diff --git a/Makefile b/Makefile
index 6c0fd35985808d5cf58248dfffe53df4a1778d87..23df1ae0937168a22efd15edbaff76aa8addc675 100644
--- a/Makefile
+++ b/Makefile
@@ -17,7 +17,7 @@
 	./scripts/run-qemu.sh
 
 check: image
-	./scripts/check-c0.sh
+	./scripts/check-c1.sh
 
 audit: image
 	@printf '%s\n' "static ELF audit passed during the container build"
diff --git a/README.md b/README.md
index 91168a100afba157790e77ac3f06b9d173b1d357..22264dd53c4de9378d9ada89d6049fa41b2d7621 100644
--- a/README.md
+++ b/README.md
@@ -1,9 +1,9 @@
 # MOUSE source tree
 
-This repository currently builds the first MOUSE boot image: Linux 6.18.35 from
-pinned kernel.org source using MOUSE's own x86_64 configuration, a MOUSE-owned
-mini rootfs with ChimeraUtils, and `cheesed` from the sibling repository as
-`/sbin/cheesed`.
+This repository builds the MOUSE C1 boot image: Linux 6.18.35 from pinned
+kernel.org source using MOUSE's own x86_64 configuration, a MOUSE-owned mini
+rootfs with ChimeraUtils and static OpenRC 0.63.3, and `cheesed` from the
+sibling repository as `/sbin/cheesed`.
 
 The mini rootfs is assembled from an explicit file list rather than inheriting
 another distribution's filesystem. The kernel, musl, NetBSD curses, `tcsh`, and
@@ -41,9 +41,11 @@
 verified through `sources.lock`. Before writing the initramfs, the build rejects
 any base ELF executable with an interpreter or dynamic `NEEDED` entry.
 
-`make check` requires `expect`. It boots the image twice under QEMU and verifies
-the C0 banner, PID 1 identity, MOUSE login environment, `clear`, `tcsh` job
-control, orphan reaping, absence of zombies, poweroff, and reboot.
+`make check` requires `expect`. It boots enabled and disabled policy variants
+under QEMU, verifies strict `/etc/rc.conf` translation into disposable
+runlevels, required-service ordering, `supervise-daemon` restart state,
+runtime-only `service` operations, the absence of `rc-update`, and orderly
+OpenRC shutdown before poweroff and reboot.
 
 To select a container frontend explicitly:
 
