diff --git a/projects/ArchR/packages/archr/autostart/007-rootpw b/projects/ArchR/packages/archr/autostart/007-rootpw
index 7dea564e5c..93a7ceb116 100755
--- a/projects/ArchR/packages/archr/autostart/007-rootpw
+++ b/projects/ArchR/packages/archr/autostart/007-rootpw
@@ -7,10 +7,10 @@
 
 tocon "Setting root password..."
 
-if [ ! -d "/storage/.cache/samba" ]
+if [ ! -d "/var/lib/samba/private" ]
 then
-  mkdir -p /storage/.cache/samba
-  touch /storage/.cache/samba/smbpasswd
+  mkdir -p /var/lib/samba/private
+  touch /var/lib/samba/private/smbpasswd
 fi
 
 ROOTPASS=$(get_setting root.password)
diff --git a/projects/ArchR/packages/archr/autostart/099-networkservices b/projects/ArchR/packages/archr/autostart/099-networkservices
index 7b605c6496..0d8ac10df9 100755
--- a/projects/ArchR/packages/archr/autostart/099-networkservices
+++ b/projects/ArchR/packages/archr/autostart/099-networkservices
@@ -12,15 +12,15 @@ do
   source ${SERVICE}
 
 
-  if [ ! -d "/storage/.cache/services" ]
+  if [ ! -d "/var/lib/archr/services" ]
   then
-    mkdir -p "/storage/.cache/services"
+    mkdir -p "/var/lib/archr/services"
   fi
 
   if [ -n "${CONF}" ] && \
-     [ -e "/storage/.cache/services/${CONF}" ]
+     [ -e "/var/lib/archr/services/${CONF}" ]
   then
-    rm -f "/storage/.cache/services/${CONF}"
+    rm -f "/var/lib/archr/services/${CONF}"
   fi
 
   statemgr() {
@@ -32,7 +32,7 @@ do
 
   case "$STATE" in
     "1")
-      touch "/storage/.cache/services/${CONF}"
+      touch "/var/lib/archr/services/${CONF}"
       statemgr start
     ;;
     *)
diff --git a/projects/ArchR/packages/archr/package.mk b/projects/ArchR/packages/archr/package.mk
index bbaffc5a41..3f6872f3ab 100644
--- a/projects/ArchR/packages/archr/package.mk
+++ b/projects/ArchR/packages/archr/package.mk
@@ -62,6 +62,20 @@ EOF
   # pre-boot bootloader scripts know about and cannot move; userland
   # tooling reads/writes through the FHS bridge.
   ln -sf /storage/.update                  ${INSTALL}/var/cache/archr/update
+
+  # State directories for runtime data the system writes back to the
+  # storage overlay. Same bridge pattern, just under /var/lib instead
+  # of /var/cache.
+  mkdir -p ${INSTALL}/var/lib/archr
+  ln -sf /storage/.cache/services          ${INSTALL}/var/lib/archr/services
+  # samba passdb at the Arch-standard /var/lib/samba/private path.
+  mkdir -p ${INSTALL}/var/lib/samba
+  ln -sf /storage/.cache/samba             ${INSTALL}/var/lib/samba/private
+  # tailscale daemon state (Arch convention).
+  ln -sf /storage/.cache/tailscale         ${INSTALL}/var/lib/tailscale
+  # cron spool (Arch convention; busybox crond walks the subtree).
+  mkdir -p ${INSTALL}/var/spool
+  ln -sf /storage/.cache/cron              ${INSTALL}/var/spool/cron
 }
 
