Start

The first hour

Same walkthrough as After you log in. Copied here so Unwoke setup can open it offline. The desktop will feel quiet. That is the product.

About 20 minutes Keep the locks Settings is not setup

The one sentence. Do not open GNOME Software, Discover, or Settings → Apps. Open Unwoke setup in the app grid (also ujust setup). Nothing turns off until you pick it.

Where to click

Use this

Unwoke setup

App grid, first login, or ujust setup. Locks, leftover stock steps, daily user, “this looks broken.” This is first-time setup.

Later, maybe

GNOME / KDE Settings

Wi-Fi network name, display scale, keyboard, night light. Not software. Not Bluetooth. Not “privacy” checkboxes.

There isn’t one

A software store

Bazaar, GNOME Software, and Discover are gone. Apps: Install an app.

Do this / not that

Do

Keep defaults for a day

Create the daily user if asked. Reboot if a signed update is staged. Enroll their Secure Boot key. USBGuard with the devices you actually use. Then stop.

Do not

Make it “feel like Fedora”

Do not enable Bluetooth, Flathub, brew, toolbox, and every browser pack in the first hour “to test.” ujust why if something looks broken.

Before the login window

An installer-style screen on tty1 before GNOME or KDE is not a hung install. It asks for a daily username. The greeter waits.

  1. If the screen appears

    Create a daily (non-wheel) user

    That account is for the graphical session. Wheel stays for TTY and run0. Empty name, Cancel, or a 5-minute skip: Unwoke setup → Daily user later. Detail: Daily user.

First graphical login, in order

  1. Login

    Sign in as the daily user

    Navy wallpaper is the theme, not a second wizard. If the greeter refuses wheel, that is admin-split. Need privilege: run0.

  2. If you see a reboot nag

    Reboot onto the signed image first

    Unwoke setup → Start → Reboot now. Until then, updates are not locked to our cosign.pub.

    rpm-ostree status

  3. The window that opens

    Stay in Unwoke setup

    Start → Keep all defaults (recommended). Hide it on login after this session. Same as ujust setup.

  4. Stock leftover tab

    Their steps, not ours

    Enroll the secureblue Secure Boot key (BIOS password secureblue). ujust set-kargs-hardening if you rebased instead of an ISO. USBGuard with trusted devices plugged in: ujust setup-usbguard. Overlay locks stay on. Their post-install.

  5. Daily user tab

    Only if you skipped tty1

    Create the non-wheel account, then log into it.

  6. Stop

    Do not “turn everything on”

    One named need later, one tutorial. Fingerprinting vs locks: read first before loosening JIT or WebGL.

  7. Trust

    Confirm the box is what we shipped

    ujust unwoke-status
ujust audit-unwoke
ujust audit-secureblue

    Check health.

  8. Now Settings is fine

    Wi-Fi, display, keyboard — not apps

    GNOME Settings or KDE System Settings for the network name and scale. Not a store. Not Bluetooth enable (Turn on tab first). Not Users as a way around admin-split.

Tab map, Settings table, and the long form: After you log in.