diff --git a/playbooks/install.yaml b/playbooks/install.yaml
index 05777db..24b6fc0 100644
--- a/playbooks/install.yaml
+++ b/playbooks/install.yaml
@@ -10,7 +10,7 @@
   roles:
     - base
 
-# - name: install minimal system packages
-#   hosts: base
-#   roles:
-#     - packages_minimal
+- name: post-install setup
+  hosts: base
+  roles:
+    - software
diff --git a/roles/base/tasks/main.yaml b/roles/base/tasks/main.yaml
index fe3fb7d..882d844 100644
--- a/roles/base/tasks/main.yaml
+++ b/roles/base/tasks/main.yaml
@@ -1,5 +1,9 @@
 ---
 - block:
+  - name: ensure root_password is set
+    assert:
+      that: root_password is defined
+      msg: "please specify a root password via -e root_password=<password>"
   - import_tasks: archinstall/mirrorlist.yaml
   - import_tasks: archinstall/partition.yaml
   - import_tasks: archinstall/initialize_root_zvol.yaml
@@ -8,5 +12,5 @@
   - import_tasks: archinstall/prepare_chroot.yaml
   - import_tasks: archinstall/install_os.yaml
   - import_tasks: archinstall/postinstall_snapshot.yaml
-  - meta: end_play
+  - meta: end_play # pull again after reboot to resume provisioning
   when: archiso_detected and base_root_disks is defined
diff --git a/roles/base/templates/arch_chroot_install.sh b/roles/base/templates/arch_chroot_install.sh
index 23652a7..76dcd03 100644
--- a/roles/base/templates/arch_chroot_install.sh
+++ b/roles/base/templates/arch_chroot_install.sh
@@ -1,6 +1,10 @@
 #!/bin/bash
 set -e
 
+function set_root_password {
+	echo "{{ root_password }}" | passwd root --stdin
+}
+
 function add_admin_user {
 	username="$1"
 	id -u $username || useradd -m -G wheel $username
@@ -75,9 +79,14 @@ function configure_dhcp_ethernet {
 
 function enable_systemd_services {
 	systemctl enable sshd.service
+	systemctl enable iwd.service
+	systemctl enable zfs.target
+	systemctl enable zfs-import-cache.service
+	systemctl enable zfs-mount.service
 }
 
 # do the stuff
+set_root_password
 add_admin_user mark
 install_paru_as mark
 install_zfs_packages_as mark
diff --git a/roles/software/tasks/main.yaml b/roles/software/tasks/main.yaml
new file mode 100644
index 0000000..132702d
--- /dev/null
+++ b/roles/software/tasks/main.yaml
@@ -0,0 +1,2 @@
+- import_tasks: software_desktop.yaml
+- import_tasks: software_gfx.yaml
diff --git a/roles/software/tasks/software_desktop.yaml b/roles/software/tasks/software_desktop.yaml
new file mode 100644
index 0000000..beaefae
--- /dev/null
+++ b/roles/software/tasks/software_desktop.yaml
@@ -0,0 +1,8 @@
+- name: install desktop packages
+  package:
+    - bzip2
+    - grim
+    - podman
+    - sway
+    - telegram-desktop
+
diff --git a/roles/software/tasks/software_gfx.yaml b/roles/software/tasks/software_gfx.yaml
new file mode 100644
index 0000000..0830514
--- /dev/null
+++ b/roles/software/tasks/software_gfx.yaml
@@ -0,0 +1,5 @@
+- name: install graphics packages
+  package:
+    - blender
+    - krita
+    - inkscape