 post_install() {
diff --git a/projects/ArchR/packages/archr/sources/scripts/backuptool b/projects/ArchR/packages/archr/sources/scripts/backuptool
index d445bed1d9..5f6de053fe 100755
--- a/projects/ArchR/packages/archr/sources/scripts/backuptool
+++ b/projects/ArchR/packages/archr/sources/scripts/backuptool
@@ -23,7 +23,7 @@ DEFAULT=(
     /storage/.config/fancontrol.conf
     /storage/.config/backuptool.conf
     /var/lib/bluetooth/*
-    /storage/.cache/connman*
+    /var/lib/connman*
     /storage/.config/system/configs/system.cfg
     /storage/.config/ppsspp/*
     /storage/.config/retroarch/*
diff --git a/projects/ArchR/packages/archr/system.d/archr-report-stats.timer b/projects/ArchR/packages/archr/system.d/archr-report-stats.timer
index b5fb640adf..04e394eefa 100644
--- a/projects/ArchR/packages/archr/system.d/archr-report-stats.timer
+++ b/projects/ArchR/packages/archr/system.d/archr-report-stats.timer
@@ -1,6 +1,6 @@
 [Unit]
 Description=Timer to report anonymous ArchR install statistics
-ConditionPathExists=/storage/.cache/services/stats.enabled
+ConditionPathExists=/var/lib/archr/services/stats.enabled
 
 [Timer]
 OnBootSec=5min
diff --git a/projects/ArchR/packages/network/avahi/system.d/avahi-daemon.service b/projects/ArchR/packages/network/avahi/system.d/avahi-daemon.service
index 2e1c503536..2851f1f929 100644
--- a/projects/ArchR/packages/network/avahi/system.d/avahi-daemon.service
+++ b/projects/ArchR/packages/network/avahi/system.d/avahi-daemon.service
@@ -3,7 +3,7 @@ Description=Avahi Daemon
 After=network.target avahi-defaults.service
 RequiresMountsFor=/storage
 Requires=avahi-defaults.service
-ConditionPathExists=/storage/.cache/services/avahi.conf
+ConditionPathExists=/var/lib/archr/services/avahi.conf
 
 [Service]
 Restart=on-failure
diff --git a/projects/ArchR/packages/network/avahi/system.d/avahi-defaults.service b/projects/ArchR/packages/network/avahi/system.d/avahi-defaults.service
index 46b31212b3..8ac6b5697d 100644
--- a/projects/ArchR/packages/network/avahi/system.d/avahi-defaults.service
+++ b/projects/ArchR/packages/network/avahi/system.d/avahi-defaults.service
@@ -3,10 +3,10 @@ Description=Avahi defaults
 After=local-fs.target
 RequiresMountsFor=/storage
 
-ConditionPathExists=!/storage/.cache/services/avahi.conf
-ConditionPathExists=!/storage/.cache/services/avahi.disabled
+ConditionPathExists=!/var/lib/archr/services/avahi.conf
+ConditionPathExists=!/var/lib/archr/services/avahi.disabled
 
 [Service]
 Type=oneshot
-ExecStart=/bin/sh -c 'cp /usr/share/services/avahi.conf /storage/.cache/services/'
+ExecStart=/bin/sh -c 'cp /usr/share/services/avahi.conf /var/lib/archr/services/'
 RemainAfterExit=yes
diff --git a/projects/ArchR/packages/network/connman/package.mk b/projects/ArchR/packages/network/connman/package.mk
index 4fd5c2b809..792bc74bf4 100644
--- a/projects/ArchR/packages/network/connman/package.mk
+++ b/projects/ArchR/packages/network/connman/package.mk
@@ -52,8 +52,8 @@ else
   PKG_CONFIGURE_OPTS_TARGET+=" --disable-wireguard"
 fi
 
