diff --git a/.gitignore b/.gitignore
index 80ec509..894c008 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,3 +4,4 @@ Brewfile.lock.json
 ipython/00-startup.py
 
 full_backup.log
+arch-mini.raw
diff --git a/bin/full_backup.sh b/bin/full_backup.sh
index 5ac0066..1adce83 100755
--- a/bin/full_backup.sh
+++ b/bin/full_backup.sh
@@ -10,6 +10,7 @@ if [[ -z "$1" ]]; then
   exit 1
 fi
 
-nohup rsync -aAXHv --rsync-path="sudo rsync" --numeric-ids / \
-  --exclude={"/var/*","/dev/*","/proc/*","/sys/*","/tmp/*","/run/*","/mnt/*","/lost+found"} \
-  "$1" 2>&1 | tee -a full_backup.log > /dev/null &
+nohup rsync -aAXHv --numeric-ids \
+  --exclude={"/dev/*","/proc/*","/sys/*","/tmp/*","/run/*","/mnt/*","/lost+found"} \
+  --exclude={"/var/cache/pacman/pkg/*","/var/tmp/*","/var/log/*"} \
+  / "$1" 2>&1 | tee -a full_backup.log > /dev/null &
diff --git a/cloud-init/arch/build-raw.sh b/cloud-init/arch/build-raw.sh
index a8ca5e1..f5db084 100755
--- a/cloud-init/arch/build-raw.sh
+++ b/cloud-init/arch/build-raw.sh
@@ -1,6 +1,6 @@
 #! /bin/bash
 
-INSTANCE_ID=${1:-"vm-arch-01"}
+INSTANCE_ID=${1:-"arch-recovery"}
 SSH_KEY="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMwt/pVQKCQHHqxEOdh1/JKqJzIyTPLQpqz/Wno0ECqG badger@catamaran"
 
 set -euxo pipefail
@@ -10,7 +10,7 @@ if [[ $EUID -ne 0 ]]; then
   exit 1
 fi
 
-for cmd in parted rsync killall readlink
+for cmd in parted rsync killall readlink mkfs.fat
 do
     if ! command -v $cmd >/dev/null 2>&1; then
       echo "Error: Command $cmd not installed.  Exiting." >&2
@@ -35,20 +35,23 @@ fi
 truncate -s ${SIZE_MB}M "$DISK"
 
 # BIOS-based boot
-parted -s "$DISK" mklabel msdos
-parted -s "$DISK" mkpart primary ext4 2MiB 100%
+parted -s "$DISK" mklabel gpt
+parted -s "$DISK" mkpart ESP fat32 2MiB 600MiB
 parted -s "$DISK" set 1 boot on
+parted -s "$DISK" mkpart primary ext4 602MiB 100%
 
 # Setup loop device
 LOOPDEV=$(losetup --show -fP "$DISK")  # Maps /dev/loopXp1
 sleep 1  # Allow time for partition probing
 
 # Format partition
-mkfs.ext4 "${LOOPDEV}p1"
+mkfs.fat -F32 -n ARCH_EFI "${LOOPDEV}p1"
+mkfs.ext4 -L ARCH_ROOT "${LOOPDEV}p2"
 
 # loopback the raw partition on mount point
-mkdir -p "$MNT"
-mount "${LOOPDEV}p1" "$MNT"
+mount "${LOOPDEV}p2" "$MNT"
+mkdir -p "$MNT/boot/efi"
+mount "${LOOPDEV}p1" "$MNT/boot/efi"
 
 # download and verify
 [[ -f archlinux-bootstrap-x86_64.tar.zst ]] || wget https://geo.mirror.pkgbuild.com/iso/latest/archlinux-bootstrap-x86_64.tar.zst
@@ -62,6 +65,7 @@ else
     exit 1
 fi
 
+[[ -d root.x86_64/ ]] && rm -r root.x86_64/
 tar --use-compress-program=unzstd -xvf archlinux-bootstrap-x86_64.tar.zst
 
 # update mirrors, not rerunnable
@@ -99,8 +103,6 @@ do echo "Mounting $i"
   mount --make-rslave "$MNT/$i"
 done
 
-# FIXME:
-# pacman -Sy efibootmgr cloud-init
 chroot "$MNT" /bin/bash -c "
     swapoff -a
     ln -sf /usr/share/zoneinfo/America/Denver /etc/localtime
@@ -111,12 +113,14 @@ chroot "$MNT" /bin/bash -c "
     echo LANG=en_US.UTF-8 > /etc/locale.conf
 
     # install base system
-    pacman -Sy --noconfirm base linux terminus-font linux-firmware openssh avahi grub dhcpcd
+    pacman -Sy --noconfirm base linux terminus-font linux-firmware openssh avahi grub dhcpcd dosfstools efibootmgr os-prober
 
     mkinitcpio -p linux
-    genfstab -U / > /etc/fstab
-    grub-install --target=i386-pc --recheck $LOOPDEV
+    mkdir -p /boot/efi
+    mount ${LOOPDEV}p1 /boot/efi
+    grub-install --target=x86_64-efi --efi-directory=/boot/efi --boot-directory=/boot/efi --no-nvram --bootloader-id=arch --removable
     grub-mkconfig -o /boot/grub/grub.cfg
+    genfstab -U / > /etc/fstab
 
