How to Install Omarchy: The Complete Step-by-Step Guide

The stick is in, the boot menu is blinking, and the one question that makes the difference is not in any boot order: is there anything left on this disk that you need? Omarchy installs itself in a few minutes, encrypted by default and without asking whether you have understood the snapshot mechanics. That is exactly why the quarter of an hour beforehand is worth more than the five minutes of the installation itself.

This guide walks the route from download to the first hour in the finished system, question by question along the real installer (as of 5 September 2026, Omarchy 4.0.2). It is based on the Omarchy manual, the release notes and the installer’s source code; where something is undocumented, it says so. What Omarchy is and who it suits is covered in our assessment of Omarchy as Linux for developers using AI agents. This piece is only about installing it.

Key takeaways

• Omarchy 4.0.2 (31 August 2026) ships as a 6.2 GB ISO from iso.omarchy.org, with a SHA256 checksum and a PGP signature alongside; the install takes under a minute to at most five, according to the manual.
• Before booting from the stick: Secure Boot and/or TPM off in the BIOS, BitLocker fully decrypted in Windows if you dual boot, a backup taken, a wired or 2.4 GHz keyboard at hand.
• The installer asks for keyboard layout, username, password, name, email, hostname and time zone, then the target drive and the mode: full disk or a free-space install next to an existing system. Encryption is the default; Ctrl+C turns it off.
• A single password covers drive, user and root at install time; in the running system the two can be changed separately.
• After the first boot, run Update > Omarchy first, then sort out scaling, keyboard layout, fingerprint and default agent. Snapshots protect the root system, not /home.

Prerequisites: what to settle before the download

Omarchy needs an x86-64 machine, a USB stick of at least 8 GB, at least 32 GB of free space for dual boot and a keyboard with a cable or wireless dongle. The project publishes no official minimums for memory or processor. Intel Macs are supported; Apple silicon is not.

On hardware in detail: the installer detects devices and applies fixes itself. The repository holds scripts for Nvidia graphics, Intel audio, Apple, ASUS, Dell XPS, Framework, Surface and Tuxedo machines (as of 5 September 2026). A computer on none of those lists does not automatically run worse; it simply gets no special treatment. An old second machine is the best test candidate, and if you do not have one, our piece on buying refurbished instead of new shows the cheapest way to get one.

One sentence on backups, because it matters: a snapshot that Omarchy takes later is not a backup. What a real one looks like is in our guide to the 3-2-1 rule for backups.

Step 1: download and verify the ISO

The current ISO lives at https://iso.omarchy.org/omarchy-4.0.2.iso, with the .sha256 and .sig files next to it. Verify at least the checksum before writing the stick: an interrupted download is the most common reason for a stick that will not boot or an install that stops halfway.

On Linux and macOS, three commands are enough:

curl -LO https://iso.omarchy.org/omarchy-4.0.2.iso
curl -LO https://iso.omarchy.org/omarchy-4.0.2.iso.sha256
sha256sum -c omarchy-4.0.2.iso.sha256

The answer must read omarchy-4.0.2.iso: OK. On macOS the command is shasum -a 256 omarchy-4.0.2.iso, on Windows in PowerShell Get-FileHash .\omarchy-4.0.2.iso -Algorithm SHA256; in both cases you compare the output by hand with the contents of the .sha256 file. For 4.0.2 the value begins with 2ef8e624 and ends in 2373cfb8.

If you want to go further, verify the signature. Omarchy signs ISOs and packages with the key 40DFB630FF42BCFFB047046CF0134EE680CAC571, which is published on keys.openpgp.org:

gpg --keyserver keys.openpgp.org --recv-keys 40DFB630FF42BCFFB047046CF0134EE680CAC571
gpg --verify omarchy-4.0.2.iso.sig omarchy-4.0.2.iso

The version number in the file name moves with every release. The download link on omarchy.org always points at the current ISO; if you read this later, substitute the number accordingly.

Step 2: write the USB stick

The manual recommends balenaEtcher on Mac and Windows and caligula on Linux. Both write the ISO raw onto the stick; everything on it is lost. dd works as well, but forgives no wrong target drive.

• balenaEtcher (graphical): “Flash from file” to the ISO, “Select target” to the stick, “Flash”. Etcher verifies automatically after writing.
• caligula (terminal): caligula burn omarchy-4.0.2.iso asks interactively for the target, shows size and model, and verifies after writing.
• Keep the stick: you will not need it after the install, but for a later factory reset or reinstall, a ready stick in the drawer is worth its weight in gold.

Step 3: prepare the BIOS and boot from the stick

Two switches in the firmware setup decide whether the stick boots at all: Secure Boot must be off, and TPM too, depending on the machine. The manual puts it verbatim as “You must turn off Secure Boot and/or TPM in the BIOS”. Then you pick the stick as the boot device.

Which key opens the firmware setup or the boot menu depends on the manufacturer; F2, F12, Esc or Del at power-on are the usual ones. When in doubt, search for “boot menu” plus the device name. Windows 11 keeps booting without Secure Boot; only software that explicitly requires it, such as some anti-cheat systems, will complain afterwards. A plan to boot Omarchy with Secure Boot enabled via a Microsoft-signed shim has sat in the ISO repository since August 2026; it has not been implemented.