@@ -61,5 +63,7 @@
 
 ```text
 Cheesed to meet you! v0.1.0
-cheesed: C0 bootstrap complete; cheesed is PID 1
+cheesed: C1 bootstrap complete; cheesed is PID 1
+cheesed: enabled optional services: mouse_optional
+cheesed: OpenRC default transition complete
 ```
diff --git a/patches/openrc-mouse-tool-surface.patch b/patches/openrc-mouse-tool-surface.patch
new file mode 100644
index 0000000000000000000000000000000000000000..4e7232bd3602c9d06d0e52a95ba2fb81bfbb2e17
--- /dev/null
+++ b/patches/openrc-mouse-tool-surface.patch
@@ -1,0 +1,72 @@
+--- a/src/meson.build
++++ b/src/meson.build
+@@ -3,36 +3,20 @@
+ 
+ subdir('librc')
+ subdir('libeinfo')
+ subdir('shared')
+ subdir('checkpath')
+ subdir('einfo')
+ subdir('fstabinfo')
+-subdir('halt')
+-subdir('is_newer_than')
+-subdir('is_older_than')
+-subdir('kill_all')
+ subdir('mark_service')
+ subdir('mountinfo')
+-subdir('on_ac_power')
+ subdir('openrc')
+-subdir('openrc-init')
+ subdir('openrc-run')
+-subdir('openrc-shutdown')
+-subdir('openrc-user')
+-subdir('pam_openrc')
+-subdir('poweroff')
+-subdir('rc-abort')
+ subdir('rc-depend')
+ subdir('rc-service')
+ subdir('rc-sstat')
+ subdir('rc-status')
+-subdir('rc-update')
+-subdir('reboot')
+ subdir('service')
+-subdir('seedrng')
+ subdir('shell_var')
+-subdir('shutdown')
+ subdir('start-stop-daemon')
+ subdir('supervise-daemon')
+-subdir('swclock')
+ subdir('value')
+--- a/sh/init.sh.Linux.in
++++ b/sh/init.sh.Linux.in
+@@ -11,14 +11,14 @@
+ 	done
+ fi
+ 
+-# check for md5sum, and probably /usr too
+-if command -v md5sum >/dev/null; then
+-	got_md5sum=true
++# check for cksum, and probably /usr too
++if command -v cksum >/dev/null; then
++	got_cksum=true
+ else
+-	eerror "md5sum is missing, which suggests /usr is not mounted"
++	eerror "cksum is missing, which suggests /usr is not mounted"
+ 	eerror "If you have separate /usr, it must be mounted by initramfs"
+ 	eerror "If not, you should check coreutils is installed correctly"
+-	got_md5sum=false
++	got_cksum=false
+ fi
+ 
+ # By default VServer already has /proc mounted, but OpenVZ does not!
+@@ -31,9 +31,9 @@
+ mountproc=true
+ f=/proc/self/environ
+ if [ -e $f ]; then
+-	if $got_md5sum && [ "$(VAR=a md5sum $f)" = "$(VAR=b md5sum $f)" ]; then
++	if $got_cksum && [ "$(VAR=a cksum $f)" = "$(VAR=b cksum $f)" ]; then
+ 		eerror "You have cruft in /proc that should be deleted"
+ 	else
+-		# If they don't have md5sum, this will fail in pretty ways if
++		# If they don't have cksum, this will fail in pretty ways if
+ 		# /proc isn't really mounted.  Oh well, their system is busted
diff --git a/rootfs/etc/group b/rootfs/etc/group
index 1dbf9013eeb9dd365f8dd758b61a61a6d49c2d0c..0b0aed46da257785006e68e3302c8765b488b8ea 100644
--- a/rootfs/etc/group
+++ b/rootfs/etc/group
@@ -1,1 +1,2 @@
 root:x:0:
+uucp:x:14:
diff --git a/rootfs/etc/init.d/mouse_optional b/rootfs/etc/init.d/mouse_optional
new file mode 100644
index 0000000000000000000000000000000000000000..22c47ff88361ee366d6126f6a5f77d8d125f8a36
--- /dev/null
+++ b/rootfs/etc/init.d/mouse_optional
@@ -1,0 +1,22 @@
+#!/sbin/openrc-run
+
+description="MOUSE optional C1 proof service"
+supervisor=supervise-daemon
+command=/bin/sleep
+command_args="2147483647"
+respawn_delay=1
+respawn_max=3
+respawn_period=10
+retry="TERM/3/KILL/2"
+
+depend() {
+	need mouse_ready
+}
+
+start_post() {
+	checkpath --file /run/mouse-optional.started
+}
+
+stop_post() {
+	rm -f /run/mouse-optional.started
+}
diff --git a/rootfs/etc/init.d/mouse_ready b/rootfs/etc/init.d/mouse_ready
new file mode 100644
index 0000000000000000000000000000000000000000..d1ad77b846a49fb7872243d5af186b54480b86d6
--- /dev/null
+++ b/rootfs/etc/init.d/mouse_ready
@@ -1,0 +1,15 @@
+#!/sbin/openrc-run
+
+description="MOUSE required C1 proof service"
+
+start() {
+	ebegin "Marking the MOUSE base ready"
+	checkpath --file /run/mouse-ready.started
+	eend $?
+}
+
+stop() {
+	ebegin "Stopping the MOUSE readiness service"
+	rm -f /run/mouse-ready.started
+	eend $?
+}
diff --git a/rootfs/etc/rc.conf b/rootfs/etc/rc.conf
index ee339b781a3aa4f42074afecdaf1b135575f0679..e0086165deab6501e65190a7484f09439be65d3a 100644
--- a/rootfs/etc/rc.conf
+++ b/rootfs/etc/rc.conf
@@ -1,1 +1,2 @@
 # Persistent MOUSE service policy belongs in this file.
+enable_mouse_optional=YES
diff --git a/rootfs/usr/lib/mouse/runlevels/boot/.keep b/rootfs/usr/lib/mouse/runlevels/boot/.keep
new file mode 100644
index 0000000000000000000000000000000000000000..bbc624d194ee8e5c670d48c5f399ecc7b49e25c6
--- /dev/null
+++ b/rootfs/usr/lib/mouse/runlevels/boot/.keep
@@ -1,0 +1,1 @@
+MOUSE defines this runlevel even when it has no required C1 services.
diff --git a/rootfs/usr/lib/mouse/runlevels/default/mouse_ready b/rootfs/usr/lib/mouse/runlevels/default/mouse_ready
new file mode 100644
index 0000000000000000000000000000000000000000..63cade7eb2f2674b7bac74132c2c0c19198855a9
--- /dev/null
+++ b/rootfs/usr/lib/mouse/runlevels/default/mouse_ready
@@ -1,0 +1,1 @@
+Required default-runlevel membership for the C1 readiness service.
diff --git a/rootfs/usr/lib/mouse/runlevels/shutdown/.keep b/rootfs/usr/lib/mouse/runlevels/shutdown/.keep
new file mode 100644
index 0000000000000000000000000000000000000000..bbc624d194ee8e5c670d48c5f399ecc7b49e25c6
--- /dev/null
+++ b/rootfs/usr/lib/mouse/runlevels/shutdown/.keep
@@ -1,0 +1,1 @@
+MOUSE defines this runlevel even when it has no required C1 services.
diff --git a/rootfs/usr/lib/mouse/runlevels/sysinit/.keep b/rootfs/usr/lib/mouse/runlevels/sysinit/.keep
new file mode 100644
index 0000000000000000000000000000000000000000..bbc624d194ee8e5c670d48c5f399ecc7b49e25c6
--- /dev/null
+++ b/rootfs/usr/lib/mouse/runlevels/sysinit/.keep
@@ -1,0 +1,1 @@
+MOUSE defines this runlevel even when it has no required C1 services.
diff --git a/scripts/audit-static-base.sh b/scripts/audit-static-base.sh
index 6e7aa716cfcaf732eefa7d8456565255812e4e88..e36360183f00268ca595e1bc26f7f24c9d243b8e 100755
--- a/scripts/audit-static-base.sh
+++ b/scripts/audit-static-base.sh
@@ -10,6 +10,12 @@
 failed=0
 count=0
 
