diff --git a/docs/TODO.md b/docs/TODO.md
index 4949054..817621f 100644
--- a/docs/TODO.md
+++ b/docs/TODO.md
@@ -64,3 +64,37 @@ Once the boot path is validated and item 1 lands, fold
 re-export a **v3** PDF (key change: `rootovl` → `systemd.volatile=overlay` in §3
 step 8 and §5). Retire/reset the errata afterward. Needs the design-doc source
 (not in this repo).
+
+## [ ] 4. Kiosk mode — autologin + fullscreen Chromium loading a URL
+
+Make the diskless workstation boot straight into a locked-down kiosk: a
+fullscreen Chromium showing a configured site (initial target: Reddit). All
+baked at **build time** into the root tree (immutable erofs/verity root; runtime
+is the tmpfs overlay), fleet-generic (no per-host state).
+
+- **Graphical stack (keep it minimal):** add a Packer provisioner installing a
+  lightweight kiosk compositor + browser. Preferred: `cage` (Wayland
+  single-app kiosk compositor) + Mesa (software GL fallback for VMs/no-GPU);
+  X11 + a minimal WM (matchbox/openbox) as the alternative. Chromium on Rocky 9
+  is in **EPEL** — enabling EPEL adds a repo/supply-chain surface (decision
+  below).
+- **Autologin + session:** dedicated unprivileged `kiosk` user; launch the
+  session via a `kiosk.service` running `cage -s -- chromium --kiosk …`
+  (or `greetd` + cage). Stage units/configs under `files/` like the other
+  provisioned config.
+- **Chromium flags:** `--kiosk --noerrdialogs --disable-infobars --incognito
+  --no-first-run --disable-session-crashed-bubble <URL>`. Writable profile/cache
+  land on the `systemd.volatile=overlay` tmpfs (RAM-backed, ephemeral) — fine,
+  but watch RAM sizing; pin `--user-data-dir`/`--disk-cache-dir` to a tmpfs path
+  if needed.
+- **Kiosk URL = Packer var** (e.g. `kiosk_url`, default the target site), baked
+  into the launch command; keep it host-generic (per-env via DNS if ever needed).
+- **Verify in boot test:** graphical session comes up on real/VM display,
+  Chromium fullscreen loads the URL over the booted network (works with the
+  current `rd.dot1x=0` test path / open network).
+- **Decisions:** Wayland(cage) vs X11; accept EPEL for Chromium (vs another
+  source); confirm the target URL.
+- **⚠ Conflict with item 2 (STIG):** passwordless autologin and a desktop
+  browser are STIG findings and enlarge the attack surface/image. Reconcile —
+  e.g. a tightly-constrained kiosk session + documented deviation — when
+  hardening lands.
diff --git a/scripts/build-oci.sh b/scripts/build-oci.sh
index 491d329..2b03442 100755
--- a/scripts/build-oci.sh
+++ b/scripts/build-oci.sh
@@ -41,11 +41,16 @@ if printf '%s' "$CMDLINE" | grep -q NVMET_TRADDR; then
 fi
 
 # --- 1+2. Build (and sign) the UKI -------------------------------------------
+# os-release stamped into the UKI's .osrel section (identifies the image to
+# bootctl / boot menus). ukify takes this as inline text; a value starting with
+# '@' is instead read from a file of that name (newline-separated KEY=VALUE).
+OSREL=$(printf 'NAME=FleetDiskless\nID=fleet-diskless\nVERSION_ID=%s\nPRETTY_NAME="Fleet Diskless %s"\n' "$VERSION" "$VERSION")
+
 UKIFY_ARGS=(build
     --linux   "$ART/vmlinuz"
     --initrd  "$ART/initramfs.img"
     --cmdline "$CMDLINE"
-    --os-release "@NAME=FleetDiskless@VERSION=${VERSION}@"
+    --os-release "$OSREL"
     --output  "$UKI")
 
 if [ -n "$SB_KEY" ] && [ -n "$SB_CERT" ]; then