diff --git a/packages/network/rpcbind/package.mk b/packages/network/rpcbind/package.mk
index 1c430edd28..14266fbdd3 100644
--- a/packages/network/rpcbind/package.mk
+++ b/packages/network/rpcbind/package.mk
@@ -20,5 +20,10 @@ PKG_CONFIGURE_OPTS_TARGET="ac_cv_header_rpcsvc_mount_h=no \
                            --with-rpcuser=root"
 
 post_install() {
-  enable_service rpcbind.service
+  # rpcbind.service rodando idle custa ~11 MB de RAM em um device com
+  # 1 GB. O upstream já fornece rpcbind.socket com Listen :111 e
+  # /run/rpcbind.sock; habilitar só o socket entrega o mesmo
+  # comportamento funcional (mount.nfs ativa o daemon sob demanda)
+  # sem o overhead permanente quando o handheld não está usando NFS.
+  enable_service rpcbind.socket
 }
diff --git a/projects/ArchR/packages/apps/archr-touchscreen-keyboard/sources/archr-touchscreen-keyboard b/projects/ArchR/packages/apps/archr-touchscreen-keyboard/sources/archr-touchscreen-keyboard
index a5cee42355..8539e8cd25 100644
--- a/projects/ArchR/packages/apps/archr-touchscreen-keyboard/sources/archr-touchscreen-keyboard
+++ b/projects/ArchR/packages/apps/archr-touchscreen-keyboard/sources/archr-touchscreen-keyboard
@@ -4,13 +4,19 @@
 
 . /etc/profile
 
+# Em devices sem touchscreen (a maioria dos handhelds RK3326 — R33S,
+# R36S, etc.) o while loop adiante nunca executa o ramo útil mas
+# continua acordando a cada 5s para conferir as mesmas variáveis e
+# voltar a dormir. Em um device de 1 GB RAM e quad Cortex-A35 cada
+# wakeup desnecessário é overhead. Bail out cedo quando o quirk diz
+# que não há touchscreen.
+if [ "${DEVICE_HAS_TOUCHSCREEN}" != "true" ]; then
+  exit 0
+fi
+
 TSKEY=$(get_setting "archr.touchscreen-keyboard.enabled")
 if [ ! -n "${TSKEY}" ]; then
-  if [ "$DEVICE_HAS_TOUCHSCREEN" == "true" ]; then
-    set_setting "archr.touchscreen-keyboard.enabled" "1"
-  else
-    set_setting "archr.touchscreen-keyboard.enabled" "0"
-  fi
+  set_setting "archr.touchscreen-keyboard.enabled" "1"
 fi
 
 
diff --git a/projects/ArchR/packages/apps/archr-touchscreen-keyboard/system.d/touchkeyboard.service b/projects/ArchR/packages/apps/archr-touchscreen-keyboard/system.d/touchkeyboard.service
index 59275d005c..df9e48fe6c 100644
--- a/projects/ArchR/packages/apps/archr-touchscreen-keyboard/system.d/touchkeyboard.service
+++ b/projects/ArchR/packages/apps/archr-touchscreen-keyboard/system.d/touchkeyboard.service
@@ -8,7 +8,11 @@ StartLimitIntervalSec=0
 [Service]
 Environment=HOME=/storage
 ExecStart=/usr/bin/archr-touchscreen-keyboard
-Restart=always
+# Em devices sem touchscreen o helper sai com exit 0; com Restart=
+# always isso significava restart infinito a cada segundo. on-failure
+# preserva o auto-restart em crashes reais (exit !=0) e respeita o
+# bail-out limpo do helper.
+Restart=on-failure
 RestartSec=1
 
