diff --git a/src/modules/netinstall/build/_base_and_developer_edition.yaml b/src/modules/netinstall/build/_base_and_developer_edition.yaml
index 8b1402b..f557a5e 100644
--- a/src/modules/netinstall/build/_base_and_developer_edition.yaml
+++ b/src/modules/netinstall/build/_base_and_developer_edition.yaml
@@ -308,6 +308,7 @@
         - dhcpcd
         - dnsmasq
         - dnsutils
+        - dnscrypt-proxy
         - ethtool
         - iw
         - iwd
diff --git a/src/modules/netinstall/build/_base_system.yaml b/src/modules/netinstall/build/_base_system.yaml
index 074edd1..cb81577 100644
--- a/src/modules/netinstall/build/_base_system.yaml
+++ b/src/modules/netinstall/build/_base_system.yaml
@@ -308,6 +308,7 @@
         - dhcpcd
         - dnsmasq
         - dnsutils
+        - dnscrypt-proxy
         - ethtool
         - iw
         - iwd
diff --git a/src/modules/netinstall/build/_netinstall_only.yaml b/src/modules/netinstall/build/_netinstall_only.yaml
index 2161fdd..2cb72e5 100644
--- a/src/modules/netinstall/build/_netinstall_only.yaml
+++ b/src/modules/netinstall/build/_netinstall_only.yaml
@@ -308,6 +308,7 @@
         - dhcpcd
         - dnsmasq
         - dnsutils
+        - dnscrypt-proxy
         - ethtool
         - iw
         - iwd
diff --git a/src/modules/netinstall/netinstall.yaml b/src/modules/netinstall/netinstall.yaml
index 2a81cd0..7c27bde 100644
--- a/src/modules/netinstall/netinstall.yaml
+++ b/src/modules/netinstall/netinstall.yaml
@@ -308,6 +308,7 @@
         - dhcpcd
         - dnsmasq
         - dnsutils
+        - dnscrypt-proxy
         - ethtool
         - iw
         - iwd
diff --git a/src/modules/services-systemd/services-systemd.conf b/src/modules/services-systemd/services-systemd.conf
index a8fbdd7..d3dea4c 100644
--- a/src/modules/services-systemd/services-systemd.conf
+++ b/src/modules/services-systemd/services-systemd.conf
@@ -114,6 +114,10 @@ units:
      action: "enable"
      mandatory: false
 
+   - name: "dnscrypt-proxy.service"
+     action: "enable"
+     mandatory: false
+
    - name: "ntpd"
      action: "disable"
      mandatory: false
diff --git a/src/modules/unpackfsc/unpackfsc.conf b/src/modules/unpackfsc/unpackfsc.conf
new file mode 100644
index 0000000..8780862
--- /dev/null
+++ b/src/modules/unpackfsc/unpackfsc.conf
@@ -0,0 +1,57 @@
+# SPDX-FileCopyrightText: no
+# SPDX-License-Identifier: CC0-1.0
+#
+# Unpack a filesystem. Supported ways to "pack" the filesystem are:
+#   - fsarchiver in *savedir/restdir* mode (directories, not block devices)
+#   - squashfs
+#
+# Configuration:
+#
+#   from globalstorage: rootMountPoint
+#   from job configuration: the item to unpack
+#
+
+---
+# This module is configured a lot like the items in the *unpackfs*
+# module, but with only **one** item. Use multiple instances for
+# unpacking more than one filesystem.
+#
+# There are the following **mandatory** keys:
+#   - *source* path relative to the live / intstalling system to the image
+#   - *sourcefs* the type of the source files; valid entries are
+#       - `none` (this entry is ignored; kind of useless)
+#       - `fsarchiver`
+#         Aliases of this are `fsarchive`, `fsa` and `fsa-dir`. Uses
+#         fsarchiver in "restdir" mode.
+#       - `fsarchiver-block`
+#         Aliases of this are `fsa-block` and `fsa-fs`. Uses fsarchiver
+#         in "restfs" mode.
+#       - `squashfs`
+#         Aliases of this are `squash` and `unsquash`.
+#       - `tar`
+#   - *destination* path relative to rootMountPoint (so in the target
+#       system) where this filesystem is unpacked. It may be an
+#       empty string, which effectively is / (the root) of the target
+#       system.
+#
+#
+# There are the following **optional** keys:
+#   - *condition* sets a dynamic condition on unpacking the item in
+#     this job. This may be true or false (constant) or name a globalstorage
+#     value. Use '.' to separate parts of a globalstorage name if it is nested.
+#     Remember to quote names.
+#
+#     A condition is used in e.g. stacked squashfses, where the user can select
+#     a specific install type. The default value of *condition* is true.
+
+
+
+source: "/run/archiso/bootmnt/arch/x86_64/airootfs.sfs"
+sourcefs: "squashfs"
+destination: ""
+# condition: true
+
+source: "/run/archiso/bootmnt/arch/boot/x86_64/vmlinuz-linux-cachyos"
+sourcefs: "file"
+destination: "/boot/vmlinuz-linux-cachyos"
+# condition: true
diff --git a/src/modules/welcome/welcome.conf b/src/modules/welcome/welcome.conf
index bcf6b50..896f4b2 100644
--- a/src/modules/welcome/welcome.conf
+++ b/src/modules/welcome/welcome.conf
@@ -14,15 +14,9 @@
 # is show if the corresponding *show<buttonname>* setting
 # here is "true". If the setting is "false", the button is hidden.
 # Empty or not-set is interpreted as "false".
-#
-# TODO:3.3 Remove the URL fallback here; URLs only in `branding.desc`
-#
-# The setting can also be a full URL which will then be used
-# instead of the one from the branding file.
 showSupportUrl:         false
 showKnownIssuesUrl:     false
 showReleaseNotesUrl:    false
-# TODO:3.3 Move to branding, keep only a bool here
 showDonateUrl:          false
 
 # Requirements checking. These are general, generic, things