diff --git a/config/includes.chroot/usr/lib/live/boot/0042-ciss-post-decrypt-attest b/config/includes.chroot/etc/initramfs-tools/scripts/live-bottom/0042-ciss-post-decrypt-attest
similarity index 96%
rename from config/includes.chroot/usr/lib/live/boot/0042-ciss-post-decrypt-attest
rename to config/includes.chroot/etc/initramfs-tools/scripts/live-bottom/0042-ciss-post-decrypt-attest
index d07dbba..4cb0521 100644
--- a/config/includes.chroot/usr/lib/live/boot/0042-ciss-post-decrypt-attest
+++ b/config/includes.chroot/etc/initramfs-tools/scripts/live-bottom/0042-ciss-post-decrypt-attest
@@ -21,7 +21,7 @@ _SAVED_SET_OPTS="$(set +o)"
 
 set -eu
 
-printf "\e[95m[INFO] Starting            : [/usr/lib/live/boot/0042-ciss-post-decrypt-attest] \n\e[0m"
+printf "\e[95m[INFO] Starting             : [/usr/lib/live/boot/0042-ciss-post-decrypt-attest] \n\e[0m"
 
 ### Declare variables ----------------------------------------------------------------------------------------------------------
 
@@ -178,6 +178,6 @@ fi
 
 eval "${_SAVED_SET_OPTS}"
 
-printf "\e[92m[INFO] Successfully applied: [/usr/lib/live/boot/0042-ciss-post-decrypt-attest]\n\e[0m"
+printf "\e[92m[INFO] Successfully applied : [/usr/lib/live/boot/0042-ciss-post-decrypt-attest]\n\e[0m"
 
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
diff --git a/config/includes.chroot/usr/lib/live/boot/0022-ciss-overlay-tmpfs b/config/includes.chroot/usr/lib/live/boot/0022-ciss-overlay-tmpfs
index c2d711d..366ebe7 100644
--- a/config/includes.chroot/usr/lib/live/boot/0022-ciss-overlay-tmpfs
+++ b/config/includes.chroot/usr/lib/live/boot/0022-ciss-overlay-tmpfs
@@ -23,7 +23,7 @@ set -eu
 
 sleep 3
 
-printf "\e[95m[INFO] Starting            : [/usr/lib/live/boot/0022-ciss-overlay-tmpfs.sh] \n\e[0m"
+printf "\e[95m[INFO] Starting             : [/usr/lib/live/boot/0022-ciss-overlay-tmpfs.sh] \n\e[0m"
 
 ### Declare variables ----------------------------------------------------------------------------------------------------------
 OVERLAY_BASE="/run/live/overlay"
@@ -47,6 +47,6 @@ mkdir -p -m 0700 "${UPPER}" "${WORK}"
 
 eval "${_SAVED_SET_OPTS}"
 
-printf "\e[92m[INFO] Successfully applied: [/usr/lib/live/boot/0022-ciss-overlay-tmpfs.sh] \n\e[0m"
+printf "\e[92m[INFO] Successfully applied : [/usr/lib/live/boot/0022-ciss-overlay-tmpfs.sh] \n\e[0m"
 
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
diff --git a/config/includes.chroot/usr/lib/live/boot/0024-ciss-crypt-squash b/config/includes.chroot/usr/lib/live/boot/0024-ciss-crypt-squash
index aff03e9..fbb0154 100644
--- a/config/includes.chroot/usr/lib/live/boot/0024-ciss-crypt-squash
+++ b/config/includes.chroot/usr/lib/live/boot/0024-ciss-crypt-squash
@@ -21,7 +21,7 @@ _SAVED_SET_OPTS="$(set +o)"
 
 set -eu
 
-printf "\e[95m[INFO] Starting            : [/usr/lib/live/boot/0024-ciss-crypt-squash] \n\e[0m"
+printf "\e[95m[INFO] Starting             : [/usr/lib/live/boot/0024-ciss-crypt-squash] \n\e[0m"
 
 #######################################
 # Ask for a passphrase on /dev/console, mask input with '*'.
@@ -37,6 +37,76 @@ ask_pass_console() {
   PASSPHRASE=""
   SAVED_STTY=""
 
