diff --git a/live-image/Makefile b/live-image/Makefile
index a8d28e7..6d7965d 100644
--- a/live-image/Makefile
+++ b/live-image/Makefile
@@ -26,7 +26,10 @@ all: check-linux $(MKOSI_EXTRA_AGENT)
 #      blob presence check trips.
 # Requires unmkinitramfs (from initramfs-tools on the build host).
 check-initrd:
-	@size=$$(stat -c%s build/initrd.img); \
+	@# build/initrd.img is a symlink into build/boot/; use wc -c (which
+	@# follows symlinks) to get the real byte count. `stat -c%s` without
+	@# -L returns the symlink's path length instead of the target size.
+	@size=$$(wc -c < build/initrd.img); \
 	 min=$$((150 * 1024 * 1024)); \
 	 if [ "$$size" -lt "$$min" ]; then \
 	   echo "ERROR: initrd.img is $$size bytes (< $$min) — firmware almost certainly missing."; \
@@ -43,7 +46,7 @@ check-initrd:
 	   echo "       Check MODULES= in /etc/initramfs-tools/initramfs.conf."; \
 	   exit 1; \
 	 fi
-	@echo "initrd.img OK ($$(du -h build/initrd.img | cut -f1), i915 firmware present)"
+	@echo "initrd.img OK ($$(du -hL build/initrd.img | cut -f1), i915 firmware present)"
 
 agent: $(AGENT_BIN)
 
diff --git a/live-image/mkosi.conf b/live-image/mkosi.conf
index f4456bb..8e08e29 100644
--- a/live-image/mkosi.conf
+++ b/live-image/mkosi.conf
@@ -45,6 +45,7 @@ Packages=
     pciutils
     usbutils
     initramfs-tools
+    zstd
     # Firmware. firmware-linux-nonfree on bookworm is a thin metapackage
     # that does NOT pull i915 GuC/HuC — those live in firmware-misc-nonfree.
     # Enumerate explicitly so the blob for whatever hardware we boot on