diff --git a/README.md b/README.md
index 2f66061..7e99dab 100644
--- a/README.md
+++ b/README.md
@@ -123,9 +123,10 @@ ansible-playbook ansible/site.yml --limit prometheus \
 butane --strict --pretty --output aegis.ign ansible/bootstrap/aegis.bu
 ```
 
-The `core` and `pi` users both receive the configured SSH key.
+The `pi` user receives the configured SSH key, and partition 5 on `/dev/mmcblk0` is formatted as
+Btrfs and mounted at `/var/lib` on first boot. Formatting is destructive for that partition.
 
-The controller then manages it remotely as `core@aegis`; unlike local desktop profiles, Aegis is
+The controller then manages it remotely as `pi@aegis`; unlike local desktop profiles, Aegis is
 intentionally an SSH inventory target. `profile_aegis` manages rootful Podman Quadlets for AdGuard
 Home and iCloudPD, persistent data under `/var/lib`, the Podman auto-update timer, and
 `wake-ikaros`. Define `vault_aegis_icloudpd_apple_id` in Vault before applying it. iCloudPD still
diff --git a/ansible/bootstrap/aegis.bu b/ansible/bootstrap/aegis.bu
index e3a7da3..b26653e 100644
--- a/ansible/bootstrap/aegis.bu
+++ b/ansible/bootstrap/aegis.bu
@@ -4,13 +4,26 @@ variant: fcos
 version: 1.6.0
 passwd:
   users:
-    - name: core
-      ssh_authorized_keys:
-        - "ssh-ed25519 CHANGEME_AEGIS_SSH_PUBLIC_KEY"
     - name: pi
       ssh_authorized_keys:
         - "ssh-ed25519 CHANGEME_AEGIS_SSH_PUBLIC_KEY"
 storage:
+  disks:
+    - device: /dev/mmcblk0
+      wipe_table: false
+      partitions:
+        - label: aegis-data
+          number: 5
+          size_mib: 0
+  filesystems:
+    - device: /dev/disk/by-partlabel/aegis-data
+      format: btrfs
+      label: aegis-data
+      wipe_filesystem: false
+      mount:
+        path: /var/lib
+        options:
+          - compress=zstd
   files:
     - path: /etc/hostname
       mode: 0644
diff --git a/ansible/inventory/host_vars/aegis.yml b/ansible/inventory/host_vars/aegis.yml
index d1e4a95..2232f68 100644
--- a/ansible/inventory/host_vars/aegis.yml
+++ b/ansible/inventory/host_vars/aegis.yml
@@ -1,7 +1,7 @@
 ---
 ansible_host: aegis
 ansible_connection: ssh
-ansible_user: core
+ansible_user: pi
 ansible_become: true
 ansible_python_interpreter: /usr/bin/python3