diff --git a/docs/SITE-CUSTOMIZATION.md b/docs/SITE-CUSTOMIZATION.md
index 543470b..4f7175b 100644
--- a/docs/SITE-CUSTOMIZATION.md
+++ b/docs/SITE-CUSTOMIZATION.md
@@ -98,7 +98,7 @@ credentials in plaintext. These are GE-Aerospace specific.
 | Value         | Default              | Where it lives                                                          |
 |---------------|----------------------|-------------------------------------------------------------------------|
 | WiFi SSID     | INTERNETACCESS       | `boot-tools/blancco/config.img` (inside the cpio archive: preferences.xml) |
-| WiFi password | Acc3ssGr@nted22      | Same                                                                    |
+| WiFi password | (per site)           | Webapp: Updates > Blancco releases > Site settings                      |
 | BMC endpoint  | classic.eu-west-1.blancco.cloud:443 | Same; encrypted credentials inside config.img        |
 
 To rebuild `config.img` for a different site, see BLANCCO.md ("Rebuilding
@@ -250,7 +250,7 @@ credentials:
 
 blancco:
   wifi_ssid: INTERNETACCESS
-  wifi_password: Acc3ssGr@nted22
+  wifi_password: <per site, set in the webapp>
   bmc_endpoint: classic.eu-west-1.blancco.cloud:443
 
 ppkg_versions:
diff --git a/docs/kb/How_To_Deploy_PXE_Server_New_Site.html b/docs/kb/How_To_Deploy_PXE_Server_New_Site.html
index e47b362..0b3ce83 100644
--- a/docs/kb/How_To_Deploy_PXE_Server_New_Site.html
+++ b/docs/kb/How_To_Deploy_PXE_Server_New_Site.html
@@ -580,7 +580,7 @@
 
             <div class="alert alert-info">
                 <strong>Build folder:</strong>
-                The <span class="command-inline">pxe-usb</span> folder holds everything the server needs offline: the Ubuntu installer, packages, the setup, the web interface, boot files, Blancco and Clonezilla. Get the current copy from: <span class="highlight">&lt;build folder location&gt;</span>. Always use a fresh copy; never edit files in it.
+                The <span class="command-inline">pxe-usb</span> folder holds everything the server needs offline: the Ubuntu installer, packages, the setup, the web interface, boot files and Clonezilla (Blancco is loaded in Part 4). Get the current copy from: <span class="highlight">&lt;build folder location&gt;</span>. Always use a fresh copy; never edit files in it.
             </div>
 
             <!-- PART 1 -->
@@ -735,8 +735,14 @@ powershell -ExecutionPolicy Bypass -File .\scripts\Build-PxeUsb.ps1 -Interactive
 
