diff --git a/config/redbear-bare.toml b/config/redbear-bare.toml
index 6c30039f7b..94d73e92bb 100644
--- a/config/redbear-bare.toml
+++ b/config/redbear-bare.toml
@@ -17,7 +17,11 @@
 include = ["minimal.toml"]
 
 [general]
-filesystem_size = 96
+# 192 MiB leaves ~30% headroom over the 153 MiB of installed content
+# (zsh, base, base-initfs, kernel, relibc, userutils, libgcc, libstdcxx,
+# coreutils, extrautils, ca-certificates, kibi, netdb, netutils, pkgutils,
+# uutils). Anything below 160 MiB triggers ENOSPC during installer commit.
+filesystem_size = 192
 
 # Trim down packages beyond what minimal.toml includes.
 # minimal.toml includes ca-certificates, coreutils, extrautils, zsh, pkgutils, kibi.
@@ -50,6 +54,24 @@ data = ""
 path = "/etc/pkg.d/50_redox"
 data = ""
 
+# Override minimal.toml's 31_debug_console.service — the bare initfs
+# does not start ptyd (only 6 daemons), so getty's retry loop on
+# /scheme/debug/no-preserve hangs the boot for ~45s before the
+# real console login is reached. Disable the debug console entirely.
+# postinstall = true ensures this override wins over any package
+# staging (Layer 2) of the same path.
+[[files]]
+path = "/etc/init.d/31_debug_console.service"
+postinstall = true
+data = """
+[unit]
+description = "Debug console (disabled on redbear-bare)"
+
+[service]
+cmd = "true"
+type = "oneshot"
+"""
+
 # Override base.toml's login_schemes — no display/audio schemes in bare
 [[files]]
 path = "/etc/login_schemes.toml"
diff --git a/recipes/core/base-initfs/recipe.toml b/recipes/core/base-initfs/recipe.toml
index 6ab537c9fa..13127e5b09 100644
--- a/recipes/core/base-initfs/recipe.toml
+++ b/recipes/core/base-initfs/recipe.toml
@@ -67,8 +67,10 @@ bare_initfs()
         randd
         zerod
         ptyd
-        getty
     )
+    # `getty` is not a member of the base workspace — it lives in
+    # userutils. We copy the prebuilt binary from the sysroot after
+    # the cargo build step (see the EXTRA_SYSROOT_BINS copy below).
 }
 
 case "${TARGET}" in
@@ -92,7 +94,61 @@ esac
 rm -rf "${COOKBOOK_BUILD}/initfs"
 mkdir -p "${COOKBOOK_BUILD}/initfs/lib/init.d"
 
-cp "${COOKBOOK_SOURCE}/init.initfs.d"/* "${COOKBOOK_BUILD}/initfs/lib/init.d/"
+if [ "${REDBEAR_BARE_INITFS:-0}" = "1" ]; then
+    # Bare initfs boots the absolute minimum: logd, ramfs, randd,
+    # zerod, ptyd, getty. Only copy the init.d units that reference
+    # binaries we actually built (no fbcond, vesad, pcid, acpid,
+    # fbbootlogd, hwd, inputd, etc. — those daemons aren't in the
+    # bare BINS, and the init runtime would otherwise try to start
+    # them and hit "binary not found" or busy-loop on the debug
+    # console scheme).
+    for unit in "${COOKBOOK_SOURCE}/init.initfs.d"/*; do
+        case "$(basename "$unit")" in
+            00_logd.service|00_randd.service|00_zerod.service|00_runtime.target|ramfs@.service|90_initfs.target|50_rootfs.service)
+                cp -v "$unit" "${COOKBOOK_BUILD}/initfs/lib/init.d/"
+                ;;
+        esac
+    done
+    # Bare initfs also needs ptyd (built from BINS) and getty (copied
+    # from sysroot below). Provide minimal unit files for both.
+    cat > "${COOKBOOK_BUILD}/initfs/lib/init.d/00_ptyd.service" <<'EOF'
+[unit]
+description = "Pseudo-terminal daemon"
+default_dependencies = false
+[service]
+cmd = "ptyd"
+type = { scheme = "pty" }
+EOF
+    cat > "${COOKBOOK_BUILD}/initfs/lib/init.d/30_getty.service" <<'EOF'
+[unit]
+description = "Console getty (login on /scheme/console/2)"
+default_dependencies = false
+requires_weak = ["00_ptyd.service"]
+[service]
+cmd = "getty"
+args = ["2"]
+type = "oneshot_async"
+EOF
+    # Bare runtime.target — ptyd and getty are not pulled in by the
+    # mainline 00_runtime.target (which references nulld/rtcd that we
+    # filtered out). Add them as weak requires so init schedules them
+    # before reaching 90_initfs.target.
+    cat > "${COOKBOOK_BUILD}/initfs/lib/init.d/00_runtime.target" <<'EOF'
+[unit]
+description = "Services that relibc needs to function"
+default_dependencies = false
+requires_weak = [
+    "00_logd.service",
+    "00_randd.service",
+    "00_zerod.service",
+    "00_ptyd.service",
+    "30_getty.service",
+    "ramfs@logging.service",
+]
+EOF
+else
+    cp "${COOKBOOK_SOURCE}/init.initfs.d"/* "${COOKBOOK_BUILD}/initfs/lib/init.d/"
+fi
 
 mkdir -pv "${COOKBOOK_BUILD}/initfs/lib/drivers.d"
 cp -v "${COOKBOOK_SOURCE}/drivers/initfs-storage.toml" "${COOKBOOK_BUILD}/initfs/lib/drivers.d/00-storage.toml"
@@ -122,6 +178,11 @@ done
 cp "${COOKBOOK_SYSROOT}/usr/bin/redoxfs" "${COOKBOOK_BUILD}/initfs/bin"
 cp "${COOKBOOK_SYSROOT}/usr/bin/ion" "${COOKBOOK_BUILD}/initfs/bin"
 cp "${COOKBOOK_SYSROOT}/usr/bin/driver-manager" "${COOKBOOK_BUILD}/initfs/bin"
+# Bare initfs needs `getty` (built by userutils, not the base
+# workspace) so the initfs shell can launch a login prompt.
+if [ "${REDBEAR_BARE_INITFS:-0}" = "1" ] && [ -f "${COOKBOOK_SYSROOT}/usr/bin/getty" ]; then
+    cp "${COOKBOOK_SYSROOT}/usr/bin/getty" "${COOKBOOK_BUILD}/initfs/bin"
+fi
 
 ARCH="$(echo "${GNU_TARGET}" | cut -d - -f1)"
 RUSTFLAGS="$RUSTFLAGS -Ctarget-feature=+crt-static -Clink-arg=-nostartfiles -Clink-arg=-nostdlib" cargo \