diff --git a/.github/workflows/build-41.yml b/.github/workflows/build-41.yml
new file mode 100644
index 00000000..c0e4ffac
--- /dev/null
+++ b/.github/workflows/build-41.yml
@@ -0,0 +1,15 @@
+name: ublue main 41
+on:
+  pull_request:
+  merge_group:
+  schedule:
+    - cron: '5 4 * * *'  # 4am-ish UTC everyday (timed against official fedora container pushes)
+  workflow_dispatch:
+
+jobs:
+  build:
+    name: build
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    with:
+      fedora_version: 41
\ No newline at end of file
diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml
index 6be76ecf..9831a72a 100644
--- a/.github/workflows/reusable-build.yml
+++ b/.github/workflows/reusable-build.yml
@@ -63,14 +63,17 @@ jobs:
             IS_LATEST_VERSION=false
             IS_STABLE_VERSION=true
             IS_GTS_VERSION=true
+            IS_BETA_VERSION=false
           elif [[ "${{ matrix.fedora_version }}" -eq "40" ]]; then
             IS_LATEST_VERSION=true
             IS_STABLE_VERSION=true
             IS_GTS_VERSION=false
+            IS_BETA_VERSION=false
           elif [[ "${{ matrix.fedora_version }}" -eq "41" ]]; then
             IS_LATEST_VERSION=false
             IS_STABLE_VERSION=false
             IS_GTS_VERSION=false
+            IS_BETA_VERSION=true
           fi
 
           COMMIT_TAGS=()
@@ -103,6 +106,10 @@ jobs:
               BUILD_TAGS+=("gts-${TIMESTAMP}")
               BUILD_TAGS+=("gts")
               echo "DEFAULT_TAG=gts" >> $GITHUB_ENV
+          elif [[ "${IS_BETA_VERSION}" == "true" ]]; then
+              BUILD_TAGS+=("beta-${TIMESTAMP}")
+              BUILD_TAGS+=("beta")
+              echo "DEFAULT_TAG=beta" >> $GITHUB_ENV
           fi
 
           if [[ "${{ github.event_name }}" == "pull_request" ]]; then
diff --git a/install.sh b/install.sh
index 02dcbf95..d09d96ed 100755
--- a/install.sh
+++ b/install.sh
@@ -40,10 +40,8 @@ sed -i '0,/enabled=1/{s/enabled=1/enabled=1\npriority=90/}' /etc/yum.repos.d/neg
 rpm-ostree override replace \
   --experimental \
   --from repo='fedora-multimedia' \
-    libheif \
     libva \
     libva-intel-media-driver \
-    libvdpau \
     mesa-dri-drivers \
     mesa-filesystem \
     mesa-libEGL \
@@ -54,12 +52,26 @@ rpm-ostree override replace \
     mesa-va-drivers \
     mesa-vulkan-drivers
 
+if [[ "$FEDORA_MAJOR_VERSION" -ne "41" ]]; then
+    rpm-ostree override replace \
+        --experimental \
+        --from repo='fedora-multimedia' \
+        libheif \
+        libvdpau
+fi
+
 # run common packages script
 /ctx/packages.sh
 
