diff --git a/.gitignore b/.gitignore
index ee652d6..36d8abc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -84,3 +84,13 @@ credentials.json
 
 # Pre-staged binary (142 MB) - track via LFS or stage on PXE server, not in regular git
 playbook/shopfloor-setup/Shopfloor/PrinterInstallerMap.exe
+
+# Keyence VR-6000 InstallShield payload (560 MB). InstallShield MSIs split
+# the compressed payload into Data1.cab; without it next to the MSI, msiexec
+# exits 1603 with "SECREPAIR: Failed to open Data1.cab" (see
+# /home/camp/pxe-images/keyence/Logs/Keyence/install.log for the signature).
+# Canonical source on the GE-Enforce SFLD share:
+#   tsgwp00525\sfld$\v2\shared\dt\shopfloor\gea-shopfloor-keyence\apps\Data1.cab
+# Stage to playbook/shopfloor-setup/gea-shopfloor-keyence/installers/Data1.cab
+# before building the USB image.
+playbook/shopfloor-setup/gea-shopfloor-keyence/installers/Data1.cab
diff --git a/playbook/shopfloor-setup/gea-shopfloor-keyence/keyence-manifest.json b/playbook/shopfloor-setup/gea-shopfloor-keyence/keyence-manifest.json
index 4853ed0..bcd4732 100644
--- a/playbook/shopfloor-setup/gea-shopfloor-keyence/keyence-manifest.json
+++ b/playbook/shopfloor-setup/gea-shopfloor-keyence/keyence-manifest.json
@@ -3,7 +3,7 @@
   "_comment": "Keyence machine-app manifest, imaging-time only. Consumed by 09-Setup-Keyence.ps1, reading from the in-repo shopfloor-setup/Keyence/ dir xcopied by startnet.cmd. Ongoing enforcement is handled separately by GE-Enforce reading keyence/manifest.json from the tsgwp00525 share. Each entry has an InstallerRoot-relative 'Installer' path plus standard detection. The 'Type' field is MSI, EXE, or INF: INF invokes pnputil /add-driver /install. When releasing a new VR-6000 version, update the Installer path + DetectionValue here AND on the share manifest.",
   "Applications": [
     {
-      "_comment": "VR-6000 Series Software - main Keyence microscope/profilometer control app. Extracted from Keyence6000.exe (Inno Setup wrapper around an InstallShield 2019 MSI). Silent install works fine with /qn + REBOOT=ReallySuppress as long as you bypass the Inno wrapper - the wrapper's [Run] entry calls the bundled InstallShield Setup.exe without silent flags which hangs in session 0.",
+      "_comment": "VR-6000 Series Software - main Keyence microscope/profilometer control app. Extracted from Keyence6000.exe (Inno Setup wrapper around an InstallShield 2019 MSI). Silent install works fine with /qn + REBOOT=ReallySuppress as long as you bypass the Inno wrapper - the wrapper's [Run] entry calls the bundled InstallShield Setup.exe without silent flags which hangs in session 0. The MSI references Data1.cab (560 MB compressed payload) in the same directory; that cab is gitignored. Stage from tsgwp00525\\sfld$\\v2\\shared\\dt\\shopfloor\\gea-shopfloor-keyence\\apps\\Data1.cab into installers/ before building the USB. Missing cab = msiexec exit 1603 with 'SECREPAIR: Failed to open ... Data1.cab' in the verbose MSI log.",
       "Name": "VR-6000 Series Software",
       "Installer": "installers\\VR-6000 Series Software.msi",
       "Type": "MSI",