-PKG_MAKE_OPTS_TARGET="storagedir=/storage/.cache/connman \
-                      vpn_storagedir=/storage/.config/wireguard \
+PKG_MAKE_OPTS_TARGET="storagedir=/var/lib/connman \
+                      vpn_storagedir=/etc/wireguard \
                       statedir=/run/connman"
 
 post_makeinstall_target() {
@@ -81,6 +81,13 @@ post_makeinstall_target() {
 
   mkdir -p ${INSTALL}/usr/share/connman/
     cp ${PKG_DIR}/config/settings ${INSTALL}/usr/share/connman/
+
+  # FHS bridges: connman storagedir baked at /var/lib/connman, wireguard
+  # vpn_storagedir at /etc/wireguard (both Arch conventions). Bridges
+  # land at the storage overlay so connections and tunnels persist.
+  mkdir -p ${INSTALL}/var/lib
+  ln -sf /storage/.cache/connman ${INSTALL}/var/lib/connman
+  ln -sf /storage/.config/wireguard ${INSTALL}/etc/wireguard
 }
 
 post_install() {
diff --git a/projects/ArchR/packages/network/connman/scripts/connman-setup b/projects/ArchR/packages/network/connman/scripts/connman-setup
index 7e5bf2793d..259a26a15a 100755
--- a/projects/ArchR/packages/network/connman/scripts/connman-setup
+++ b/projects/ArchR/packages/network/connman/scripts/connman-setup
@@ -4,9 +4,9 @@
 # Copyright (C) 2009-2014 Stephan Raue (stephan@openelec.tv)
 
 # creating initial settings file
-  if [ ! -f /storage/.cache/connman/settings ]; then
-    mkdir -p /storage/.cache/connman
-      cp /usr/share/connman/settings /storage/.cache/connman
+  if [ ! -f /var/lib/connman/settings ]; then
+    mkdir -p /var/lib/connman
+      cp /usr/share/connman/settings /var/lib/connman
   fi
 
 # set variable for connman main.conf location
diff --git a/projects/ArchR/packages/network/openssh/system.d/sshd.service b/projects/ArchR/packages/network/openssh/system.d/sshd.service
index d67ae6103c..b71af5dd4c 100644
--- a/projects/ArchR/packages/network/openssh/system.d/sshd.service
+++ b/projects/ArchR/packages/network/openssh/system.d/sshd.service
@@ -3,11 +3,11 @@ Description=OpenSSH server daemon
 After=network.target
 RequiresMountsFor=/storage
 ConditionKernelCommandLine=|ssh
-ConditionPathExists=|/storage/.cache/services/sshd.conf
+ConditionPathExists=|/var/lib/archr/services/sshd.conf
 
 [Service]
 Restart=on-failure
-EnvironmentFile=-/storage/.cache/services/sshd.conf
+EnvironmentFile=-/var/lib/archr/services/sshd.conf
 ExecStartPre=-/bin/sh -c 'mkdir -p /var/lib/sshd'
 ExecStartPre=/usr/bin/ssh-keygen -A
 ExecStartPre=-/bin/sh -c 'chmod 600 /var/lib/sshd/ssh_host_*'
diff --git a/projects/ArchR/packages/network/samba/config/smb.conf b/projects/ArchR/packages/network/samba/config/smb.conf
index 85d89085aa..5491966616 100644
--- a/projects/ArchR/packages/network/samba/config/smb.conf
+++ b/projects/ArchR/packages/network/samba/config/smb.conf
@@ -20,7 +20,7 @@
   load printers = no
   enable core files = no
   passdb backend = smbpasswd
-  smb passwd file = /storage/.cache/samba/smbpasswd
+  smb passwd file = /var/lib/samba/private/smbpasswd
   smb encrypt = disabled
   fruit:model = Xserve
 
diff --git a/projects/ArchR/packages/network/samba/system.d/nmbd.service b/projects/ArchR/packages/network/samba/system.d/nmbd.service
index 91ae82c217..86464b159c 100644
--- a/projects/ArchR/packages/network/samba/system.d/nmbd.service
+++ b/projects/ArchR/packages/network/samba/system.d/nmbd.service
@@ -3,7 +3,7 @@ Description=Samba NMB Daemon
 Wants=network-online.target samba-config.service
 After=network-online.target samba-config.service
 RequiresMountsFor=/storage
-ConditionPathExists=!/storage/.cache/services/samba.disabled
+ConditionPathExists=!/var/lib/archr/services/samba.disabled
 ConditionPathExists=/run/samba/smb.conf
 
