diff --git a/diskless.pkr.hcl b/diskless.pkr.hcl
index 09eef9b..2fc7f86 100644
--- a/diskless.pkr.hcl
+++ b/diskless.pkr.hcl
@@ -275,7 +275,13 @@ build {
       "if [ -z \"$KIOSK_URL\" ]; then echo 'kiosk_url empty -> skipping kiosk install.'; exit 0; fi",
       "echo '==> Enabling EPEL + installing kiosk stack (weston, chromium, mesa)'",
       "dnf install -y epel-release",
-      "dnf install -y weston chromium mesa-dri-drivers mesa-libEGL mesa-libgbm dejavu-sans-fonts",
+      # tsflags=nodocs: the kickstart's --excludedocs only covers the anaconda
+      # install, not these provisioner transactions; without it chromium/mesa lay
+      # down man/doc into the read-only erofs. (mesa-dri-drivers + llvm-libs are
+      # the heaviest items here and are likely unnecessary given weston
+      # --use-pixman + chromium --disable-gpu — candidate to drop once the kiosk
+      # is display-verified; see TODO #4.)
+      "dnf install -y --setopt=tsflags=nodocs weston chromium mesa-dri-drivers mesa-libEGL mesa-libgbm dejavu-sans-fonts",
       # Unprivileged, passwordless kiosk user; video/input as a seat fallback.
       "id kiosk >/dev/null 2>&1 || useradd -m -G video,input kiosk",
       # Install the staged unit, weston config, and session wrapper.
@@ -357,6 +363,13 @@ build {
       "rm -rf /var/lib/dnf/repos/* /var/log/dnf.* /var/log/hawkey.log",
       "rm -rf /var/tmp/* /tmp/*",
       "truncate -s 0 /var/log/messages /var/log/secure 2>/dev/null || true",
+      # Docs/man/info: the kickstart used --excludedocs but the provisioner dnf
+      # installs (kiosk + admin) did not, so strip what they laid down.
+      "rm -rf /usr/share/doc/* /usr/share/man/* /usr/share/info/*",
+      # Chromium ships ~50 locale .pak files; a single-locale kiosk needs one.
+      "if [ -d /usr/lib64/chromium-browser/locales ]; then find /usr/lib64/chromium-browser/locales -type f -name '*.pak' ! -name 'en-US.pak' -delete; fi",
+      # App translation catalogs (.mo) for locales this fleet never uses.
+      "[ -d /usr/share/locale ] && find /usr/share/locale -mindepth 1 -maxdepth 1 -type d ! -name 'en*' ! -name 'C*' -exec rm -rf {} + || true",
     ]
   }