+if [ -e "$rootfs/usr/bin/rc-update" ] ||
+    [ -e "$rootfs/sbin/rc-update" ]; then
+    printf '%s\n' "forbidden persistent-policy tool in base image: rc-update" >&2
+    exit 1
+fi
+
 while IFS= read -r executable; do
     description=$(file "$executable")
     case "$description" in
diff --git a/scripts/build-image.sh b/scripts/build-image.sh
index 80b387e330d745df8fcabaef86e6f7c2b1669fc8..764b6f114e8ce1b29daefad43c48c3c999dc325a 100755
--- a/scripts/build-image.sh
+++ b/scripts/build-image.sh
@@ -37,12 +37,18 @@
 ln -s usr/bin "$staging/bin"
 ln -s usr/bin "$staging/sbin"
 ln -s bin "$staging/usr/sbin"
+ln -s /run "$staging/var/run"
 
 cp -R "$base_root/." "$staging/"
 install -m 0755 "$cheesed_binary" "$staging/usr/bin/cheesed"
 
 cp -R "$repo_dir/rootfs/." "$staging/"
+find "$staging/usr/lib/mouse/runlevels" -name .keep -delete
 ln -s mouse-release "$staging/etc/os-release"
+chmod 0755 \
+    "$staging/etc/init.d/mouse_optional" \
+    "$staging/etc/init.d/mouse_ready"
+ln -s /run/openrc/runlevels/current "$staging/etc/runlevels"
 
 "$script_dir/audit-static-base.sh" "$staging"
 
diff --git a/scripts/build-static-base.sh b/scripts/build-static-base.sh
index 1dfa59c63ccf2c2a19fb42aa05f37ca90b40d99c..9933e70c811f4ae3a1781a07624a795a5aaabfa8 100755
--- a/scripts/build-static-base.sh
+++ b/scripts/build-static-base.sh
@@ -70,11 +70,15 @@
 extract libxo-1.7.5.tar.gz
 extract tcsh-6.24.16.tar.gz
 extract chimerautils-15.0.3.tar.gz
+extract libcap-2.77.tar.xz
+extract openrc-0.63.3.tar.gz
 
 patch -d "$source_build_dir/tcsh-TCSH6_24_16" -p1 \
     <"$repo_dir/patches/tcsh-gethost-native.patch"
 patch -d "$source_build_dir/chimerautils-15.0.3" -p1 \
     <"$repo_dir/patches/chimerautils-native-cdefs.patch"
+patch -d "$source_build_dir/openrc-0.63.3" -p1 \
+    <"$repo_dir/patches/openrc-mouse-tool-surface.patch"
 
