diff --git a/dracut-modules/90void-usb/module-setup.sh b/dracut-modules/90void-usb/module-setup.sh
index 2dd30ad..6229ea0 100644
--- a/dracut-modules/90void-usb/module-setup.sh
+++ b/dracut-modules/90void-usb/module-setup.sh
@@ -11,8 +11,10 @@ depends() {
 install() {
   inst_hook pre-udev 90 "$moddir/create-loop0.sh"
   inst_hook pre-mount 92 "$moddir/squashfs-img.sh"
+  inst_hook pre-pivot 90 "$moddir/overlay.sh"
 }
 
 installkernel() {
   instmods loop
+  instmods overlay
 }
diff --git a/dracut-modules/90void-usb/overlay.sh b/dracut-modules/90void-usb/overlay.sh
new file mode 100644
index 0000000..a904b75
--- /dev/null
+++ b/dracut-modules/90void-usb/overlay.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+mkdir /run/void-usb/overlay
+mount -t tmpfs -o size=4g,mode=755 none /run/void-usb/overlay
+mkdir /run/void-usb/overlay/upper
+mkdir /run/void-usb/overlay/work
+
+mount -t overlay -o lowerdir=/sysroot,upperdir=/run/void-usb/overlay/upper,workdir=/run/void-usb/overlay/work none /sysroot
diff --git a/install-stage1.sh b/install-stage1.sh
index 7fb4377..99b0e68 100644
--- a/install-stage1.sh
+++ b/install-stage1.sh
@@ -135,8 +135,7 @@ mkfs.f2fs -f -l "boot" "$TARGET_PART_BOOT"
 mkfs.f2fs -f -l "container" "$TARGET_PART_BIG"
 
 mkdir -p /mnt/target
-#TODO don't use default permissions for tmpfs
-mount -t tmpfs -o size=3g tmpfs /mnt/target
+mount -t tmpfs -o size=3g,mode=755 tmpfs /mnt/target
 
 # used for chroot later
 mkdir /mnt/target/run
@@ -218,6 +217,8 @@ wget --output-document=/mnt/target/lib/dracut/modules.d/90void-usb/create-loop0.
 chmod 744 /mnt/target/lib/dracut/modules.d/90void-usb/create-loop0.sh
 wget --output-document=/mnt/target/lib/dracut/modules.d/90void-usb/squashfs-img.sh https://lostcave.ddnss.de/git/BodgeMaster/void-minecraft-usb/raw/branch/master/dracut-modules/90void-usb/squashfs-img.sh
 chmod 744 /mnt/target/lib/dracut/modules.d/90void-usb/squashfs-img.sh
+wget --output-document=/mnt/target/lib/dracut/modules.d/90void-usb/overlay.sh https://lostcave.ddnss.de/git/BodgeMaster/void-minecraft-usb/raw/branch/master/dracut-modules/90void-usb/overlay.sh
+chmod 744 /mnt/target/lib/dracut/modules.d/90void-usb/overlay.sh
 
 wget --output-document=/mnt/target/opt/void-usb/backup-fs https://lostcave.ddnss.de/git/BodgeMaster/void-minecraft-usb/raw/branch/master/opt/backup-fs
 chmod 744 /mnt/target/opt/void-usb/backup-fs
@@ -227,9 +228,7 @@ echo "
 echo "# See fstab(5).
 # <device> <mount point> <fstype> <options> <dump> <pass>
 
-# /run/void-usb/container and the underlying image for / are mounted by initramfs
-
-# TODO: add overlayfs
+# /run/void-usb/container, /run/void-usb/overlay, and / are mounted by scripts in initramfs
 
 UUID=$(blkid --output value --match-tag UUID $TARGET_PART_BOOT) /boot f2fs defaults,nodev,nosuid 0 2
 UUID=$(blkid --output value --match-tag UUID $TARGET_PART_EFI) /boot/efi vfat defaults,fmask=0077,dmask=0077 0 2