             <div class="step">
                 <span class="step-number">Step 3</span>
-                <h3>Blancco site settings</h3>
-                <p>Open <strong>Updates &gt; Blancco releases</strong> and fill in <strong>Site settings</strong>:</p>
+                <h3>Blancco</h3>
+                <p>The <span class="command-inline">pxe-usb</span> folder carries no Blancco release: each site loads its own. Until it does, the Blancco entry in the PXE menu does not boot.</p>
+                <ol>
+                    <li>Download <strong>Blancco Drive Eraser 7.20</strong> (the ISO, or the USB image) from the Blancco portal. Use 7.20: a newer version stops at staging until the preferences are merged for it.</li>
+                    <li>Open <strong>Updates &gt; Blancco releases</strong>, upload it under <strong>Release files</strong> and click <strong>Stage</strong>. The server writes the GE preferences (report share, licensing) into it.</li>
+                    <li>Click <strong>Add test entry</strong>, boot a test PC from the new entry in the PXE menu, and check that Blancco starts and licenses. Then click <strong>Activate</strong>.</li>
+                </ol>
+                <p>Then fill in <strong>Site settings</strong> on the same page:</p>
                 <ul>
                     <li><strong>Business location</strong>: your site, as it should appear on every erasure report.</li>
                     <li><strong>Wi-Fi network (SSID)</strong> and <strong>Wi-Fi password</strong>: the internet-only Wi-Fi Blancco joins to license each erasure in the GE Blancco cloud. Usually <span class="command-inline">INTERNETACCESS</span>; the password differs between sites, so get yours from the site network team.</li>
diff --git a/scripts/stage-usb-share.sh b/scripts/stage-usb-share.sh
index 08e4f6c..a58f68a 100755
--- a/scripts/stage-usb-share.sh
+++ b/scripts/stage-usb-share.sh
@@ -4,7 +4,7 @@
 # on a share, so a Windows PC can build the installer USB from it.
 #
 # Usage:
-#   scripts/stage-usb-share.sh [--iso FILE] [--payload-root DIR] [DEST]
+#   scripts/stage-usb-share.sh [--iso FILE] [--payload-root DIR] [--no-blancco-release] [DEST]
 #
 # DEST defaults to ~/pxe-images/pxe-usb (the [pxe-images] Samba share; on
 # the work PC: \\<this PC>\pxe-images\pxe-usb, usually Z:\pxe-usb). It gets:
@@ -18,6 +18,12 @@
 # Then on the work PC: copy the folder to a local disk (C:\pxe-usb) and
 # double-click Build-PxeUsb.cmd (KB: docs/kb/How_To_Deploy_PXE_Server_New_Site.html).
 #
+# --no-blancco-release leaves out the Blancco release (the vendor files from
+# boot-tools/blancco: kernel, initramfs, microcode, rootfs, and config.img
+# with this site's preferences and licence files) and the unused
+# blancco-uki.efi. Use it for a folder going to another site: that site
+# uploads its own Blancco ISO on Updates > Blancco releases.
+#
 # The new copy is built beside the old one and swapped in when complete.
 # Run capture-site-content.sh --apply first so site-content/ is current.
 
@@ -27,11 +33,13 @@ REPO_ROOT="$(cd "$(dirname "$0")"/.. && pwd)"
 PAYLOAD_ROOT="$REPO_ROOT"
 ISO=""
 DEST=""
+NO_BLANCCO_RELEASE=0
 
 while [ $# -gt 0 ]; do
     case "$1" in
         --iso) ISO="${2:?}"; shift 2 ;;
         --payload-root) PAYLOAD_ROOT="$(cd "${2:?}" && pwd)"; shift 2 ;;
+        --no-blancco-release) NO_BLANCCO_RELEASE=1; shift ;;
         -h|--help) sed -n '2,/^$/p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
         -*) echo "unknown option $1" >&2; exit 2 ;;
         *) DEST="$1"; shift ;;
@@ -86,6 +94,13 @@ for d in offline-packages pip-wheels boot-files boot-tools enrollment bios-stagi
     link_or_copy "$src" "$NEW/$d"
     printf '    %-17s %s\n' "$d" "$(du -sh "$NEW/$d" | cut -f1)"
 done
+if [ "$NO_BLANCCO_RELEASE" = 1 ]; then
+    # Hard links: removing them here leaves the payload copies alone.
+    B="$NEW/boot-tools/blancco"
+    rm -rf -- "$B/arch" "$B/vmlinuz-bde-linux" "$B/initramfs-bde-linux.img" \
+        "$B/intel-ucode.img" "$B/amd-ucode.img" "$B/config.img" "$B/blancco-uki.efi"
+    echo "    Blancco release   left out (--no-blancco-release)"
+fi
 link_or_copy "$ISO" "$NEW/$(basename "$ISO")"
 echo "    ISO               $(basename "$ISO")"
 
@@ -94,6 +109,7 @@ echo "    ISO               $(basename "$ISO")"
     echo "Commit: $(git log -1 --format='%h %s')"
     echo "ISO: $(basename "$ISO")"
     echo "Payload root: $PAYLOAD_ROOT"
+    [ "$NO_BLANCCO_RELEASE" = 1 ] && echo "Blancco release: not included (upload one on Updates > Blancco releases)"
     echo
     echo "On the Windows PC:"
     echo "  1. Copy this whole folder to a local disk, e.g. C:\\pxe-usb"