diff --git a/diskless.pkr.hcl b/diskless.pkr.hcl
index 5160bbe..40ebac2 100644
--- a/diskless.pkr.hcl
+++ b/diskless.pkr.hcl
@@ -194,8 +194,9 @@ build {
       # ---- Diskless adaptations ------------------------------------------
       # Per-host machine-id is generated at boot into the overlay
       "truncate -s 0 /etc/machine-id",
-      # Read-only NFS root; runtime state on tmpfs/overlay (rootovl via the
-      # dracut 'overlayfs' module is pulled in by 90-diskless.conf)
+      # Read-only erofs/verity root; runtime state on a tmpfs overlay provided
+      # by systemd.volatile=overlay (set in the cmdline by extract-artifacts.sh).
+      # RHEL/Rocky dracut has no 'overlayfs'/'rootovl' module.
       "printf '%s\\n' '# diskless: root is provided by netroot; no local mounts' > /etc/fstab",
       # No local bootloader regeneration wanted on kernel updates inside CI
       "command -v grub2-mkconfig >/dev/null && echo 'GRUB updates not used on diskless hosts' || true",
diff --git a/files/etc/dracut.conf.d/90-diskless.conf b/files/etc/dracut.conf.d/90-diskless.conf
index e514fff..f1d23a5 100644
--- a/files/etc/dracut.conf.d/90-diskless.conf
+++ b/files/etc/dracut.conf.d/90-diskless.conf
@@ -5,8 +5,11 @@
 # because the build VM only has virtio devices.
 hostonly="no"
 # Module NAMES here omit the NN dir-prefix: the directory is 95dot1x-macsec but
-# the module is 'dot1x-macsec' (cf. nvmf, overlayfs below).
-add_dracutmodules+=" dot1x-macsec network-legacy nvmf systemd-veritysetup overlayfs "
+# the module is 'dot1x-macsec' (cf. nvmf). The writable root overlay is provided
+# by systemd.volatile=overlay on the kernel cmdline (RHEL/Rocky dracut has no
+# 'overlayfs'/'rootovl' module — that's a Debian/third-party feature); we only
+# need the overlay kernel filesystem, included via 'filesystems' below.
+add_dracutmodules+=" dot1x-macsec network-legacy nvmf systemd-veritysetup "
 filesystems+=" erofs overlay "
 add_drivers+=" macsec nvme-tcp nvme-fabrics dm-verity @NIC_DRIVERS@ "
 install_items+=" /etc/dot1x/radius-ca.pem /etc/dot1x/wpa_supplicant-dot1x.conf "
diff --git a/scripts/extract-artifacts.sh b/scripts/extract-artifacts.sh
index f09e412..f7288a8 100755
--- a/scripts/extract-artifacts.sh
+++ b/scripts/extract-artifacts.sh
@@ -81,7 +81,7 @@ if [ "$DISABLE_DOT1X" = "true" ]; then
 fi
 printf '%s' \
   "$DOT1X_FRAGMENT" \
-  "rd.neednet=1 rootovl " \
+  "rd.neednet=1 systemd.volatile=overlay " \
   "rd.dot1x.nvindex=0x01800001 rd.dot1x.timeout=60 " \
   "rd.nvmf.discover=tcp,NVMET_TRADDR,4420 " \
   "root=/dev/mapper/root rootfstype=erofs rootflags=ro " \