On an Intel Mac the route looks different, because Apple hides the switches in recovery: shut the Mac down, hold Command-R immediately at power-on, and under “Utilities > Startup Security Utility” set Secure Boot to “No Security” and allow “Allow booting from external or removable media”. Then restart, hold Option immediately and pick the orange “EFI Boot” device. Two things should be clear beforehand: the install wipes the disk including macOS, which can only be brought back via Internet Recovery, and on the T1-chip models (the 2016 MacBook Pros with Touch Bar) the Touch Bar and sound do not work, according to the manual. On T2 Macs from 2018 to 2020 the installer sets up the patched kernel, audio, Broadcom firmware and fan control automatically.

Step 4: the installer, question by question

The installer is a text wizard: Return starts it, then come keyboard layout, user account, summary, drive, install mode and the final confirmation. Only after that is anything written to disk. Esc goes back at each step; Ctrl+C has a special meaning on two screens.

1. Welcome. Logo, tagline, “Press Return to Start Install”. Return.
2. Keyboard layout. A list preselecting “English (US)”; pick your layout here. It applies immediately to every following input and later also to the encryption password prompt at boot. Ctrl+C on this screen is the entry into “prepare this machine for another owner” (see below).
3. Username. Letters and digits only, no spaces; the placeholder offers “dhh” as an example. Reserved system names are rejected.
4. Password and confirmation. The placeholder says what it covers: “Used for user + root, and disk encryption when enabled”. One password for three things. Choose characters that sit unambiguously on your layout; a password with y and z is annoying precisely when the US layout turns out to be active at boot.
5. Name and email. Optional, only for the Git configuration; Return skips.
6. Hostname. Return sets “omarchy”; otherwise 1 to 63 letters, digits and dashes.
7. Time zone. A list with a suggestion; select or type “Europe/London” or wherever you are.
8. Summary. A table with everything, password masked. “Does this look right?” “No, change it” goes back to the layout.
9. Drive. “Select install disk” lists every drive with size, model and existing partitions; the install stick itself is hidden. Read the line twice if more than one disk is in the machine.
10. Install mode. “Full disk install”, “Free space install (alongside existing data)” and “Choose a different disk”. The free-space entry only appears if the stick was booted in UEFI mode and the disk has unpartitioned space. An empty disk jumps straight to the confirmation.
11. Confirmation. “Everything will be overwritten. There is no recovery possible.” Below it, “Yes, install”. Ctrl+C switches to “Yes, install without encryption”, a second Ctrl+C back again. Encrypted is the default, and it should stay that way.
12. Installation. A progress screen shows the phases, from “Preparing install target” through “Installing Arch + Omarchy” to “Finalizing Limine boot” and “Validating boot setup”. On modern machines that is done in under a minute, according to the manual, on older ones in five at most.
13. Reboot. Confirm “Reboot Now” and pull the stick as soon as the screen goes black.

What the installer puts on the disk is in the source code: a GPT partition table, a 2 GB EFI partition, then a LUKS2 container holding Btrfs with the subvolumes @, @home, @log and @pkg under zstd compression, plus the Limine bootloader with a unified kernel image. The installer picks the kernel itself, linux-t2 on T2 Macs. There is no language question: the system runs on en_US.UTF-8, and regional date and number formats are set later in /etc/locale.conf.

Variant: dual boot next to Windows

Installing next to Windows differs in three points: making room, switching BitLocker off, and adding Windows to the boot menu afterwards.

• Make room: open “Disk Management” in Windows, right-click the system partition and shrink it (“Shrink Volume”), leaving at least 32 GB free, plus 2 GB if the disk has no EFI partition yet. Do not format the free area; the installer wants unpartitioned space. If it is missing, the installer offers cfdisk under “Open partition tool”.
• Switch BitLocker off, do not merely suspend it: the installer looks for the BitLocker signature on every partition and aborts if it finds one; the code says explicitly “Suspending BitLocker is not enough”. The route in Windows is Settings > Privacy & Security > Device encryption, then wait until the disk has finished decrypting.
• Choose “Free space install”. The installer leaves the Windows EFI partition untouched and creates its own; the source code also says why: the Windows partition at 100 to 260 MB is too small for Omarchy’s kernel images, Windows updates could reformat it, and a shared partition would prevent encryption.
• After the first boot run limine-scan in a terminal. That adds the Windows Boot Manager to the Limine menu; on the next boot both systems are offered.

Variant: a machine for someone else

If you are setting up a device for a family member, a new colleague or a buyer, press Ctrl+C on the keyboard screen and confirm “Prepare this machine for another owner”. Omarchy then installs straight away onto the full disk, encrypted with a throwaway password, and defers layout, username and password to the first boot. The password the new owner picks there also becomes the encryption password; the container is re-keyed for it. For fleets and VMs there is additionally the unattended mode: if a second drive labelled cidata with the configuration files is attached, the installer skips the wizard entirely.