+  ### Save current console settings.
+  SAVED_STTY=$(stty -g </dev/console 2>/dev/null || printf '')
+
+  ### Non-canonical mode, no echo, 1 byte at a time.
+  stty -echo -icanon time 0 min 1 </dev/console 2>/dev/null || return 1
+
+  printf '\e[93m[INFO] Enter LUKS passphrase: \e[0m' > /dev/console
+
+  nl=$(printf '\n')
+  cr=$(printf '\r')
+  bs=$(printf '\b')
+  del=$(printf '\177')
+
+  while :; do
+
+    ### Read exactly one byte from the console.
+    c=$(dd bs=1 count=1 2>/dev/null </dev/console)
+
+    ### If nothing read (race), loop again.
+    [ -z "${c}" ] && continue
+
+    case "${c}" in
+
+      "${nl}"|"${cr}")
+        ### Enter: finish input.
+        printf '\n' > /dev/console
+        break
+        ;;
+
+      "${bs}"|"${del}")
+        ### Backspace, delete: delete one character, if available.
+        if [ -n "${PASSPHRASE}" ]; then
+
+          PASSPHRASE=${PASSPHRASE%?}
+          printf '\b \b' > /dev/console
+
+        fi
+        ;;
+
+      *)
+        ### Normal character: append and mask output.
+        PASSPHRASE="${PASSPHRASE}${c}"
+        printf '*' > /dev/console
+        ;;
+
+    esac
+
+  done
+
+  [ -n "${SAVED_STTY}" ] && stty "${SAVED_STTY}" </dev/console 2>/dev/null || :
+
+  printf '%s' "${PASSPHRASE}"
+
+  return 0
+}
+
+#######################################
+# Ask for a passphrase on /dev/console, mask input with '*'.
+# Globals:
+#   None
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+#   1: on failure / empty
+#######################################
+ask_pass_console_old() {
+  PASSPHRASE=""
+  SAVED_STTY=""
+
   if command -v stty >/dev/null 2>&1; then
 
     SAVED_STTY="$(stty -g </dev/console 2>/dev/null || printf '')"
@@ -118,8 +188,8 @@ for _PARAMETER in ${CMDLINE}; do
 
 done
 
-printf "\e[92m[INFO] CDLB_LUKS_FS   : [%s] \n\e[0m" "${CDLB_LUKS_FS}"
-printf "\e[92m[INFO] CDLB_ISO_LABEL : [%s] \n\e[0m" "${CDLB_ISO_LABEL}"
+printf "\e[92m[INFO] CDLB_LUKS_FS         : [%s] \n\e[0m" "${CDLB_LUKS_FS}"
+printf "\e[92m[INFO] CDLB_ISO_LABEL       : [%s] \n\e[0m" "${CDLB_ISO_LABEL}"
 
 mkdir -p "${MNT_MEDIUM}" "${MNT_ROOTFS}"
 
@@ -167,7 +237,7 @@ if ! mountpoint -q "${MNT_MEDIUM}"; then
 
 fi
 
-printf "\e[92m[INFO] MNT_MEDIUM     : [%s] \n\e[0m" "${MNT_MEDIUM}"
+printf "\e[92m[INFO] MNT_MEDIUM           : [%s] \n\e[0m" "${MNT_MEDIUM}"
 
 ### Locate the encrypted root container on the medium. -------------------------------------------------------------------------
 if [ ! -f "${MNT_MEDIUM}${CDLB_LUKS_FS}" ]; then
@@ -178,12 +248,12 @@ if [ ! -f "${MNT_MEDIUM}${CDLB_LUKS_FS}" ]; then
 
 fi
 
-printf "\e[92m[INFO] CISS LUKS FS   : [%s%s] \n\e[0m" "${MNT_MEDIUM}" "${CDLB_LUKS_FS}"
+printf "\e[92m[INFO] CISS LUKS FS         : [%s%s] \n\e[0m" "${MNT_MEDIUM}" "${CDLB_LUKS_FS}"
 
 ### Attach a loop device read-only to the encrypted file. ----------------------------------------------------------------------
 LOOP="$(losetup -f --show -r "${MNT_MEDIUM}${CDLB_LUKS_FS}")" || { log "losetup failed"; exit 42; }
 
