diff --git a/setup/modules/FreeipaAnsible/ansible/deploy-ansipa-policies.yml b/setup/modules/FreeipaAnsible/ansible/deploy-ansipa-policies.yml
index 227331d..2be68c7 100644
--- a/setup/modules/FreeipaAnsible/ansible/deploy-ansipa-policies.yml
+++ b/setup/modules/FreeipaAnsible/ansible/deploy-ansipa-policies.yml
@@ -97,10 +97,10 @@
         name: "{{ item }}"
         state: present
       loop:
-        - samba-client
+        - "{{ 'samba' if ansible_os_family == 'Archlinux' else 'samba-client' }}"
         - cups
         - cifs-utils      # needed for usr_smb_* CIFS mounts
-        - openssh-server  # needed for dev_ssh_* (sshd must be running to accept keys)
+        - "{{ 'openssh' if ansible_os_family == 'Archlinux' else 'openssh-server' }}"
         - lm_sensors      # needed for dev_mon_power fallback (Intel RAPL preferred)
       ignore_errors: yes
 
@@ -188,6 +188,6 @@
         dest: /data/policy-store/policies.d/
         mode: '0664'
         directory_mode: '02775'
-      delegate_to: "{{ ipa_server_host }}"
+      delegate_to: "{{ ipa_server_host | default(omit) }}"
       run_once: true
-      when: seed_policystore | default(false) | bool
+      when: (seed_policystore | default(false) | bool) and (ipa_server_host is defined)
diff --git a/setup/modules/FreeipaAnsible/freeipa-enroll.sh b/setup/modules/FreeipaAnsible/freeipa-enroll.sh
index 9216ec6..9727825 100644
--- a/setup/modules/FreeipaAnsible/freeipa-enroll.sh
+++ b/setup/modules/FreeipaAnsible/freeipa-enroll.sh
@@ -132,7 +132,7 @@ section "Detecting OS"
 if [[ -f /etc/os-release ]]; then
     source /etc/os-release
     OS_ID="${ID}"
-    OS_VERSION="${VERSION_ID%%.*}"
+    OS_VERSION="${VERSION_ID:+${VERSION_ID%%.*}}"
     log "Detected: $PRETTY_NAME"
 else
     error "Cannot detect OS — /etc/os-release missing"
@@ -259,7 +259,18 @@ section "Installing packages"
 if [[ "$OS_ID" == "arch" ]]; then
     # Ensure pacman db is fresh
     pacman -Sy --noconfirm
-    pkg_install $IPA_CLIENT_PKG $SSSD_PKGS $ODDJOB_PKGS
+    # freeipa is AUR-only; skip if ipa-client-install already present
+    if command -v ipa-client-install &>/dev/null; then
+        log "ipa-client-install already present — skipping AUR freeipa install"
+    else
+        pkg_install $IPA_CLIENT_PKG $SSSD_PKGS
+    fi
+    # oddjob (for mkhomedir) — skip if not available in official repos
+    if pacman -Si oddjob &>/dev/null 2>&1; then
+        pkg_install $ODDJOB_PKGS
+    else
+        warn "oddjob not in official repos — mkhomedir via pam_mkhomedir fallback"
+    fi
 
     # Arch: pam-u2f may be in AUR — try pacman first, fall back to yay/paru
     if [[ "$ENABLE_FIDO2" == true ]]; then
@@ -299,7 +310,7 @@ log "Packages installed"
 # ─── Set hostname ─────────────────────────────────────────────────────────────
 section "Configuring hostname"
 
-CURRENT_HOSTNAME=$(hostname -f 2>/dev/null || hostname)
+CURRENT_HOSTNAME=$(hostname -f 2>/dev/null || hostnamectl hostname 2>/dev/null || cat /etc/hostname 2>/dev/null || echo "unknown")
 if [[ "$CURRENT_HOSTNAME" != "$IPA_HOSTNAME" ]]; then
     log "Setting hostname to $IPA_HOSTNAME"
     hostnamectl set-hostname "$IPA_HOSTNAME"
@@ -344,8 +355,8 @@ ENROLL_ARGS=(
 )
 
 [[ "$MKHOMEDIR" == true ]]    && ENROLL_ARGS+=(--mkhomedir)
-[[ "$DNS_UPDATE" == false ]]  && ENROLL_ARGS+=(--no-dns-update)
-[[ "$CONFIGURE_SUDO" == true ]] && ENROLL_ARGS+=(--enable-dns-updates)
+[[ "$DNS_UPDATE" == true ]]   && ENROLL_ARGS+=(--enable-dns-updates)
+[[ "$CONFIGURE_SUDO" == true ]] && true  # sudo via SSSD is configured post-enrollment
 
 log "Running ipa-client-install..."
 if ipa-client-install "${ENROLL_ARGS[@]}"; then