diff --git a/aimee-os b/aimee-os
index 554063e..c30da6a 160000
--- a/aimee-os
+++ b/aimee-os
@@ -1 +1 @@
-Subproject commit 554063e1f4e316a6d3087a27076e0c6d5a34fca1
+Subproject commit c30da6a5ff0d2f9fade417e91b083d7b483f0984
diff --git a/customize.sh b/customize.sh
index 57ba6d7..3845955 100755
--- a/customize.sh
+++ b/customize.sh
@@ -13,4 +13,7 @@ ${target}-emerge -vgKnj --root=/mnt/gentoo www-client/firefox:esr
 
 passwd -R /mnt/gentoo -d root
 
+groupadd -R /mnt/gentoo -r kiosk
+useradd -R /mnt/gentoo -r -g kiosk kiosk
+
 systemctl --root=/mnt/gentoo enable wpa_supplicant@wlan0
diff --git a/install.packages b/install.packages
index 7998e21..1c92159 100644
--- a/install.packages
+++ b/install.packages
@@ -1,2 +1,3 @@
+gui-wm/sway
 net-wireless/wpa_supplicant
 media-video/pipewire
diff --git a/overlay/usr/lib/systemd/system/kiosk.service b/overlay/usr/lib/systemd/system/kiosk.service
new file mode 100644
index 0000000..2de5019
--- /dev/null
+++ b/overlay/usr/lib/systemd/system/kiosk.service
@@ -0,0 +1,28 @@
+[Unit]
+After=systemd-user-sessions.service plymouth-quit-wait.service
+Before=graphical.target
+ConditionPathExists=/dev/tty1
+Wants=dbus.socket systemd-logind.service
+After=dbus.socket systemd-logind.service
+Conflicts=getty@tty1.service
+After=getty@tty1.service
+Wants=time-sync.target
+After=time-sync.target
+
+[Service]
+TemporaryFileSystem=/home
+ExecStartPre=!/bin/install -o kiosk -g kiosk -d -m u=rwx,go= /home/kiosk
+ExecStart=/usr/bin/sway
+User=kiosk
+Environment=WLR_RENDERER_ALLOW_SOFTWARE=1
+Environment=WLR_LIBINPUT_NO_DEVICES=1
+StandardInput=tty
+StandardOutput=tty
+StandardError=journal
+TTYPath=/dev/tty1
+TTYReset=yes
+TTYVHangup=yes
+TTYVTDisallocate=yes
+PAMName=system-login
+UtmpMode=user
+UtmpIdentifier=tty1