-printf "\e[92m[INFO] Loop device    : [%s] \n\e[0m" "${LOOP}"
+printf "\e[92m[INFO] Loop device          : [%s] \n\e[0m" "${LOOP}"
 
 ### Expose the loop device for unlock-wrapper.sh, dropbear forced-command. -----------------------------------------------------
 mkdir -p /run 2>/dev/null || true
@@ -192,7 +262,7 @@ echo "${LOOP}" > /run/ciss-loopdev 2>/dev/null || true
 
 chmod 0600 /run/ciss-loopdev 2>/dev/null || true
 
-printf "\e[92m[INFO] Exposed LOOP   : [/run/ciss-loopdev] -> [%s]\n\e[0m" "${LOOP}"
+printf "\e[92m[INFO] Exposed LOOP         : [/run/ciss-loopdev] -> [%s]\n\e[0m" "${LOOP}"
 
 ### Prepare fifo for passphrase. -----------------------------------------------------------------------------------------------
 mkdir -p /lib/cryptsetup 2>/dev/null || true
@@ -235,7 +305,7 @@ chmod 0600 /lib/cryptsetup/passfifo 2>/dev/null || true
 
     [ -n "${PASS}" ] || continue
 
-    printf "\e[93m[INFO] Trying to unlock via cryptsetup ...\n\e[0m" >/dev/console 2>/dev/null || true
+    printf "\e[93m[INFO] LUKS mapper [%s] trying to unlock via cryptsetup ... \n\e[0m" "${CDLB_MAPPER_DEV}" >/dev/console 2>/dev/null || true
 
     KEYLEN=${#PASS}
 
@@ -246,7 +316,7 @@ chmod 0600 /lib/cryptsetup/passfifo 2>/dev/null || true
 
     if [ -b "${CDLB_MAPPER_DEV}" ]; then
 
-      printf "\e[92m[INFO] LUKS mapper [%s] successfully opened.\n\e[0m" "${CDLB_MAPPER_DEV}" >/dev/console 2>/dev/null || true
+      printf "\e[92m[INFO] LUKS mapper [%s] successfully opened. \n\e[0m" "${CDLB_MAPPER_DEV}" >/dev/console 2>/dev/null || true
       break
 
     fi
@@ -293,7 +363,7 @@ REMAINING="${CDLB_REMOTE_WAIT_SECS}"
 
 if [ ! -b "${CDLB_MAPPER_DEV}" ]; then
 
-  printf "\e[93m[INFO] Waiting up to %s seconds for [%s] to be unlocked ...\n\e[0m" "${REMAINING}" "${CDLB_MAPPER_DEV}"
+  printf "\e[93m[INFO] Waiting up to %s seconds for [%s] to be unlocked ... \n\e[0m" "${REMAINING}" "${CDLB_MAPPER_DEV}"
 
 fi
 
@@ -325,7 +395,7 @@ kill "${PID_PROMPT}" 2>/dev/null || true
 wait "${PID_BROKER}" 2>/dev/null || true
 rm -f /lib/cryptsetup/passfifo 2>/dev/null || true
 
-printf "\e[92m[INFO] LUKS mapper    : [%s] is now present.\n\e[0m" "${CDLB_MAPPER_DEV}"
+printf "\e[92m[INFO] LUKS mapper          : [%s] is now present.\n\e[0m" "${CDLB_MAPPER_DEV}"
 
 ### Expose the decrypted root device for live-boot overlay. The live-boot components will pick this up in '9990-overlay.sh'. ---
 echo "${CDLB_MAPPER_DEV}" >| /run/ciss-rootdev
@@ -340,13 +410,13 @@ printf "\e[92m[INFO] Decrypted root device exposed at: [/run/ciss-rootdev] -> [%
 if [ ! -b "${CDLB_MAPPER_DEV}" ]; then
 
   log "Failed to unlock encrypted root [${CDLB_LUKS_FS}] via dropbear and console."
-  printf "\e[91m[WARN] Failed unlock  : [%s] via dropbear and console. \n\e[0m" "${CDLB_LUKS_FS}"
+  printf "\e[91m[WARN] Failed unlock        : [%s] via dropbear and console. \n\e[0m" "${CDLB_LUKS_FS}"
   exit 42
 
 fi
 
 eval "${_SAVED_SET_OPTS}"
 