 (
     cd "$source_build_dir/ninja-1.13.1"
@@ -257,6 +261,102 @@
         "prefer_static = true"
 } >"$cross_file"
 
+(
+    cd "$source_build_dir/libcap-2.77"
+    make -s -C libcap -j"$jobs" \
+        CC="$cc" \
+        BUILD_CC="$native_cc" \
+        AR="$llvm_ar" \
+        RANLIB="$ranlib" \
+        SHARED=no \
+        PTHREADS=no \
+        USE_GPERF=no \
+        GOLANG=no \
+        PAM_CAP=no \
+        libcap.a
+    install -d -m 0755 \
+        "$sysroot/usr/include/linux" \
+        "$sysroot/usr/include/sys" \
+        "$sysroot/usr/lib/pkgconfig"
+    install -m 0644 libcap/libcap.a "$sysroot/usr/lib/libcap.a"
+    install -m 0644 \
+        libcap/include/sys/capability.h \
+        "$sysroot/usr/include/sys/capability.h"
+    install -m 0644 \
+        libcap/include/uapi/linux/capability.h \
+        "$sysroot/usr/include/linux/capability.h"
+    sed \
+        -e 's,@prefix@,/usr,' \
+        -e 's,@exec_prefix@,/usr,' \
+        -e 's,@libdir@,/usr/lib,' \
+        -e 's,@includedir@,/usr/include,' \
+        -e 's,@VERSION@,2.77,' \
+        -e 's,@deps@,,' \
+        libcap/libcap.pc.in >"$sysroot/usr/lib/pkgconfig/libcap.pc"
+)
+
+openrc_build="$source_build_dir/openrc-0.63.3/build"
+openrc_install="$static_dir/openrc-install"
+PKG_CONFIG_LIBDIR="$sysroot/usr/lib/pkgconfig:$sysroot/usr/share/pkgconfig" \
+PKG_CONFIG_SYSROOT_DIR="$sysroot" \
+    python3 "$meson_source" setup \
+    "$openrc_build" \
+    "$source_build_dir/openrc-0.63.3" \
+    --cross-file="$cross_file" \
+    --prefix=/usr \
+    --bindir=bin \
+    --sbindir=bin \
+    --libdir=lib \
+    --libexecdir=lib \
+    --sysconfdir=/etc \
+    --buildtype=release \
+    -Daudit=disabled \
+    -Dbash-completions=false \
+    -Dnewnet=false \
+    -Dpam=false \
+    -Dpkgconfig=false \
+    -Dselinux=disabled \
+    -Dsysvinit=false \
+    -Dzsh-completions=false
+PKG_CONFIG_LIBDIR="$sysroot/usr/lib/pkgconfig:$sysroot/usr/share/pkgconfig" \
+PKG_CONFIG_SYSROOT_DIR="$sysroot" \
+    python3 "$meson_source" compile -C "$openrc_build"
+DESTDIR="$openrc_install" \
+    python3 "$meson_source" install -C "$openrc_build"
+
+for command in \
+    openrc openrc-run rc-service rc-sstat rc-status \
+    start-stop-daemon supervise-daemon
+do
+    install -m 0755 \
+        "$openrc_install/usr/bin/$command" \
+        "$base_root/usr/bin/$command"
+done
+ln -s openrc-run "$base_root/usr/bin/runscript"
+ln -s rc-service "$base_root/usr/bin/service"
+
+install -d -m 0755 "$base_root/usr/lib"
+cp -R "$openrc_install/usr/lib/rc" "$base_root/usr/lib/"
+install -d -m 0755 "$base_root/etc/init.d"
+cp -P "$openrc_install/etc/init.d/functions.sh" "$base_root/etc/init.d/functions.sh"
+
+install -d -m 0755 "$base_root/usr/lib/mouse/manifests"
+{
+    printf '%s\n' \
+        /etc/init.d/functions.sh \
+        /usr/bin/openrc \
+        /usr/bin/openrc-run \
+        /usr/bin/rc-service \
+        /usr/bin/rc-sstat \
+        /usr/bin/rc-status \
+        /usr/bin/runscript \
+        /usr/bin/service \
+        /usr/bin/start-stop-daemon \
+        /usr/bin/supervise-daemon
+    find "$base_root/usr/lib/rc" -type f -o -type l |
+        sed "s|^$base_root||"
+} | LC_ALL=C sort >"$base_root/usr/lib/mouse/manifests/openrc.files"
+
 chimerautils_build="$source_build_dir/chimerautils-15.0.3/build"
 PKG_CONFIG_LIBDIR="$sysroot/usr/lib/pkgconfig:$sysroot/usr/share/pkgconfig" \
 PKG_CONFIG_SYSROOT_DIR="$sysroot" \
@@ -277,7 +377,7 @@
     -Dchimera_realpath=disabled
 
