diff --git a/Makefile b/Makefile
index a84ff53..e3332c0 100644
--- a/Makefile
+++ b/Makefile
@@ -75,7 +75,8 @@ release: orchestrator-linux agent-linux live-image ## Build the scp-and-go relea
 ifneq ($(findstring Windows,$(UNAME_S))$(findstring MINGW,$(UNAME_S))$(findstring MSYS,$(UNAME_S)),)
 	@echo "ERROR: make release must be run from Linux/WSL (live-image dep needs mkosi)." && exit 1
 endif
-	@stamp=vetting-bundle-$(GIT_SHA); \
+	@set -e; \
+	  stamp=vetting-bundle-$(GIT_SHA); \
 	  rm -rf build/$$stamp bin/$$stamp.tar.gz; \
 	  mkdir -p build/$$stamp/bin build/$$stamp/live-image; \
 	  cp bin/vetting-linux-amd64 bin/vetting-agent.linux-amd64 build/$$stamp/bin/; \
diff --git a/live-image/mkosi.postinst b/live-image/mkosi.postinst
index aea9cfd..46a991c 100755
--- a/live-image/mkosi.postinst
+++ b/live-image/mkosi.postinst
@@ -1,10 +1,17 @@
 #!/bin/sh
-# mkosi postinst: enable the vetting-agent service. The binary lands in
-# the image via mkosi.extra/ (staged by the live-image Makefile from
-# ../bin/vetting-agent.linux-amd64); the service unit lands via
-# mkosi.skeleton/. All we need here is the multi-user.target symlink.
+# mkosi postinst: enable the vetting-agent service and generate the
+# initrd. The binary lands in the image via mkosi.extra/ (staged by the
+# live-image Makefile from ../bin/vetting-agent.linux-amd64); the
+# service unit lands via mkosi.skeleton/.
 set -eu
 
 mkdir -p "$BUILDROOT/etc/systemd/system/multi-user.target.wants"
 ln -sf /etc/systemd/system/vetting-agent.service \
     "$BUILDROOT/etc/systemd/system/multi-user.target.wants/vetting-agent.service"
+
+# Bootable=no means mkosi won't run update-initramfs for us, and the
+# deferred initramfs-tools trigger inside the chroot doesn't actually
+# generate /boot/initrd.img-<kver>. Do it explicitly so the top-level
+# Makefile's cp of live-image/build/initrd.img has something to copy.
+kver=$(ls "$BUILDROOT/lib/modules/" | head -n1)
+chroot "$BUILDROOT" update-initramfs -c -k "$kver"