-printf "\e[92m[INFO] Successfully applied: [/usr/lib/live/boot/0024-ciss-crypt-squash] \n\e[0m"
+printf "\e[92m[INFO] Successfully applied : [/usr/lib/live/boot/0024-ciss-crypt-squash] \n\e[0m"
 
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
diff --git a/config/includes.chroot/usr/lib/live/boot/0026-ciss-early-sysctl b/config/includes.chroot/usr/lib/live/boot/0026-ciss-early-sysctl
index eab9bb0..cfaf2f6 100644
--- a/config/includes.chroot/usr/lib/live/boot/0026-ciss-early-sysctl
+++ b/config/includes.chroot/usr/lib/live/boot/0026-ciss-early-sysctl
@@ -21,7 +21,7 @@ _SAVED_SET_OPTS="$(set +o)"
 
 set -eu
 
-printf "\e[95m[INFO] Starting            : [/usr/lib/live/boot/0026-ciss-early-sysctl.sh] \n\e[0m"
+printf "\e[95m[INFO] Starting             : [/usr/lib/live/boot/0026-ciss-early-sysctl.sh] \n\e[0m"
 
 echo 2 > /proc/sys/kernel/yama/ptrace_scope 2>/dev/null || true
 echo 1 > /proc/sys/kernel/unprivileged_bpf_disabled 2>/dev/null || true
@@ -34,6 +34,6 @@ echo 2 > /proc/sys/kernel/kptr_restrict 2>/dev/null || true
 
 eval "${_SAVED_SET_OPTS}"
 
-printf "\e[92m[INFO] Successfully applied: [/usr/lib/live/boot/0026-ciss-early-sysctl.sh] \n\e[0m"
+printf "\e[92m[INFO] Successfully applied : [/usr/lib/live/boot/0026-ciss-early-sysctl.sh] \n\e[0m"
 
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
diff --git a/config/includes.chroot/usr/lib/live/boot/0030-ciss-verify-checksums b/config/includes.chroot/usr/lib/live/boot/0030-ciss-verify-checksums
index 8a0ab92..32b9f03 100644
--- a/config/includes.chroot/usr/lib/live/boot/0030-ciss-verify-checksums
+++ b/config/includes.chroot/usr/lib/live/boot/0030-ciss-verify-checksums
@@ -29,7 +29,7 @@
 #   0 : Successful verification
 #######################################
 Verify_checksums() {
-  printf "\e[95m[INFO] Starting            : [/usr/lib/live/boot/0030-ciss-verify-checksums] \n\e[0m"
+  printf "\e[95m[INFO] Starting             : [/usr/lib/live/boot/0030-ciss-verify-checksums] \n\e[0m"
 
   ### Declare variables --------------------------------------------------------------------------------------------------------
 
diff --git a/config/includes.chroot/usr/lib/live/boot/9990-main.sh b/config/includes.chroot/usr/lib/live/boot/9990-main.sh
index 55c1568..6a259e1 100644
--- a/config/includes.chroot/usr/lib/live/boot/9990-main.sh
+++ b/config/includes.chroot/usr/lib/live/boot/9990-main.sh
@@ -20,11 +20,11 @@
 
 # set -e
 
-printf "\e[95m[INFO] Sourcing            : [/usr/lib/live/boot/9990-main.sh] \n\e[0m"
+printf "\e[95m[INFO] Sourcing             : [/usr/lib/live/boot/9990-main.sh] \n\e[0m"
 
 Live ()
 {
-  printf "\e[95m[INFO] Starting            : [/usr/lib/live/boot/9990-main.sh] \n\e[0m"
+  printf "\e[95m[INFO] Starting             : [/usr/lib/live/boot/9990-main.sh] \n\e[0m"
 
   if [ -x /scripts/local-top/cryptroot ]
   then
@@ -252,5 +252,5 @@ Live ()
     cp boot.log "${rootmnt}/var/log/live" 2>/dev/null; \
     cp fsck.log "${rootmnt}/var/log/live" 2>/dev/null )
 
