diff --git a/build-local.sh b/build-local.sh
index 942476a..ebaac0a 100755
--- a/build-local.sh
+++ b/build-local.sh
@@ -49,7 +49,7 @@ grep airootfs_image_tool_options "$STAGE/profiledef.sh"
 # created from skel (the live user and the installed user) then gets the same
 # versions `bakery list` reports here, fully offline. Copied at build time so the
 # binaries never bloat the git repo and always track the current bakery state.
-BREAD_BINS=(bakery bread breadd breadman breadbar breadbox breadbox-sync breadcrumbs breadpad breadpaper bread-theme breadmon breadsearch breadmill breadclip breadclipd breadshot)
+BREAD_BINS=(bakery bread breadd breadman breadbar breadbox breadbox-sync breadcrumbs breadpad breadpaper bread-theme breadmon breadsearch breadmill breadclip breadclipd breadshot bos-settings breadhelp)
 LAPTOP_HOME="${LAPTOP_HOME:-$(getent passwd "${SUDO_USER:-$USER}" | cut -d: -f6)}"
 BAKERY_BIN="$LAPTOP_HOME/.local/bin"
 BAKERY_STATE="$LAPTOP_HOME/.local/state/bakery"
diff --git a/iso/airootfs/etc/calamares/post-install.sh b/iso/airootfs/etc/calamares/post-install.sh
index 7899e67..c2e059f 100644
--- a/iso/airootfs/etc/calamares/post-install.sh
+++ b/iso/airootfs/etc/calamares/post-install.sh
@@ -371,12 +371,12 @@ if command -v ufw &>/dev/null; then
     ufw --force enable         || echo "WARN: ufw enable failed"
 fi
 
-# The bread ecosystem (bakery + bread, breadbar, breadbox, breadcrumbs, breadpad)
-# is bakery-managed, not pacman: the binaries and bakery manifest live in
-# /etc/skel/.local (baked in at ISO build time) and are copied into the user's
-# home below, so the install works fully offline with no DNS for bakery/GitHub.
-# bos-settings and breadhelp are the only pacman bread packages and were
-# installed by unpackfs.
+# The whole bread ecosystem (bakery, bread, breadbar, breadbox, breadcrumbs,
+# breadpad, bos-settings, breadhelp, ...) is bakery-managed, not pacman: the
+# binaries and bakery manifest live in /etc/skel/.local (baked in at ISO
+# build time via build-local.sh's BREAD_BINS array) and are copied into the
+# user's home below, so the install works fully offline with no DNS for
+# bakery/GitHub.
 
 # ---------------------------------------------------------------------------
 # Deploy dotfiles + the bakery bread ecosystem into the user's home (Calamares
diff --git a/iso/airootfs/etc/skel/.local/share/applications/bos-settings.desktop b/iso/airootfs/etc/skel/.local/share/applications/bos-settings.desktop
new file mode 100644
index 0000000..5385adb
--- /dev/null
+++ b/iso/airootfs/etc/skel/.local/share/applications/bos-settings.desktop
@@ -0,0 +1,9 @@
+[Desktop Entry]
+Name=BOS Settings
+Comment=System settings for Bread OS
+Exec=bos-settings
+Icon=preferences-system
+Terminal=false
+Type=Application
+Categories=Settings;System;
+StartupWMClass=bos-settings
diff --git a/iso/airootfs/etc/skel/.local/share/applications/breadhelp.desktop b/iso/airootfs/etc/skel/.local/share/applications/breadhelp.desktop
new file mode 100644
index 0000000..c41be36
--- /dev/null
+++ b/iso/airootfs/etc/skel/.local/share/applications/breadhelp.desktop
@@ -0,0 +1,9 @@
+[Desktop Entry]
+Name=BOS Help
+Comment=Your personal guide to the Bread desktop
+Exec=breadhelp
+Icon=help-browser
+Terminal=false
+Type=Application
+Categories=Help;System;
+StartupWMClass=com.breadway.breadhelp
diff --git a/iso/packages.x86_64 b/iso/packages.x86_64
index 38b4488..c8cbb57 100644
--- a/iso/packages.x86_64
+++ b/iso/packages.x86_64
@@ -104,6 +104,7 @@ gtk4
 gtk4-layer-shell
 librsvg
 libpulse
+hicolor-icon-theme
 # GTK3 dark theme (Adwaita-dark); without this package the gtk-theme-name in
 # skel settings.ini silently falls back to the light theme for GTK3 apps.
 gnome-themes-extra
@@ -178,19 +179,19 @@ yay-bin
 
