dropped `mellanox/` (those are `mlxsw_spectrum`
+  SWITCH-ASIC blobs, NOT NIC fw — mlx5 NIC fw is on-card) and narrowed `intel/` to just
+  `ice` (dropped ish/sof/ibt = sensor-hub/audio/bluetooth, none loaded at boot).
+- **Initramfs top-25-files diagnostic** added after the dracut build (sorts `lsinitrd.txt`
+  by size) so the next build shows what dominates the `.img` — measure before the next cut.
+- **BENCH-VERIFY:** kiosk still renders on the 820 (i915 kept); check the new
+  "initramfs largest files" log line for the post-omit size + next targets.
+
 **Combined:** ~**800 MB** off the uncompressed erofs (langpacks + firmware), dwarfing the
-kiosk weak-deps trim (#4). NEXT candidates from the manifest (measure, don't guess):
-`iso-codes` (19 MB), `samba-client-libs`/`intel-mediasdk`/`gstreamer` (chromium-common
-HARD deps — only removable by dropping HTML5 media), `binutils` (25 MB, build-only?),
-`cracklib-dicts` (9.8 MB, needed for pam pwquality — keep).
+kiosk weak-deps trim (#4), plus a smaller UKI/initramfs from the DRM-driver omit. NEXT
+candidates from the manifest (measure, don't guess): `iso-codes` (19 MB),
+`samba-client-libs`/`intel-mediasdk`/`gstreamer` (chromium-common HARD deps — only
+removable by dropping HTML5 media, and samba/rabbitmq/rist/srt/zmq are libavformat
+DT_NEEDED so they can't go without breaking future media — confirmed via ldd 2026-07-03),
+`binutils` (25 MB, build-only?), `cracklib-dicts` (9.8 MB, needed for pam pwquality — keep).
 
 **Stack note:** committed on `trim-rpm`. When `optimise-ram` rebases onto the new
 `trim-rpm`, expect a trivial `docs/TODO.md` tail conflict (both branches appended after
diff --git a/files/etc/dracut.conf.d/90-diskless.conf b/files/etc/dracut.conf.d/90-diskless.conf
index a58470e..49184a3 100644
--- a/files/etc/dracut.conf.d/90-diskless.conf
+++ b/files/etc/dracut.conf.d/90-diskless.conf
@@ -25,5 +25,13 @@ add_dracutmodules+=" dot1x-macsec network-manager nvmf systemd-veritysetup "
 add_dracutmodules+=" plymouth "
 filesystems+=" erofs overlay "
 add_drivers+=" macsec nvme-tcp nvme-fabrics dm-verity @NIC_DRIVERS@ "
+# Omit the discrete-GPU DRM drivers plymouth's `drm` dep would otherwise instmod
+# in --no-hostonly mode. This fleet is Intel i915 ONLY (the build VM uses
+# virtio-gpu/bochs), so amdgpu/radeon/nouveau are dead weight — amdgpu.ko alone is
+# the single biggest module in the initramfs. i915 + virtio-gpu/bochs stay for the
+# splash. (Their FIRMWARE is already stripped pre-dracut in diskless.pkr.hcl; this
+# drops the MODULES too.) If a future host has a non-Intel GPU, remove it here.
+# See docs/TODO #18.
+omit_drivers+=" amdgpu radeon nouveau "
 install_items+=" /etc/dot1x/radius-ca.pem /etc/dot1x/wpa_supplicant-dot1x.conf "
 compress="zstd"