-  printf "\e[92m[INFO] Successfully applied: [/usr/lib/live/boot/9990-main.sh] ... \n\e[0m"
+  printf "\e[92m[INFO] Successfully applied : [/usr/lib/live/boot/9990-main.sh] ... \n\e[0m"
 }
diff --git a/config/includes.chroot/usr/lib/live/boot/9990-overlay.sh b/config/includes.chroot/usr/lib/live/boot/9990-overlay.sh
index 70c2c31..707d86d 100644
--- a/config/includes.chroot/usr/lib/live/boot/9990-overlay.sh
+++ b/config/includes.chroot/usr/lib/live/boot/9990-overlay.sh
@@ -24,7 +24,7 @@ printf "\e[95m[INFO] Sourcing            : [/usr/lib/live/boot/9990-overlay.sh]
 
 setup_unionfs ()
 {
-  printf "\e[95m[INFO] Starting            : [/usr/lib/live/boot/9990-overlay.sh] \n\e[0m"
+  printf "\e[95m[INFO] Starting             : [/usr/lib/live/boot/9990-overlay.sh] \n\e[0m"
 
   image_directory="${1}"
   rootmnt="${2}"
@@ -495,5 +495,5 @@ setup_unionfs ()
     done
   fi
 
-  printf "\e[92m[INFO] Successfully applied: [/usr/lib/live/boot/9990-overlay.sh] ... \n\e[0m"
+  printf "\e[92m[INFO] Successfully applied : [/usr/lib/live/boot/9990-overlay.sh] ... \n\e[0m"
 }
diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 7f16278..105ce5d 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -18,7 +18,7 @@ include_toc: true
 * **Bugfixes**: [0024-ciss-crypt-squash](../config/includes.chroot/usr/lib/live/boot/0024-ciss-crypt-squash)
 * **Bugfixes**: [0026-ciss-early-sysctl](../config/includes.chroot/usr/lib/live/boot/0026-ciss-early-sysctl)
 * **Bugfixes**: [0030-ciss-verify-checksums](../config/includes.chroot/usr/lib/live/boot/0030-ciss-verify-checksums)
-* **Bugfixes**: [0042-ciss-post-decrypt-attest](../config/includes.chroot/usr/lib/live/boot/0042-ciss-post-decrypt-attest)
+* **Bugfixes**: [0042-ciss-post-decrypt-attest](../config/includes.chroot/etc/initramfs-tools/scripts/live-bottom/0042-ciss-post-decrypt-attest)
 
 ## V8.13.432.2025.11.18
 * **Bugfixes**: [0003_cdi_autostart.chroot](../config/hooks/live/0003_cdi_autostart.chroot)
@@ -34,7 +34,7 @@ include_toc: true
 * **Added**: [0022-ciss-overlay-tmpfs.sh](../config/includes.chroot/usr/lib/live/boot/0022-ciss-overlay-tmpfs) + Pre-create constrained tmpfs for OverlayFS upper/work before live-boot mounts overlay.
 * **Added**: [0024-ciss-crypt-squash](../config/includes.chroot/usr/lib/live/boot/0024-ciss-crypt-squash) + Open ``/live/ciss_rootfs.crypt`` (LUKS) and present its SquashFS as ``/run/live/rootfs``.
 * **Added**: [0026-ciss-early-sysctl.sh](../config/includes.chroot/usr/lib/live/boot/0026-ciss-early-sysctl) + Enforce early sysctls before services start.
-* **Added**: [0042-ciss-post-decrypt-attest](../config/includes.chroot/usr/lib/live/boot/0042-ciss-post-decrypt-attest) + Late rootfs attestation and dmsetup health checking.
+* **Added**: [0042-ciss-post-decrypt-attest](../config/includes.chroot/etc/initramfs-tools/scripts/live-bottom/0042-ciss-post-decrypt-attest) + Late rootfs attestation and dmsetup health checking.
 * **Added**: [MAN_CISS_ISO_BOOT_CHAIN.md](MAN_CISS_ISO_BOOT_CHAIN.md)
 * **Added**: [lib_ciss_signatures.sh](../lib/lib_ciss_signatures.sh) + integrated dynamic GPG FPR injection.
 * **Bugfixes**: [0021_dropbear_initramfs.chroot](../config/hooks/live/0021_dropbear_initramfs.chroot) + mv original files to a safe backup location.