diff --git a/iso-profiles/antergos/live-overlay/etc/calamares/modules/basestrap.conf b/iso-profiles/antergos/live-overlay/etc/calamares/modules/basestrap.conf
index 495f11f..5db4dba 100644
--- a/iso-profiles/antergos/live-overlay/etc/calamares/modules/basestrap.conf
+++ b/iso-profiles/antergos/live-overlay/etc/calamares/modules/basestrap.conf
@@ -33,4 +33,17 @@ operations:
     - base
     - antergos-next-keyring
     - antergos-release
+    # Without this, GPU/wifi/etc. drivers can fail to initialize at all
+    # on first boot. This belongs in basestrap.conf rather than
+    # profile.yaml — profile.yaml only affects the live ISO session,
+    # never the installed target. basestrap is the step in Calamares'
+    # actual install sequence that's guaranteed to run for every
+    # install regardless of desktop choice (verified against the full
+    # 32-step sequence documented in docs/installer.md).
+    - linux-firmware
+    # users.conf sets every new user's default shell to zsh regardless
+    # of desktop choice, but zsh was never guaranteed to be installed —
+    # a real login lockout (pam_shells.so rejects the shell before the
+    # password is even checked). Same reasoning as linux-firmware above.
+    - zsh
 
diff --git a/iso-profiles/antergos/profile.yaml b/iso-profiles/antergos/profile.yaml
index 15aec12..c9b854c 100644
--- a/iso-profiles/antergos/profile.yaml
+++ b/iso-profiles/antergos/profile.yaml
@@ -61,6 +61,16 @@ rootfs:
     - kwin-zones
     - oh-my-posh-bin
     - pacseek
+    # Fixes a real lockout bug: users.conf sets every new user's shell to
+    # zsh regardless of which desktop they choose, but zsh was never
+    # actually guaranteed to be installed. This applies to every desktop
+    # choice, not just KDE, so it belongs here rather than in any one
+    # desktop's package block.
+    - zsh
+    # Without this, GPU/wifi/etc. drivers can fail to initialize at all
+    # on first boot — worse than anything a post-install tool can fix,
+    # since the person may not even get a usable display to fix it with.
+    - linux-firmware
   packages-init:
     dinit:
       - pipewire-dinit