 # Bread ecosystem.
 #
-# The bread apps themselves (bakery, bread, breadbar, breadbox, breadcrumbs,
-# breadpad) are NOT pacman packages here — they are bakery-managed binaries
-# baked into /etc/skel/.local/bin at build time (see build-local.sh), so every
-# user gets the exact versions from this laptop's bakery install with no
-# network/DNS needed at install or runtime. Their runtime system deps are pulled
-# in elsewhere in this list (gtk4, gtk4-layer-shell, iw, libpulse, librsvg,
-# networkmanager, openssl, zlib, systemd-libs) — keep those even though no bread
-# package depends on them.
-#
-# bos-settings and breadhelp are BOS-specific pacman packages (not part of the
-# bakery index), so they stay here, served from the [breadway] repo.
-bos-settings
-breadhelp
+# None of the bread apps (bakery, bread, breadbar, breadbox, breadcrumbs,
+# breadpad, bos-settings, breadhelp, ...) are pacman packages here anymore —
+# they are all bakery-managed binaries baked into /etc/skel/.local/bin at
+# build time (see build-local.sh's BREAD_BINS array), so every user gets the
+# exact versions from this laptop's bakery install with no network/DNS
+# needed at install or runtime. bos-settings/breadhelp's desktop entries are
+# hand-committed static files at
+# iso/airootfs/etc/skel/.local/share/applications/, matching the pattern
+# already used for breadclip/breadman/breadmon/breadsearch. Their runtime
+# system deps are pulled in elsewhere in this list (gtk4, gtk4-layer-shell,
+# iw, libpulse, librsvg, networkmanager, openssl, zlib, systemd-libs,
+# hicolor-icon-theme) — keep those even though no bread package depends on
+# them via pacman.
 
 # Input / screen utilities
 brightnessctl
diff --git a/packaging/arch/README.md b/packaging/arch/README.md
index ccdd544..4c3df28 100644
--- a/packaging/arch/README.md
+++ b/packaging/arch/README.md
@@ -1,39 +1,18 @@
 Arch packaging
 ==============
 
-`breadhelp/PKGBUILD` builds and installs `breadhelp` from source — BOS's
-onboarding + help center, and the only first-party pacman package still built
-from this repo.
+This directory only holds `PKGBUILD`s for third-party AUR packages BOS
+republishes to the `[breadway]` pacman repo (`calamares`, `bibata`,
+`powerlevel10k`, `yay-bin`) — not the user's own code. See each
+subdirectory's `.forgejo/workflows/<name>.yml` (in this repo) for how each
+one publishes on a push to `packaging/<name>/**`.
 
-`bos-settings` is also pacman-packaged and served from the same [breadway]
-repo, but its source lives in its own repo now (`~/Projects/bos-settings`,
-`git.breadway.dev/Breadway/bos-settings`) so a bos-settings release doesn't require
-a BOS ISO release.
-
-Everything else the bread ecosystem ships (breadbar, breadbox, breadpad, ...)
-is bakery-managed, not pacman-packaged — see `build-local.sh`.
-
-## Local build
-
-```bash
-cd breadhelp && makepkg -si
-```
-
-## Before publishing to [breadway] repo
-
-CI (`.forgejo/workflows/package.yml`) handles this on tag push (`vX.Y.Z`): it
-bumps `pkgver`, archives the repo into the expected tarball name, and runs
-`makepkg`. To do it by hand instead:
-
-1. Tag a release on GitHub (`vX.Y.Z`).
-2. Update `pkgver` in `breadhelp/PKGBUILD` to match the tag.
-3. Update `source` to the release tarball URL.
-4. Run `updpkgsums` (or manually set `sha256sums`).
-
-## Runtime dependencies
-
-| Package | Required | Notes |
-|---------|----------|-------|
-| `gtk4` | yes | UI toolkit |
-| `glib2` | yes | always |
-| `snapper` | optional | create-backup one-click fix |
+Every bread-ecosystem app (bakery, bread, breadbar, breadbox, breadcrumbs,
+breadpad, breadpaper, breadmon, breadsearch, breadclip, breadshot,
+bos-settings, breadhelp, ...) is bakery-managed, not pacman-packaged — see
+`build-local.sh`'s `BREAD_BINS` array, which bakes this laptop's
+bakery-installed binaries into the ISO's `/etc/skel` at build time.
+`breadlock` is the sole deliberate exception (it needs a root-owned
+`/etc/pam.d/breadlock` PAM service file, which bakery — by design — has no
+privileged-install path for) and stays on pacman only; see
+`bread-ecosystem/docs/release-channels.md` for the full policy.