 [Service]
diff --git a/projects/ArchR/packages/network/samba/system.d/smbd.service b/projects/ArchR/packages/network/samba/system.d/smbd.service
index ef407e8abb..821987d2eb 100644
--- a/projects/ArchR/packages/network/samba/system.d/smbd.service
+++ b/projects/ArchR/packages/network/samba/system.d/smbd.service
@@ -3,7 +3,7 @@ Description=Samba SMB Daemon
 Wants=network-online.target nmbd.service avahi-daemon.service
 After=network-online.target nmbd.service avahi-daemon.service
 RequiresMountsFor=/storage
-ConditionPathExists=!/storage/.cache/services/samba.disabled
+ConditionPathExists=!/var/lib/archr/services/samba.disabled
 ConditionPathExists=/run/samba/smb.conf
 
 [Service]
diff --git a/projects/ArchR/packages/network/simple-http-server/system.d/simple-http-server.service b/projects/ArchR/packages/network/simple-http-server/system.d/simple-http-server.service
index 74a9a96ab2..610299e34f 100644
--- a/projects/ArchR/packages/network/simple-http-server/system.d/simple-http-server.service
+++ b/projects/ArchR/packages/network/simple-http-server/system.d/simple-http-server.service
@@ -3,7 +3,7 @@ Description=simple-http-server
 Wants=network-pre.target
 After=network-pre.target
 RequiresMountsFor=/storage
-ConditionPathExists=/storage/.cache/services/simplehttp.conf
+ConditionPathExists=/var/lib/archr/services/simplehttp.conf
 
 [Service]
 ExecStart=/usr/bin/bash -c "source /etc/profile.d/001-functions && /usr/bin/simple-http-server -i -p 80 -a root:$(get_setting root.password) -s -u /storage"
diff --git a/projects/ArchR/packages/network/syncthing/system.d/syncthing.service b/projects/ArchR/packages/network/syncthing/system.d/syncthing.service
index c641546872..1f7d66b384 100644
--- a/projects/ArchR/packages/network/syncthing/system.d/syncthing.service
+++ b/projects/ArchR/packages/network/syncthing/system.d/syncthing.service
@@ -1,7 +1,7 @@
 [Unit]
 Description=Start SyncThing
 After=archr.service
-ConditionPathExists=/storage/.cache/services/syncthing.conf
+ConditionPathExists=/var/lib/archr/services/syncthing.conf
 
 [Service]
 Type=simple
diff --git a/projects/ArchR/packages/network/tailscale/system.d/tailscaled.service b/projects/ArchR/packages/network/tailscale/system.d/tailscaled.service
index 79d1a16e90..ae6419d629 100644
--- a/projects/ArchR/packages/network/tailscale/system.d/tailscaled.service
+++ b/projects/ArchR/packages/network/tailscale/system.d/tailscaled.service
@@ -4,12 +4,12 @@ Documentation=https://tailscale.com/kb/
 Wants=network-pre.target
 After=network-pre.target systemd-resolved.service
 RequiresMountsFor=/storage
-ConditionPathExists=/storage/.cache/services/tailscaled.conf
+ConditionPathExists=/var/lib/archr/services/tailscaled.conf
 
 [Service]
 EnvironmentFile=/storage/.config/tailscaled.defaults
 ExecStartPre=/usr/sbin/tailscaled --cleanup
-ExecStart=/usr/sbin/tailscaled --state=/storage/.cache/tailscale/tailscaled.state --socket=/run/tailscale/tailscaled.sock --port $PORT $FLAGS
+ExecStart=/usr/sbin/tailscaled --state=/var/lib/tailscale/tailscaled.state --socket=/run/tailscale/tailscaled.sock --port $PORT $FLAGS
 ExecStopPost=/usr/sbin/tailscaled --cleanup
 
