diff --git a/config/files/etc/yum.repos.d/koji.repo b/config/files/etc/yum.repos.d/koji.repo
index ab37ffe..ee63574 100644
--- a/config/files/etc/yum.repos.d/koji.repo
+++ b/config/files/etc/yum.repos.d/koji.repo
@@ -1,7 +1,7 @@
 [koji]
 name=Koji $basearch
 baseurl=https://kojipkgs.fedoraproject.org/repos/rawhide/latest/$basearch/
-enabled=1
+enabled=0
 gpgcheck=0
 repo_gpgcheck=0
 # DISABLE KOJI WHEN NOT BROKEN
diff --git a/config/files/usr/sbin/ostree-dnf-upgrade.py b/config/files/usr/sbin/ostree-dnf-upgrade.py
new file mode 100755
index 0000000..bca5592
--- /dev/null
+++ b/config/files/usr/sbin/ostree-dnf-upgrade.py
@@ -0,0 +1,43 @@
+#!/usr/bin/env python3
+
+import argparse
+import glob
+import libdnf5
+import subprocess
+import sys
+import tempfile
+
+parser = argparse.ArgumentParser()
+parser.add_argument('--distrosync', default=False, action='store_true')
+args = parser.parse_args()
+
+base = libdnf5.base.Base()
+base.load_config()
+config = base.get_config()
+
+with tempfile.TemporaryDirectory(prefix='rpms_') as td:
+    config.destdir = td
+    config.excludepkgs = ['kernel*']
+    base.setup()
+
+    repo_sack = base.get_repo_sack()
+    repo_sack.create_repos_from_system_configuration()
+    repo_sack.update_and_load_enabled_repos(True)
+
+    goal = libdnf5.base.Goal(base)
+    if args.distrosync:
+        goal.add_rpm_distro_sync()
+    else:
+        goal.add_upgrade("*")
+
+    transaction = goal.resolve()
+    if transaction.get_transaction_packages_count() == 0:
+        sys.exit(0)
+
+    transaction.download()
+    packages = glob.glob(td + '/*.rpm')
+
+    cmd = ["rpm-ostree", "override", "replace"] + packages
+    print(cmd)
+    completed_process = subprocess.run(cmd)
+    completed_process.check_returncode()
diff --git a/recipes/fedora-kinoite-laptop.yml b/recipes/fedora-kinoite-laptop.yml
index 1aebb7f..ab07bad 100644
--- a/recipes/fedora-kinoite-laptop.yml
+++ b/recipes/fedora-kinoite-laptop.yml
@@ -23,6 +23,7 @@ modules:
       - etc/yum.repos.d: /etc/yum.repos.d
       - etc/pki: /etc/pki
       - etc/dracut.conf.d: /etc/dracut.conf.d
+      - usr/sbin: /usr/sbin
       - rpms: /usr/share/local-rpm-repo
 
   - type: containerfile
@@ -59,7 +60,7 @@ modules:
   - type: script
     snippets:
       - createrepo /usr/share/local-rpm-repo
-      #- dnf5 '--exclude=kernel*' upgrade -y
+      - ostree-dnf-upgrade.py --distrosync
 
   # Virtualization
   - type: rpm-ostree
@@ -117,6 +118,11 @@ modules:
       - google-chrome-stable
       - tailscale
 
+  - type: script
+    snippets:
+      - echo "L /var/opt/google - - - - ../../usr/lib/opt/google" > /usr/lib/tmpfiles.d/var-symlinks.conf
+      - echo "L /var/opt/1Password - - - - ../../usr/lib/opt/1Password" >> /usr/lib/tmpfiles.d/var-symlinks.conf
+
   # Development
   - type: rpm-ostree
     install:
@@ -167,14 +173,14 @@ modules:
   # BUST LAYER CACHE IF THERE ARE UPDATES
   # We still download packages from whatever repo is suggested by Fedora's metalink
   # But we trust UWaterloo to be somewhat quickly up to date.
-  #- type: containerfile
-  #  snippets:
-  #    - ADD https://mirror.csclub.uwaterloo.ca/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/repomd.xml /tmp/mirror-cache-bust
+  - type: containerfile
+    snippets:
+      - ADD https://mirror.csclub.uwaterloo.ca/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/repomd.xml /tmp/mirror-cache-bust
 
   # Upgrade all in one layer if there are any new packages
-  #- type: script
-  #  snippets:
-  #    - dnf5 '--exclude=kernel*' upgrade -y
+  - type: script
+    snippets:
+      - ostree-dnf-upgrade.py
 
   - type: rpm-ostree
     install:
@@ -190,8 +196,6 @@ modules:
       # Put back /opt and create symlinks in /var
       - rm /opt
       - ln -s var/opt /opt
-      - echo "L /var/opt/google - - - - ../../usr/lib/opt/google" > /usr/lib/tmpfiles.d/var-symlinks.conf
-      - echo "L /var/opt/1Password - - - - ../../usr/lib/opt/1Password" >> /usr/lib/tmpfiles.d/var-symlinks.conf
       # merge /usr/etc into /etc otherwise ostree tar import is not consistent
       - cp -fal /usr/etc /
       # Virtualization packages install files in /boot we don't want