 [Install]
diff --git a/projects/ArchR/packages/archr/config/system/configs/system.cfg b/projects/ArchR/packages/archr/config/system/configs/system.cfg
index e105093a6b..4d4c829983 100644
--- a/projects/ArchR/packages/archr/config/system/configs/system.cfg
+++ b/projects/ArchR/packages/archr/config/system/configs/system.cfg
@@ -181,7 +181,7 @@ system.battery.warning=0
 system.battery.warning_threshold=25
 system.hostname=@DEVICENAME@
 system.language=en_US
-enable.turbo-mode=0
+enable.turbo-mode=1
 system.cpugovernor=ondemand
 system.loglevel=none
 system.merged.storage=0
diff --git a/projects/ArchR/packages/archr/sources/scripts/setrootpass b/projects/ArchR/packages/archr/sources/scripts/setrootpass
index 9f063a3462..25dda003fa 100755
--- a/projects/ArchR/packages/archr/sources/scripts/setrootpass
+++ b/projects/ArchR/packages/archr/sources/scripts/setrootpass
@@ -9,6 +9,18 @@ ROOTPASS="$1"
 LPC=$(awk -F: '/^root/{print $3}' /storage/.cache/shadow)
 CURRENT=$(awk -F: '/^root/{print $2}' /storage/.cache/shadow)
 
+# Short-circuit no-op runs. 007-rootpw chama setrootpass a cada boot
+# com a senha já gravada — cryptpw sha512 + smbpasswd + syncthing
+# generate juntos custam ~6s mesmo quando nada vai mudar. Comparar a
+# senha contra o último valor escrito por nós e bail out se for igual.
+LAST_PASS_HASH="/storage/.cache/.archr-rootpass.sha256"
+if [ -n "${ROOTPASS}" ] && [ -f "${LAST_PASS_HASH}" ]; then
+  CURRENT_HASH=$(printf '%s' "${ROOTPASS}" | sha256sum | awk '{print $1}')
+  if [ "$(cat "${LAST_PASS_HASH}" 2>/dev/null)" = "${CURRENT_HASH}" ]; then
+    exit 0
+  fi
+fi
+
 # Turn it into a usable hash
 NEW=$(cryptpw -m sha512 "${ROOTPASS}" 2>/dev/null)
 
@@ -24,6 +36,9 @@ syncthing generate --gui-user "root" --gui-password "${ROOTPASS}" >/dev/null 2>&
 # Save the password so we can display it in ES
 set_setting root.password "${ROOTPASS}"
 
+# Lembrar o hash da senha gravada para o short-circuit no próximo boot.
+printf '%s' "${ROOTPASS}" | sha256sum | awk '{print $1}' >"${LAST_PASS_HASH}" 2>/dev/null
+
 # Restart syncthing if it was enabled.
 SYNCSTATUS=$(get_setting syncthing.enabled)
 SYNCACTIVE=$(systemctl status syncthing | awk '/active/ {print $2}')
diff --git a/projects/ArchR/packages/sysutils/systemd/package.mk b/projects/ArchR/packages/sysutils/systemd/package.mk
index e55ec0e8a2..b25bc4d2e8 100644
--- a/projects/ArchR/packages/sysutils/systemd/package.mk
+++ b/projects/ArchR/packages/sysutils/systemd/package.mk
@@ -264,6 +264,16 @@ post_makeinstall_target() {
   ln -sf /storage/.config/timesyncd.conf.d ${INSTALL}/etc/systemd/timesyncd.conf.d
   safe_remove ${INSTALL}/etc/sysctl.d
   ln -sf /storage/.config/sysctl.d ${INSTALL}/etc/sysctl.d
+  # /etc/sysctl.d aponta para /storage que ainda não está montado
+  # quando systemd-sysctl roda (Before=sysinit.target). Resultado: os
+  # archr.conf / 99-archr-networking.conf nunca eram aplicados no boot
+  # — dirty_writeback_centisecs, BBR/fq_codel, ip_forward etc. ficavam
+  # no default do kernel. Replicar os defaults da distro em
+  # /usr/lib/sysctl.d (rootfs, sempre acessível) garante a aplicação
+  # antes de /storage subir. A cópia em /etc/sysctl.d continua sendo o
+  # ponto de override do usuário (last-wins).
+  mkdir -p ${INSTALL}/usr/lib/sysctl.d
+  cp -PR ${PKG_DIR}/config/sysctl.d/*.conf ${INSTALL}/usr/lib/sysctl.d/
   safe_remove ${INSTALL}/etc/tmpfiles.d
   ln -sf /storage/.config/tmpfiles.d ${INSTALL}/etc/tmpfiles.d
   safe_remove ${INSTALL}/etc/udev/hwdb.d