Step 5: the first hour in the new system

After the reboot Limine briefly shows its menu, then LUKS asks for the password, and then Omarchy logs you in automatically. The first hour belongs to five settings: update, scaling, keyboard, security, agent. All of them are reached through the Omarchy menu on Super + Space.

1. Update first. Update > Omarchy, or omarchy update in the terminal. That takes a snapshot before applying anything, runs migrations and pulls in every package. A direct pacman -Syu is blocked by Omarchy with a hint, because it would skip the snapshot and the migrations. Firmware for BIOS, SSD and dock is separate under Update > Firmware.
2. Scaling. Omarchy assumes a high-resolution display at double scaling. On a 1080p or 1440p screen everything therefore looks huge: Super + / and Super + Alt + / step through the scaling levels and remember the choice. If you only want to change the text, use omarchy display text size 14. Custom values go in monitors.lua via Setup > Monitors.
3. Keyboard. The layout from the installer already applies. If you want to switch between layouts or get Caps Lock back, that lives in input.lua via Setup > Input; by default Caps Lock is Omarchy’s compose key for emoji and special characters.
4. Security. Fingerprint under Setup > Security > Fingerprint, after which your finger unlocks the lock screen, sudo and system prompts. SSH stays off until you enable it under Setup > Security > SSHD; otherwise the firewall blocks everything incoming except port 53317 for LocalSend. You separate the two passwords under Update > Password: “Drive Encryption” for the disk, “User” for login and sudo. Since 4.0.1 Docker no longer puts you in its group automatically; that is an opt-in in the Setup menu.
5. Agent. A one-time notification invites you to pick the default agent; alternatively Setup > Defaults > Agent or omarchy default agent claude. If the CLI is not installed yet, choosing it installs it. Super + Shift + Ctrl + A then launches the agent in its own terminal, in its don’t-stop-to-ask mode, as the manual puts it. Anyone giving an agent write access to their own system should first understand how prompt injection against AI agents works.

Two more moves are worth doing on day one: omarchy-snapshot create takes a manual snapshot of the clean system that you can bring back from the Limine menu. And omarchy hibernation setup sets up hibernation if it is missing from the System menu; the swap subvolume for it is the size of your RAM.

The most common mistakes

1. The stick does not boot. Usually Secure Boot is still “Enabled”; less often the download is incomplete. Check the checksum first, then the firmware setup.
2. “Free space install” is missing from the choices. Either the stick was booted in legacy BIOS mode instead of UEFI, or the space freed in Windows was accidentally created as a partition. The installer wants unpartitioned space.
3. BitLocker only suspended. The installer aborts with “BitLocker is enabled on this disk”. Decrypt fully; that can take a while on large disks.
4. Bluetooth keyboard at the password prompt. The screen does not respond, because the Bluetooth stack only runs after unlocking. Plug in a cable or a 2.4 GHz dongle.
5. Password with a layout trap. If the US layout was left selected in the installer, y and z are swapped at boot and special characters sit elsewhere. After too many failed logins, Ctrl+Alt+F2, a root login and faillock --reset --user yourname help.
6. Habitual pacman -Syu. Omarchy’s guard stops the command. That is intentional: omarchy update brings the snapshot and the migrations with it.
7. Treating a snapshot as a backup. The rollback via Limine restores the root system, not /home. Only a real backup protects your own files.

When the ISO does not fit: VMs, Apple silicon, manual installation

Not every machine takes the ISO. For virtual machines, ARM devices and special cases there are documented detours, all of which demand more manual work than the stick.

• Virtual machine: VirtualBox, VMware Workstation and Parallels work via community-maintained guides, according to the manual; VirtualBox with the note that performance “probably won’t be great”. For repeatable VMs, say in Proxmox or with Packer, the unattended mode with a cidata drive is the clean route. The configuration files for it are written to /root by a single interactive run. Two warnings from the manual: encrypted installs are still not fully unattended, because someone has to type the passphrase at the first boot, and the configuration carries that passphrase in plain text.
• Apple silicon: not supported. The manual points to Asahi Alarm and a community guide, with the caveat “with some effort”. A second x86-64 machine is the more honest test.
• Manual installation: if you cannot use the ISO, install vanilla Arch via archinstall with Btrfs, LUKS, Limine as bootloader, PipeWire and a user account, then run curl -fsSL https://omarchy.org/install | bash. That takes 5 to 30 minutes because everything comes from the network, and the manual itself says most people should not attempt it. Two consequences are documented: the factory reset is missing, because it needs the baseline snapshot of the ISO installer, and encryption is mandatory, since Omarchy logs in automatically after unlocking.
• Steam Deck and NixOS: community projects exist for both, linked from the manual without being maintained by it.

The bottom line

Installing Omarchy is the easy part: five minutes, a wizard, no partitioning puzzles. The work lies before and after. Before, Secure Boot, BitLocker, keyboard and backup decide whether the evening stays relaxed. After, the update, the scaling and the choice of agent decide whether the system is still a pleasure on day three. Work through the checklist above and the machine is running within an hour. And if you are still hesitating: an old laptop and an 8 GB stick make a risk-free test that says more than any video.