 commands="
-cat chmod chown cp date dd df echo env find grep head hostname id kill
+cat chmod chown cksum cp date dd df echo env find grep head hostname id kill
 ls mkdir mv pwd realpath rm rmdir sed sh sleep stat stty sync tail touch
 tty uname wc
 "
@@ -286,6 +386,7 @@
 src.freebsd/coreutils/cat/cat
 src.freebsd/coreutils/chmod/chmod
 src.freebsd/coreutils/chown/chown
+src.freebsd/coreutils/cksum/cksum
 src.freebsd/coreutils/cp/cp
 src.freebsd/coreutils/date/date
 src.freebsd/coreutils/dd/dd
diff --git a/scripts/check-c1.exp b/scripts/check-c1.exp
new file mode 100755
index 0000000000000000000000000000000000000000..d05d6fff01692b8b4548adb0f7a667c4b2850265
--- /dev/null
+++ b/scripts/check-c1.exp
@@ -1,0 +1,130 @@
+#!/usr/bin/expect -f
+
+if {$argc != 2} {
+    puts stderr "usage: check-c1.exp RUNNER enabled|disabled"
+    exit 2
+}
+
+set runner [file normalize [lindex $argv 0]]
+set policy [lindex $argv 1]
+set timeout 45
+
+proc fail {message} {
+    puts stderr "C1 check failed: $message"
+    exit 1
+}
+
+proc await_exact {text description} {
+    expect {
+        -exact $text {
+            return
+        }
+        timeout {
+            fail "timed out waiting for $description"
+        }
+        eof {
+            fail "QEMU exited while waiting for $description"
+        }
+    }
+}
+
+proc await_clean_exit {action} {
+    expect {
+        eof {
+            set result [wait]
+            set status [lindex $result 3]
+            if {$status != 0} {
+                fail "QEMU exited with status $status after $action"
+            }
+        }
+        timeout {
+            fail "QEMU did not exit after $action"
+        }
+    }
+}
+
+spawn -noecho $runner
+await_exact "Cheesed to meet you! v0.1.0" "the cheesed startup banner"
+await_exact "cheesed: C1 bootstrap complete; cheesed is PID 1" "PID 1 confirmation"
+
+if {$policy eq "enabled"} {
+    await_exact "cheesed: enabled optional services: mouse_optional" "enabled-service policy"
+} elseif {$policy eq "disabled"} {
+    await_exact "cheesed: enabled optional services: (none)" "disabled-service policy"
+} else {
+    fail "unknown policy $policy"
+}
+
+await_exact "cheesed: generated OpenRC runlevels at /run/openrc/runlevels/generations/1" "the generated runlevel"
+await_exact "cheesed: OpenRC sysinit transition complete" "the sysinit transition"
+await_exact "cheesed: OpenRC boot transition complete" "the boot transition"
+await_exact "Marking the MOUSE base ready" "the required service"
+if {$policy eq "enabled"} {
+    await_exact "Starting mouse_optional" "the optional service after its dependency"
+}
+await_exact "cheesed: OpenRC default transition complete" "the default transition"
+await_exact "MOUSE 0.1.0 (x86_64)" "the MOUSE login banner"
+await_exact "mouse:~# " "the tcsh prompt"
+
+send -- "cat /proc/1/comm\r"
+await_exact "cheesed\r" "cheesed in /proc/1"
+await_exact "mouse:~# " "the prompt after the PID 1 check"
+
+send -- "sh -c 'test -f /run/mouse-ready.started'; echo READY_\$status\r"
+await_exact "READY_0\r" "the required service marker"
+await_exact "mouse:~# " "the prompt after the required service check"
+
+send -- "sh -c 'test -L /etc/runlevels'; echo RUNLEVELS_\$status\r"
+await_exact "RUNLEVELS_0\r" "the immutable runlevel link"
+await_exact "mouse:~# " "the prompt after the runlevel-link check"
+
+send -- "sh -c 'test ! -e /sbin/rc-update'; echo NO_RC_UPDATE_\$status\r"
+await_exact "NO_RC_UPDATE_0\r" "the absence of rc-update"
+await_exact "mouse:~# " "the prompt after the rc-update check"
+
+if {$policy eq "enabled"} {
+    send -- "sh -c 'test -f /run/mouse-optional.started'; echo OPTIONAL_\$status\r"
+    await_exact "OPTIONAL_0\r" "the optional service marker"
+    await_exact "mouse:~# " "the prompt after the optional marker check"
+
+    send -- "service mouse_optional status\r"
+    await_exact "status: started" "supervise-daemon service status"
+    await_exact "mouse:~# " "the prompt after service status"
+
+    send -- "sh -c 'old_child=`cat /run/openrc/options/mouse_optional/child_pid`; kill -TERM \"\$old_child\"; sleep 3; new_child=`cat /run/openrc/options/mouse_optional/child_pid`; test \"\$old_child\" != \"\$new_child\"'; echo RESPAWN_\$status\r"
