diff --git a/playbook/blancco-init.sh b/playbook/blancco-init.sh
index 70fae8e..662986f 100644
--- a/playbook/blancco-init.sh
+++ b/playbook/blancco-init.sh
@@ -192,6 +192,24 @@ if ! wget -q -T 30 -O /run/newroot/albus/config.xml "http://$SERVER/blancco/conf
     exec /bin/sh
 fi
 
+# On a native boot config.img is an initrd, its files land in the
+# initramfs root and archiso keeps them in /run/initramfs, where Blancco's
+# /opt/scripts/inc/* pick up report.key (report signing), certificate.ca,
+# hybrid.ids and flexible_container. This path never had them, so
+# 1_reportKey wrote an empty /albus/report.key. Recreate the layout on a
+# tmpfs at the new root's /run; systemd leaves an existing /run mounted.
+mount -t tmpfs -o mode=0755,nosuid,nodev tmpfs /run/newroot/run
+mkdir -p /run/newroot/run/initramfs
+if wget -q -T 30 -O /tmp/config.img "http://$SERVER/blancco/config.img" &&
+   (cd /run/newroot/run/initramfs && cpio -id < /tmp/config.img 2>/dev/null) &&
+   [ -s /run/newroot/run/initramfs/report.key ]; then
+    dbg ls -la /run/newroot/run/initramfs
+else
+    echo "ERROR: config.img (report key, certificate) download or unpack failed."
+    exec /bin/sh
+fi
+rm -f /tmp/config.img
+
 mkdir -p /run/newroot/etc/X11/xorg.conf.d
 # Don't pin a single Xorg driver - hardware varies per site (Intel iGPU,
 # NVIDIA GK208, AMD, etc). Let Xorg auto-pick. With nomodeset + KMS