     echo \"root:root\" | chpasswd
 
@@ -172,5 +176,5 @@ chroot "$MNT" /bin/bash -c "
 sleep 3
 killall gpg-agent
 
-umount -R "$MNT"
-losetup -d "$LOOPDEV"
+# umount -R "$MNT"
+# losetup -d "$LOOPDEV"
diff --git a/cloud-init/arch/build-raw2.sh b/cloud-init/arch/build-raw2.sh
new file mode 100644
index 0000000..ab810ef
--- /dev/null
+++ b/cloud-init/arch/build-raw2.sh
@@ -0,0 +1,82 @@
+#!/bin/bash
+set -euo pipefail
+
+IMG="arch-efi-luks.img"
+SIZE=3G
+MNT=/mnt/arch
+LOOP=
+
+echo "==> Creating raw image"
+truncate -s $SIZE $IMG
+
+echo "==> Partitioning (GPT + EFI + LUKS)"
+parted $IMG --script mklabel gpt
+parted $IMG --script mkpart ESP fat32 1MiB 513MiB
+parted $IMG --script set 1 boot on
+parted $IMG --script mkpart primary ext4 513MiB 100%
+
+LOOP=$(losetup --find --show --partscan "$IMG")
+mkfs.vfat -F32 "${LOOP}p1"
+
+echo "==> Encrypting root partition"
+echo -n "testpass" | cryptsetup luksFormat "${LOOP}p2" -
+echo -n "testpass" | cryptsetup open "${LOOP}p2" cryptroot -
+
+mkfs.ext4 /dev/mapper/cryptroot
+
+echo "==> Mounting filesystems"
+mount /dev/mapper/cryptroot $MNT
+mkdir -p $MNT/boot
+mount "${LOOP}p1" $MNT/boot
+
+echo "==> Installing Arch base system"
+pacstrap -K $MNT base linux linux-firmware systemd-boot vim mkinitcpio
+
+echo "==> Generating fstab"
+genfstab -U $MNT >> $MNT/etc/fstab
+
+echo "==> Configuring system"
+arch-chroot $MNT bash -c "
+  ln -sf /usr/share/zoneinfo/UTC /etc/localtime
+  hwclock --systohc
+  echo 'en_US.UTF-8 UTF-8' > /etc/locale.gen
+  locale-gen
+  echo 'LANG=en_US.UTF-8' > /etc/locale.conf
+  echo 'archluks' > /etc/hostname
+  echo 'root:testpass' | chpasswd
+"
+
+echo "==> Setting up crypttab"
+UUID=$(blkid -s UUID -o value "${LOOP}p2")
+echo "cryptroot UUID=$UUID none luks" > $MNT/etc/crypttab
+
+echo "==> Configuring mkinitcpio for LUKS"
+sed -i 's/^HOOKS=.*/HOOKS=(base udev autodetect modconf block encrypt filesystems keyboard fsck)/' $MNT/etc/mkinitcpio.conf
+arch-chroot $MNT mkinitcpio -P
+
+echo "==> Installing systemd-boot"
+arch-chroot $MNT bootctl install
+
+echo "==> Creating boot entry"
+cat > $MNT/boot/loader/loader.conf <<EOF
+default arch
+timeout 3
+editor no
+EOF
+
+cat > $MNT/boot/loader/entries/arch.conf <<EOF
+title   Arch Linux (LUKS)
+linux   /vmlinuz-linux
+initrd  /initramfs-linux.img
+options cryptdevice=UUID=$UUID:cryptroot root=/dev/mapper/cryptroot rw
+EOF
+
+echo "==> Cleanup"
+umount -R $MNT
+cryptsetup close cryptroot
+losetup -d $LOOP
+
+echo "✅ Done! Image ready: $IMG"
+
+echo "==> Test with:"
+echo "qemu-system-x86_64 -drive file=$IMG,format=raw -enable-kvm -m 2048 -cpu host -bios /usr/share/ovmf/x64/OVMF_CODE.fd"
diff --git a/cloud-init/arch/startup.sh b/cloud-init/arch/startup.sh
old mode 100644
new mode 100755
index 5fb24b0..6ae7d65
--- a/cloud-init/arch/startup.sh
+++ b/cloud-init/arch/startup.sh
@@ -27,9 +27,11 @@ cp $SOURCE_PATH $TARGET_PATH
 virt-install --name ${INSTANCE_ID} --memory ${MEMORY} --vcpus ${VCPUS} \
   --disk path="${TARGET_PATH},format=raw,bus=virtio" \
   --os-variant archlinux \
-  --graphics none \
   --console pty,target_type=serial \
   --import \
-  --noautoconsole
+  --noautoconsole \
+  --network bridge=br0 \
+  --graphics spice \
+  --boot uefi
 
 virsh autostart ${INSTANCE_ID}
diff --git a/installer.sh b/installer.sh
index 4788858..d92cd8a 100755
--- a/installer.sh
+++ b/installer.sh
@@ -24,7 +24,7 @@ install-nvim () {
   ln -sf $(pwd)/nvim/init.lua ~/.config/nvim/init.lua
   ln -sf $(pwd)/nvim/lua/plugins.lua ~/.config/nvim/lua/plugins.lua
 
-  nvim -c ':PlugInstall' +qa
+  nvim -c ':PlugInstall' +qa || true
 }
 
 install-oh-my-zsh () {
diff --git a/zsh/.exports b/zsh/.exports
index 187e5f3..a097b7b 100644
--- a/zsh/.exports
+++ b/zsh/.exports
@@ -7,3 +7,5 @@ export NVM_DIR="$HOME/.nvm"
 export COMPOSE_DOCKER_CLI_BUILD=1
 export DOCKER_BUILDKIT=1
 export COMPOSE_BAKE=True
+export OLLAMA_MODELS=/kvmpool/models
+export PATH=$PATH:~/src/bin