+    await_exact "RESPAWN_0\r" "supervise-daemon replacing a terminated child"
+    await_exact "mouse:~# " "the prompt after the respawn check"
+
+    send -- "sh -c 'test `cat /run/openrc/options/mouse_optional/start_count` = 1'; echo COUNT_\$status\r"
+    await_exact "COUNT_0\r" "the recorded supervisor restart count"
+    await_exact "mouse:~# " "the prompt after the restart-count check"
+
+    send -- "set before=\"`cksum /etc/rc.conf`\"; service mouse_optional stop\r"
+    await_exact "Stopping mouse_optional" "the runtime service stop"
+    await_exact "mouse:~# " "the prompt after stopping the service"
+    send -- "service mouse_optional start\r"
+    await_exact "Starting mouse_optional" "the runtime service start"
+    await_exact "mouse:~# " "the prompt after starting the service"
+    send -- "set after=\"`cksum /etc/rc.conf`\"; sh -c 'test \"\$1\" = \"\$2\"' sh \"\$before\" \"\$after\"; echo POLICY_\$status\r"
+    await_exact "POLICY_0\r" "runtime service control preserving boot policy"
+    await_exact "mouse:~# " "the prompt after the policy check"
+
+    send -- "kill -TERM 1\r"
+    await_exact "cheesed: received poweroff request" "the poweroff request"
+    await_exact "cheesed: OpenRC shutdown transition complete" "the shutdown transition"
+    await_clean_exit "poweroff"
+} else {
+    send -- "sh -c 'test ! -e /run/mouse-optional.started'; echo OPTIONAL_DISABLED_\$status\r"
+    await_exact "OPTIONAL_DISABLED_0\r" "the disabled optional service"
+    await_exact "mouse:~# " "the prompt after the disabled service check"
+    send -- "service mouse_optional status\r"
+    await_exact "status: stopped" "the disabled service status"
+    await_exact "mouse:~# " "the prompt after disabled service status"
+
+    send -- "kill -INT 1\r"
+    await_exact "cheesed: received reboot request" "the reboot request"
+    await_exact "cheesed: OpenRC shutdown transition complete" "the shutdown transition"
+    await_clean_exit "reboot"
+}
+
+puts "C1 QEMU integration check passed for $policy policy"
diff --git a/scripts/check-c1.sh b/scripts/check-c1.sh
new file mode 100755
index 0000000000000000000000000000000000000000..d6c73752b057e051af5889639fe4fe317e496edf
--- /dev/null
+++ b/scripts/check-c1.sh
@@ -1,0 +1,41 @@
+#!/bin/sh
+set -eu
+
+script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+repo_dir=$(dirname "$script_dir")
+build_dir=${MOUSE_BUILD_DIR:-"$repo_dir/build"}
+image="$build_dir/mouse-initramfs.cpio.gz"
+
+for command in expect cpio gzip; do
+    if ! command -v "$command" >/dev/null 2>&1; then
+        printf '%s\n' "$command is required for the C1 integration check" >&2
+        exit 1
+    fi
+done
+
+if [ ! -f "$image" ]; then
+    printf '%s\n' "run 'make image' before checking MOUSE" >&2
+    exit 1
+fi
+
+"$script_dir/check-c1.exp" "$script_dir/run-qemu.sh" enabled
+
+temporary=$(mktemp -d "${TMPDIR:-/tmp}/mouse-c1-check.XXXXXX")
+trap 'rm -rf "$temporary"' EXIT HUP INT TERM
+root="$temporary/root"
+disabled_image="$temporary/mouse-initramfs-disabled.cpio.gz"
+mkdir "$root"
+gzip -dc "$image" | (cd "$root" && cpio -id 2>/dev/null)
+printf '%s\n' \
+    '# MOUSE service enablement policy.' \
+    'enable_mouse_optional=NO' >"$root/etc/rc.conf"
+(
+    cd "$root"
+    find . -print |
+        LC_ALL=C sort |
+        cpio -o --format newc -R 0:0 2>/dev/null |
+        gzip -9
+) >"$disabled_image"
+
+MOUSE_INITRAMFS="$disabled_image" \
+    "$script_dir/check-c1.exp" "$script_dir/run-qemu.sh" disabled
diff --git a/scripts/run-qemu.sh b/scripts/run-qemu.sh
index 8bc36b8053359fbec8033988cdd9baf7ca41a755..43d29780b60830a9752f996615d920035ee7967c 100755
--- a/scripts/run-qemu.sh
+++ b/scripts/run-qemu.sh
@@ -5,6 +5,7 @@
 repo_dir=$(dirname "$script_dir")
 build_dir=${MOUSE_BUILD_DIR:-"$repo_dir/build"}
 kernel_args=${MOUSE_KERNEL_ARGS:-"console=ttyS0 rdinit=/sbin/cheesed panic=-1"}
+initramfs=${MOUSE_INITRAMFS:-"$build_dir/mouse-initramfs.cpio.gz"}
 local_qemu="$build_dir/tools/qemu/bin/qemu-system-x86_64"
 local_lib="$build_dir/tools/deps/lib"
 