 Restart=on-failure
diff --git a/projects/ArchR/packages/network/zerotier-one/system.d/zerotier-one.service b/projects/ArchR/packages/network/zerotier-one/system.d/zerotier-one.service
index cb088c28bd..1e9642cbcb 100644
--- a/projects/ArchR/packages/network/zerotier-one/system.d/zerotier-one.service
+++ b/projects/ArchR/packages/network/zerotier-one/system.d/zerotier-one.service
@@ -3,7 +3,7 @@ Description=zerotier-one
 Wants=network-pre.target
 After=network-pre.target
 RequiresMountsFor=/storage
-ConditionPathExists=/storage/.cache/services/zerotier.conf
+ConditionPathExists=/var/lib/archr/services/zerotier.conf
 
 [Service]
 ExecStart=/usr/sbin/zerotier-one /storage/.config/zerotier/
diff --git a/projects/ArchR/packages/sysutils/busybox/system.d.opt/cron-defaults.service b/projects/ArchR/packages/sysutils/busybox/system.d.opt/cron-defaults.service
index 0f8b39e773..ad840e7b38 100644
--- a/projects/ArchR/packages/sysutils/busybox/system.d.opt/cron-defaults.service
+++ b/projects/ArchR/packages/sysutils/busybox/system.d.opt/cron-defaults.service
@@ -3,10 +3,10 @@ Description=Cron defaults
 After=local-fs.target
 RequiresMountsFor=/storage
 
-ConditionPathExists=!/storage/.cache/services/crond.conf
-ConditionPathExists=!/storage/.cache/services/crond.disabled
+ConditionPathExists=!/var/lib/archr/services/crond.conf
+ConditionPathExists=!/var/lib/archr/services/crond.disabled
 
 [Service]
 Type=oneshot
-ExecStart=/bin/sh -c 'cp /usr/share/services/crond.conf /storage/.cache/services/'
+ExecStart=/bin/sh -c 'cp /usr/share/services/crond.conf /var/lib/archr/services/'
 RemainAfterExit=yes
diff --git a/projects/ArchR/packages/sysutils/busybox/system.d.opt/cron.service b/projects/ArchR/packages/sysutils/busybox/system.d.opt/cron.service
index d7434e88d8..7a601861c1 100644
--- a/projects/ArchR/packages/sysutils/busybox/system.d.opt/cron.service
+++ b/projects/ArchR/packages/sysutils/busybox/system.d.opt/cron.service
@@ -4,10 +4,10 @@ After=cron-defaults.service
 RequiresMountsFor=/storage
 Requires=cron-defaults.service
 
-ConditionPathExists=/storage/.cache/services/crond.conf
+ConditionPathExists=/var/lib/archr/services/crond.conf
 
 [Service]
-ExecStartPre=/bin/mkdir -p /storage/.cache/cron/crontabs
+ExecStartPre=/bin/mkdir -p /var/spool/cron/crontabs
 ExecStart=/sbin/crond -f -S
 KillMode=process
 TimeoutStopSec=1s
diff --git a/projects/ArchR/packages/sysutils/systemd/scripts/usercache-setup b/projects/ArchR/packages/sysutils/systemd/scripts/usercache-setup
index 9a0e7c9786..843e54b0ad 100755
--- a/projects/ArchR/packages/sysutils/systemd/scripts/usercache-setup
+++ b/projects/ArchR/packages/sysutils/systemd/scripts/usercache-setup
@@ -3,8 +3,8 @@
 # SPDX-License-Identifier: GPL-2.0
 # Copyright (C) 2017-present Team LibreELEC (https://libreelec.tv)
 
-# Fix bug in older versions creating file /storage/.cache/services
-[ -f /storage/.cache/services ] && rm /storage/.cache/services && mkdir -p /storage/.cache/services
+# Fix bug in older versions creating file /var/lib/archr/services
+[ -f /var/lib/archr/services ] && rm /var/lib/archr/services && mkdir -p /var/lib/archr/services
 
 # Copy cache files, but don't overwrite
 false | cp -iRp /usr/cache/* /storage/.cache/ &>/dev/null