diff --git a/chromium-setup/emmc-provisioning/cloud-init/first-boot.md b/chromium-setup/emmc-provisioning/cloud-init/first-boot.md
index 647219d..9d0f1ee 100644
--- a/chromium-setup/emmc-provisioning/cloud-init/first-boot.md
+++ b/chromium-setup/emmc-provisioning/cloud-init/first-boot.md
@@ -9,7 +9,7 @@ This script runs once on first boot via cloud-init (see `user-data-remote-gnss.e
 1. **Constants** — `FILE_SERVER`, `PI_USER`, paths, log file.
 2. **Logging** — All output tee’d to `/var/log/first-boot.log`.
 3. **Helpers** — `install_oneshot(name)` downloads `${name}.sh` from the file server and installs it as a one-shot autostart (runs once at pi’s first login, then deletes itself).
-4. **Packages** — git, Chromium, wmctrl, SSH, swaybg, wlr-randr, maliit, xinput-calibrator.
+4. **Packages** — git, Chromium, wmctrl, SSH, swaybg, wlr-randr, maliit, xinput-calibrator, rpi-eeprom.
 5. **Kiosk files** — Download `start-chromium.sh` and `chromium-kiosk.desktop`; create autostart dir.
 6. **Boot splash and wallpaper** — Download `splash.png`; install Plymouth custom theme; copy image for LightDM and desktop.
 7. **LightDM** — Download `99-default-session.conf` (rpd-labwc) and `99-wallpaper.conf` to `/etc/lightdm/lightdm.conf.d/`.
@@ -53,6 +53,7 @@ Installs the software needed for the rest of the script and for the kiosk:
 | **wlr-randr** | Display rotation for wlroots/labwc; one-shot sets “Left” (transform 270). |
 | **maliit-keyboard** | On-screen keyboard for touch input. |
 | **xinput-calibrator** | Touchscreen calibration (optional; run manually if needed). |
+| **rpi-eeprom** | EEPROM tools (`rpi-eeprom-update`, `rpi-eeprom-config`) for Pi 4/CM4 boot order (e.g. network first). |
 
 ---
 
@@ -78,7 +79,7 @@ Ensure the `.desktop` file on the server has `Exec=/home/pi/start-chromium.sh` (
 
 A **single image** (`splash.png`) is used for the boot splash, login screen, and desktop wallpaper. Host it at **`${FILE_SERVER}/splash.png`** (e.g. `http://10.130.60.141:5000/files/splash.png`).
 
-- **Plymouth (boot splash):** Downloads `splash.png`, `custom.plymouth`, and `custom.script` from the file server → installs to `/usr/share/plymouth/themes/custom/` → sets `Theme=custom` in `/etc/plymouth/plymouthd.conf` (single `[Daemon]` section) → runs `update-initramfs -u`. If any download fails, logs a warning and continues. **Note:** On reTerminal DM the DSI panel initializes a few seconds into boot, so the Plymouth splash may appear briefly or after a short black screen; this is normal for DSI on Pi 5.
+- **Plymouth (boot splash):** Downloads `splash.png`, `custom.plymouth`, and `custom.script` from the file server → installs to `/usr/share/plymouth/themes/custom/` → sets `Theme=custom` in `/etc/plymouth/plymouthd.conf` (single `[Daemon]` section) → runs `update-initramfs -u`. If any download fails, logs a warning and continues. **Note:** On reTerminal DM the DSI panel can initialize a few seconds into boot, so the Plymouth splash may appear briefly or after a short black screen; this is normal for DSI displays.
 - **LightDM (login screen):** Copies the same image to `/usr/share/rpd-wallpaper/splash.png` and writes `/etc/lightdm/lightdm.conf.d/99-wallpaper.conf` with `wallpaper=...` and `wallpaper_mode=crop`.
 - **Desktop wallpaper:** A one-shot autostart runs when **pi** first logs in: it adds `swaybg -i /usr/share/rpd-wallpaper/splash.png -m fill` to `~/.config/labwc/autostart` (so it persists across logins) and runs swaybg for the current session. The one-shot then deletes itself.
 