@@ -34,7 +35,7 @@
 esac
 
 if [ ! -f "$build_dir/vmlinuz-virt" ] ||
-    [ ! -f "$build_dir/mouse-initramfs.cpio.gz" ]; then
+    [ ! -f "$initramfs" ]; then
     printf '%s\n' "run 'make image' before booting MOUSE" >&2
     exit 1
 fi
@@ -47,5 +48,5 @@
     -display none \
     -nographic \
     -kernel "$build_dir/vmlinuz-virt" \
-    -initrd "$build_dir/mouse-initramfs.cpio.gz" \
+    -initrd "$initramfs" \
     -append "$kernel_args"
diff --git a/sources.lock b/sources.lock
index d9178c140bc1ba909420db8ea8dcb47b1d765f81..d178f4f1ef04f66c97bd8799f2a8e3c7602037ba 100644
--- a/sources.lock
+++ b/sources.lock
@@ -14,3 +14,5 @@
 febaa8f7c1916521c53eb5fd11c0641b5eb4741c2c6e9b42c288ed62d9e4fd2c https://github.com/mesonbuild/meson/archive/refs/tags/1.9.1.tar.gz meson-1.9.1.tar.gz
 f0055ad0369bf2e372955ba55128d000cfcc21777057806015b45e4accbebf23 https://github.com/ninja-build/ninja/archive/refs/tags/v1.13.1.tar.gz ninja-1.13.1.tar.gz
 79721badcad1987dead9c3609eb4877ab9b58821c06bdacb824f2c8897c11f2a https://github.com/pkgconf/pkgconf/archive/refs/tags/pkgconf-2.5.1.tar.gz pkgconf-2.5.1.tar.gz
+897bc18b44afc26c70e78cead3dbb31e154acc24bee085a5a09079a88dbf6f52 https://mirrors.edge.kernel.org/pub/linux/libs/security/linux-privs/libcap2/libcap-2.77.tar.xz libcap-2.77.tar.xz
+f5bc2257f22ca7f0920a12698ad1e8f85a0f91a90e8e83106611514ea409b8ec https://github.com/OpenRC/openrc/archive/refs/tags/0.63.3.tar.gz openrc-0.63.3.tar.gz
