diff --git a/projects/ArchR/packages/archr/sources/post-update b/projects/ArchR/packages/archr/sources/post-update
index 8bd72abadb..85724b7f4b 100644
--- a/projects/ArchR/packages/archr/sources/post-update
+++ b/projects/ArchR/packages/archr/sources/post-update
@@ -60,7 +60,7 @@ echo "Apply dev wifi config if available..." >>${LOG}
 if [ -d /usr/config/iwd ]
 then
   tocon "Update developer wifi config..."
-  cp /usr/config/iwd/* /storage/.cache/iwd/
+  cp /usr/config/iwd/* /var/lib/iwd/
 fi
 
 ### Sync rsync configs
diff --git a/projects/ArchR/packages/archr/sources/scripts/wifictl b/projects/ArchR/packages/archr/sources/scripts/wifictl
index f5ccfeb71e..8435fefbdd 100755
--- a/projects/ArchR/packages/archr/sources/scripts/wifictl
+++ b/projects/ArchR/packages/archr/sources/scripts/wifictl
@@ -14,7 +14,7 @@
 ###     wifictl command [ssid] [psk]
 ###
 
-IWD_AP_CFG_DIR="/storage/.cache/iwd/ap"
+IWD_AP_CFG_DIR="/var/lib/iwd/ap"
 WIFI_TYPE=$(get_setting wifi.adhoc.enabled)
 NETWORK_ADDRESS="192.168.80"
 ADHOC_CLIENT_ID=$(get_setting wifi.adhoc.id)
@@ -67,7 +67,7 @@ connect_wifi() {
   sleep 1
 
   # Create iwd network profile for persistent connection
-  IWD_DIR="/storage/.cache/iwd"
+  IWD_DIR="/var/lib/iwd"
   mkdir -p "${IWD_DIR}"
   if [ -n "${PSK}" ]; then
     printf '[Security]\nPassphrase=%s\n' "${PSK}" > "${IWD_DIR}/${SSID}.psk"
diff --git a/projects/ArchR/packages/network/iwd/package.mk b/projects/ArchR/packages/network/iwd/package.mk
index db8bbf04df..1f30c24713 100644
--- a/projects/ArchR/packages/network/iwd/package.mk
+++ b/projects/ArchR/packages/network/iwd/package.mk
@@ -19,4 +19,10 @@ post_makeinstall_target() {
 
   mkdir -p ${INSTALL}/usr/bin
     cp -P ${PKG_DIR}/scripts/iwd_get-networks ${INSTALL}/usr/bin
+
+  # FHS bridge: /var/lib/iwd is the Arch-standard state dir. tmpfiles
+  # z_03_iwd.conf creates the backing /storage/.cache/iwd so the
+  # symlinked target is writable on first boot.
+  mkdir -p ${INSTALL}/var/lib
+  ln -sf /storage/.cache/iwd ${INSTALL}/var/lib/iwd
 }
diff --git a/projects/ArchR/packages/network/iwd/system.d/iwd.service b/projects/ArchR/packages/network/iwd/system.d/iwd.service
index 88f260db40..bd96e872b1 100644
--- a/projects/ArchR/packages/network/iwd/system.d/iwd.service
+++ b/projects/ArchR/packages/network/iwd/system.d/iwd.service
@@ -7,7 +7,7 @@ Before=network.target
 Wants=network.target
 
 [Service]
-Environment=STATE_DIRECTORY=/storage/.cache/iwd
+Environment=STATE_DIRECTORY=/var/lib/iwd
 Type=dbus
 BusName=net.connman.iwd
 ExecStart=/usr/lib/iwd
diff --git a/projects/ArchR/packages/network/openssh/package.mk b/projects/ArchR/packages/network/openssh/package.mk
index 84399e7ae3..c90574471f 100644
--- a/projects/ArchR/packages/network/openssh/package.mk
+++ b/projects/ArchR/packages/network/openssh/package.mk
@@ -28,7 +28,7 @@ PKG_CONFIGURE_OPTS_TARGET="ac_cv_header_rpc_types_h=no \
                            --disable-pututline \
                            --disable-pututxline \
                            --disable-etc-default-login \
-                           --with-keydir=/storage/.cache/ssh \
+                           --with-keydir=/var/lib/sshd \
                            --without-pam"
 
 pre_configure_target() {
@@ -55,4 +55,11 @@ post_makeinstall_target() {
 
 post_install() {
   enable_service sshd.service
+
+  # FHS bridge for host keys: --with-keydir is baked at configure time
+  # to /var/lib/sshd. Symlink it into /storage/.cache/ssh (rw overlay)
+  # so the keys persist across reboots. The backing path is still
+  # created by tmpfiles z_04_openssh.conf.
+  mkdir -p ${INSTALL}/var/lib
+  ln -sf /storage/.cache/ssh ${INSTALL}/var/lib/sshd
 }
diff --git a/projects/ArchR/packages/network/openssh/system.d/sshd.service b/projects/ArchR/packages/network/openssh/system.d/sshd.service
index 8b733405d7..d67ae6103c 100644
--- a/projects/ArchR/packages/network/openssh/system.d/sshd.service
+++ b/projects/ArchR/packages/network/openssh/system.d/sshd.service
@@ -8,10 +8,10 @@ ConditionPathExists=|/storage/.cache/services/sshd.conf
 [Service]
 Restart=on-failure
 EnvironmentFile=-/storage/.cache/services/sshd.conf
-ExecStartPre=-/bin/sh -c 'mkdir -p /storage/.cache/ssh'
+ExecStartPre=-/bin/sh -c 'mkdir -p /var/lib/sshd'
 ExecStartPre=/usr/bin/ssh-keygen -A
-ExecStartPre=-/bin/sh -c 'chmod 600 /storage/.cache/ssh/ssh_host_*'
-ExecStartPre=-/bin/sh -c 'chmod 644 /storage/.cache/ssh/ssh_host_*.pub'
+ExecStartPre=-/bin/sh -c 'chmod 600 /var/lib/sshd/ssh_host_*'
+ExecStartPre=-/bin/sh -c 'chmod 644 /var/lib/sshd/ssh_host_*.pub'
 ExecStart=/usr/sbin/sshd -D $SSH_ARGS
 ExecReload=/bin/kill -HUP $MAINPID
 TimeoutStopSec=1s
diff --git a/projects/ArchR/packages/sysutils/systemd/scripts/userconfig-setup b/projects/ArchR/packages/sysutils/systemd/scripts/userconfig-setup
index 43a3cd6e09..99e7479012 100755
--- a/projects/ArchR/packages/sysutils/systemd/scripts/userconfig-setup
+++ b/projects/ArchR/packages/sysutils/systemd/scripts/userconfig-setup
@@ -33,7 +33,7 @@ then
   if [ -d /usr/config/iwd ]
   then
     tocon "Update developer wifi config..."
-    cp /usr/config/iwd/* /storage/.cache/iwd/
+    cp /usr/config/iwd/* /var/lib/iwd/
   fi
 
   if [ -e "/usr/bin/emulationstation" ]