 ## install packages direct from github
 /ctx/github-release-install.sh sigstore/cosign x86_64
 
+# use CoreOS' generator for emergency/rescue boot
+# see detail: https://github.com/ublue-os/main/issues/653
+CSFG=/usr/lib/systemd/system-generators/coreos-sulogin-force-generator
+curl -sSLo ${CSFG} https://raw.githubusercontent.com/coreos/fedora-coreos-config/refs/heads/stable/overlay.d/05core/usr/lib/systemd/system-generators/coreos-sulogin-force-generator
+chmod +x ${CSFG}
+
 if [[ "${KERNEL_VERSION}" == "${QUALIFIED_KERNEL}" ]]; then
     /ctx/initramfs.sh
 fi
diff --git a/packages.json b/packages.json
index da670699..abe66092 100644
--- a/packages.json
+++ b/packages.json
@@ -20,7 +20,6 @@
                 "grub2-tools-extra",
                 "heif-pixbuf-loader",
                 "htop",
-                "intel-vaapi-driver",
                 "just",
                 "kernel-tools",
                 "libcamera",
@@ -40,7 +39,6 @@
                 "pam-u2f",
                 "pam_yubico",
                 "pamu2fcfg",
-                "pipewire-libs-extra",
                 "pipewire-plugin-libcamera",
                 "powerstat",
                 "smartmontools",
@@ -92,7 +90,8 @@
                 "libavutil-free",
                 "libpostproc-free",
                 "libswresample-free",
-                "libswscale-free"
+                "libswscale-free",
+                "default-fonts-cjk-sans"
             ],
             "kinoite": [
                 "ffmpegthumbnailer",
@@ -107,30 +106,40 @@
     "39": {
         "include": {
             "all": [
-                "bootc"
+                "bootc",
+                "intel-vaapi-driver",
+                "pipewire-libs-extra"
             ],
             "kinoite": [
                 "xwaylandvideobridge"
             ]
         },
         "exclude": {
-            "all": [
-                "default-fonts-cjk-sans"
-            ]
+            "all": []
         }
     },
     "40": {
         "include": {
-            "all": [],
+            "all": [
+                "intel-vaapi-driver",
+                "pipewire-libs-extra"
+            ],
             "kinoite": [
                 "kf6-kimageformats",
                 "qt6-qtimageformats"
             ]
         },
         "exclude": {
-            "all": [
-                "default-fonts-cjk-sans"
-            ]
+            "all": []
+        }
+    },
+    "41": {
+        "include": {
+            "all": [],
+            "kinoite": []
+        },
+        "exclude": {
+            "all": []
         }
     }
 }
diff --git a/sys_files/usr/lib/systemd/system-generators/ublue-sulogin-generator b/sys_files/usr/lib/systemd/system-generators/ublue-sulogin-generator
deleted file mode 100755
index ebee5d35..00000000
--- a/sys_files/usr/lib/systemd/system-generators/ublue-sulogin-generator
+++ /dev/null
@@ -1,65 +0,0 @@
-#!/usr/bin/bash
-
-# This systemd.generator(7) detects if rescue or emergency targets were
-# requested from the kernel cmdline; if so, it overrides the respective
-# target to set force sulogin, allowing use of rescue/emergency targets
-# on systems with locked root password (as is Fedora default).
-#
-# This does NOT bypass locked root password on a fsck failure, but WILL
-# bypass when rescue/emergency targets are chosen from kernel cmdline.
-# Since this requires console/grub access, it is assumed to be at least
-# as secure as a user reset of the root password using grub to modify
-# the kernel cmdline with init=/bin/bash .
-#
-# NOTE: the SYSTEMD_SULOGIN_FORCE method used here does not bypass any
-# assigned password; root password is only bypassed when locked/unset.
-
-export PATH="/usr/bin:/usr/sbin:${PATH}"
-if [ -n "$1" ]; then
-    # If invoked with arguments (not testing) log to kmsg
-    # https://github.com/systemd/systemd/issues/15638
-    exec 1>/dev/kmsg; exec 2>&1
-fi
-
-# If invoked with no arguments (for testing) write to /tmp
-UNIT_DIR="${1:-/tmp}"
-
-set -euo pipefail
-
-have_some_karg() {
-    local args=("$@")
-    IFS=" " read -r -a cmdline <<< "$(</proc/cmdline)"
-    local i
-    for i in "${cmdline[@]}"; do
-        for a in "${args[@]}"; do
-        if [[ "$i" == "$a" ]]; then
-            return 0
-        fi
-        done
-    done
-    return 1
-}
-
-write_dropin() {
-    local service="$1"
-
-    local out_dir="${UNIT_DIR}/${service}.service.d"
-    mkdir -p "${out_dir}"
-
-    # /tmp isn't r/w yet, and the shell needs to cache the here-document
-    TMPDIR=/run
-    cat > "${out_dir}/sulogin-force.conf" <<EOF
-[Service]
-Environment=SYSTEMD_SULOGIN_FORCE=1
-EOF
-    echo "$(basename ${0}): set SYSTEMD_SULOGIN_FORCE=1 for ${service}.service"
-}
-
-# Match kernel command line targets for systemd(1) rescue/emergency
-# Ignores 'rd.' prefixed targets since they enter the dracut ramdisk
-# environment which does not interact with installed system root user.
-if have_some_karg 'systemd.unit=rescue.target' rescue single s S 1; then
-    write_dropin rescue
-elif have_some_karg 'systemd.unit=emergency.target' emergency '-b' ; then
-    write_dropin emergency
-fi
\ No newline at end of file