@@ -127,7 +128,7 @@ The reTerminal DM default is portrait. Rotation is set using **wlr-randr** (labw
 
 ## Boot order (network first, then eMMC/SD)
 
-If **`rpi-eeprom-config`** and **`rpi-eeprom-update`** are present (Pi 4/CM4), the script sets the EEPROM **`BOOT_ORDER=0x21`**: try **network** first (0x2), then **SD/eMMC** (0x1). This allows future network boot or re-provisioning (e.g. PXE or USB gadget) before falling back to local storage. The EEPROM update is scheduled for the next reboot; no second reboot is required. **On reTerminal DM (Pi 5)** the bootloader is different and `rpi-eeprom-update -l` typically does not provide a config file — the log message “Boot order unchanged (reTerminal DM / Pi 5 use a different bootloader…)” is normal and not an error. If the tools are not available, the step is skipped.
+If **`rpi-eeprom-config`** and **`rpi-eeprom-update`** are present (Pi 4/CM4), the script sets the EEPROM **`BOOT_ORDER=0x21`**: try **network** first (0x2), then **SD/eMMC** (0x1). This allows future network boot or re-provisioning (e.g. PXE or USB gadget) before falling back to local storage. The EEPROM update is scheduled for the next reboot; no second reboot is required. If “Could not read current EEPROM config” appears, run `sudo rpi-eeprom-update -l` on the device to see if a firmware file is listed; you can set boot order manually with `rpi-eeprom-config` if needed. If the tools are not available, the step is skipped.
 
 ## Reboot
 
diff --git a/chromium-setup/emmc-provisioning/cloud-init/first-boot.sh b/chromium-setup/emmc-provisioning/cloud-init/first-boot.sh
index 3a6ff6e..271efb4 100644
--- a/chromium-setup/emmc-provisioning/cloud-init/first-boot.sh
+++ b/chromium-setup/emmc-provisioning/cloud-init/first-boot.sh
@@ -57,9 +57,9 @@ install_oneshot() {
 log "--- Installing packages ---"
 log "Running apt-get update ..."
 apt-get update -qq
-log "Installing: git chromium wmctrl openssh-server swaybg wlr-randr maliit-keyboard xinput-calibrator"
+log "Installing: git chromium wmctrl openssh-server swaybg wlr-randr maliit-keyboard xinput-calibrator rpi-eeprom"
 apt-get install -y -qq git chromium wmctrl openssh-server \
-  swaybg wlr-randr maliit-keyboard xinput-calibrator
+  swaybg wlr-randr maliit-keyboard xinput-calibrator rpi-eeprom
 log "Packages installed successfully"
 
 # --- 2. Dirs and kiosk files from file server ---
@@ -158,7 +158,6 @@ update-initramfs -u -k all 2>/dev/null || true
 
 # --- 6c. Boot order: network first, then eMMC/SD (for future network boot / re-provisioning) ---
 # BOOT_ORDER: 0x2 = network, 0x1 = SD/eMMC. 0x21 = try network first, then local storage.
-# On Pi 5 / reTerminal DM the EEPROM layout differs; rpi-eeprom-update -l may not return a path (skip is normal).
 log "--- Boot order (network first, then eMMC/SD) ---"
 if command -v rpi-eeprom-config >/dev/null 2>&1 && command -v rpi-eeprom-update >/dev/null 2>&1; then
   BOOTCONF="/tmp/first-boot-eeprom-conf.txt"
@@ -174,7 +173,7 @@ if command -v rpi-eeprom-config >/dev/null 2>&1 && command -v rpi-eeprom-update
       log "WARNING: rpi-eeprom-config --apply failed; boot order unchanged"
     fi
   else
-    log "Boot order unchanged (reTerminal DM / Pi 5 use a different bootloader; rpi-eeprom-update did not provide a config file — this is normal)"
+    log "WARNING: Could not read current EEPROM config; skipping boot order change (run 'rpi-eeprom-update -l' as root to check)"
   fi
   rm -f "$BOOTCONF"
 else