diff --git a/installer/README.md b/installer/README.md
index fea30d6..8e1c857 100644
--- a/installer/README.md
+++ b/installer/README.md
@@ -48,10 +48,15 @@ the live session with the installer in it.
 
 `overlays/live/etc/systemd/system/arcline-installer.service` starts
 `arcline-installer-session` on boot. Modern Xorg (trixie 21.1.x) refuses to
-run as root, so the session script starts Xorg as the dedicated unprivileged
-`liveuser` account on vt1, grants root display access (`xhost
-+SI:localuser:root`), then runs the installer as root (it needs root for
-`deploy-disk.sh`). When the installer exits, X and the session end.
+run as root, so the session script:
+
+1. hands the dedicated console VT to `liveuser` (`chown`, since udev leaves
+   VTs 620 root:tty which isn't readable by the tty group),
+2. starts Xorg as the unprivileged `liveuser` on vt1,
+3. grants root display access (`xhost +SI:localuser:root`),
+4. runs the installer as root (it needs root for `deploy-disk.sh`).
+
+When the installer exits, X and the session end.
 
 ## Manual run (for development / on a box without the ISO)
 
diff --git a/overlays/live/usr/local/sbin/arcline-installer-session b/overlays/live/usr/local/sbin/arcline-installer-session
index 3106405..a7d1210 100755
--- a/overlays/live/usr/local/sbin/arcline-installer-session
+++ b/overlays/live/usr/local/sbin/arcline-installer-session
@@ -10,9 +10,20 @@ set -euo pipefail
 
 export DISPLAY=:0
 LXUSER=liveuser
+VT=1
+TTY="/dev/tty$VT"
+
+# udev leaves console VTs as 620 root:tty — group tty has write-only, no read,
+# so Xorg's xf86OpenConsole fails with "Cannot open virtual console (Permission
+# denied)". This VT is dedicated to the installer (the unit Conflicts with
+# getty@tty1), so hand it to liveuser outright.
+chown "$LXUSER" "$TTY" 2>/dev/null || true
+
+# clear stale X state from a previous attempt in the same boot
+rm -f /tmp/.X0-lock /tmp/.X11-unix/X0 2>/dev/null || true
 
 # 1. start Xorg as the unprivileged user on vt1 (no -allow-root; it's gone)
-runuser -u "$LXUSER" -- /usr/bin/Xorg :0 vt1 -nolisten tcp &
+runuser -u "$LXUSER" -- /usr/bin/Xorg :0 "vt$VT" -nolisten tcp &
 XPID=$!
 
 # 2. wait for the X socket