diff --git a/profiles/hardened-plasma-systemd/patches/app-admin/mkosi/mkosi-gentoo-pkg-remove.patch b/profiles/hardened-plasma-systemd/patches/app-admin/mkosi/mkosi-gentoo-pkg-remove.patch
new file mode 100644
index 0000000..891dd38
--- /dev/null
+++ b/profiles/hardened-plasma-systemd/patches/app-admin/mkosi/mkosi-gentoo-pkg-remove.patch
@@ -0,0 +1,155 @@
+diff --git a/mkosi/installer/__init__.py b/mkosi/installer/__init__.py
+index fa7418ae09a6..5d64801bbe52 100644
+--- a/mkosi/installer/__init__.py
++++ b/mkosi/installer/__init__.py
+@@ -157,7 +157,8 @@ class PackageManager:
+ 
+     @classmethod
+     def remove(cls, context: Context, packages: Sequence[str]) -> None:
+-        pass
++        raise NotImplementedError()
++        #pass
+ 
+     @classmethod
+     def sync(cls, context: Context, force: bool) -> None:
+diff --git a/mkosi/installer/emerge.py b/mkosi/installer/emerge.py
+index a6d9ce9b00ec..f6b243ad55d7 100644
+--- a/mkosi/installer/emerge.py
++++ b/mkosi/installer/emerge.py
+@@ -48,10 +48,10 @@ class Emerge(PackageManager):
+     def scripts(cls, context: Context) -> dict[str, list[PathString]]:
+         return {
+             "emerge": cls.apivfs_script_cmd(context) + cls.env_cmd(context) + cls.cmd(context),
+-            "mkosi-install": ["emerge"],
+-            "mkosi-upgrade": ["emerge", "--update"],
+-            "mkosi-remove": ["emerge", "--unmerge"],
+-            "mkosi-reinstall": ["emerge"],
++            "mkosi-install": ["--update"],
++            "mkosi-upgrade": ["--update", "--deep", "@world"],
++            "mkosi-remove": ["--unmerge", "--with-bdeps=y"],
++            "mkosi-reinstall": [],
+         }
+ 
+     # TODO: remove this if it's identical to super
+@@ -126,8 +126,37 @@ class Emerge(PackageManager):
+         # "--ro-bind", cls.stage3 / "etc/xml", cls.installroot / "etc/xml",
+         # "--symlink", cls.installroot / "etc/xml", "/etc/xml",
+ 
++        #(context.root / "usr/share/openpgp-keys").mkdir(parents=True, exist_ok=True)
++        #(context.root / "usr/bin").mkdir(parents=True, exist_ok=True)
++        #copy_tree(
++        #    cls.stage3 / "usr/share/openpgp-keys/gentoo-release.asc",
++        #    context.root / "usr/share/openpgp-keys/gentoo-release.asc",
++        #    dereference=True,
++        #    sandbox=context.sandbox,
++        #)
++        #copy_tree(
++        #    cls.stage3 / "usr/bin/getuto",
++        #    context.root / "usr/bin/getuto",
++        #    dereference=True,
++        #    sandbox=context.sandbox,
++        #)
++        
++        # Получаем путь назначения ВНУТРИ overlay/sandbox
++        sandbox_dest = context.root / "etc/portage/make.profile"
++        
++        # Гарантируем существование родительского каталога
++#        sandbox_dest_parent = sandbox_dest.parent
++#        if not sandbox_dest_parent.exists():
++#            print(f"Creating missing directory in sandbox: {sandbox_dest_parent}")
++#            sandbox_dest_parent.mkdir(parents=True, exist_ok=True)
++
++#        print("Destination dir contents:")
++#        if sandbox_dest.exists():
++#            for entry in sandbox_dest.iterdir():
++#                print(entry, ":", "dir" if entry.is_dir() else "symlink" if entry.is_symlink() else "file")
++            
+         # /etc/portage/make.profile is not a symlink and will probably prevent most merges.
+-        mounts += ["--symlink", (cls.stage3 / "etc/portage/make.profile").readlink(), cls.installroot / "etc/portage/make.profile"]  # fmt: skip
++        #mounts += ["--symlink", (cls.stage3 / "etc/portage/make.profile").readlink(), cls.installroot / "etc/portage/make.profile"]  # fmt: skip
+ 
+         return mounts
+ 
+@@ -162,7 +191,7 @@ class Emerge(PackageManager):
+ 
+         if not (stage3_cache_dir / current).exists():
+             output_dir = stage3_cache_dir / current.parent
+-            with complete_step(f"Fetching the latest stage3 snapshot into {stage3_cache_dir / current}"):
++            with complete_step(f"Fetching the latest stage3 snapshot from {stage3_url} into {stage3_cache_dir / current}"):
+                 for i in stage3_cache_dir.iterdir():
+                     if i.is_dir() and i != output_dir:
+                         rmtree(i)
+@@ -221,18 +250,19 @@ class Emerge(PackageManager):
+     def cmd(cls, context: Context) -> list[PathString]:
+         return [
+             cls.executable(context.config),
+-            "--buildpkg=y",
++            #"--buildpkg=y",
+             "--usepkg=y",
+-            # "--getbinpkg=y",
+-            "--binpkg-respect-use=y",
++            "--usepkgonly=y",
++            #"--getbinpkg=y",
++            "--binpkg-respect-use=n",
+             "--jobs",
+             "--load-average",
+             "--root-deps=rdeps",
+             "--with-bdeps-auto=n",
+             "--verbose-conflicts",
+             "--noreplace",
+-            "--update",
+-            "--newuse",
++            #"--update",
++            #"--newuse",
+             *(["--verbose", "--quiet-fail=n"] if ARG_DEBUG.get() else ["--quiet-build", "--quiet"]),
+             f"--root={cls.installroot}",
+         ]
+@@ -298,11 +328,25 @@ class Emerge(PackageManager):
+                 petition the upstream to ship git with stage3
+             """)
+             )
+-            # run(
+-            #     ["emerge-webrsync", "--verbose"],
+-            #     sandbox=cls.sandbox(context, apivfs=False),
+-            #     env={'HOME': '/var/lib/portage/home'}
+-            # )
++            #run(
++            #    ["emerge-webrsync", "--verbose"],
++            #    sandbox=cls.sandbox(context, apivfs=False),
++            #    env={'HOME': '/var/lib/portage/home'}
++            #)
++            #run(
++            #    ["emerge", "sec-keys/openpgp-keys-gentoo-release"],
++            #    sandbox=cls.sandbox(context, apivfs=False),
++            #    env={'ROOT': cls.installroot}
++            #)
++            #run(
++            #    ["getuto"],
++            #    sandbox=cls.sandbox(context, apivfs=False)
++            #)
++            #run(
++            #    ["ls", "-l", "/tmp/root/etc/portage"],
++            #    sandbox=cls.sandbox(context, apivfs=False),
++            #    env={'HOME': '/var/lib/portage/home'}
++            #)
+ 
+         if not force:
+             return
+@@ -326,4 +370,16 @@ class Emerge(PackageManager):
+         *,
+         apivfs: bool = True,
+     ) -> None:
+-        cls.invoke(context, cls.installroot, (), packages, apivfs=apivfs)
++        prefix = cls.scripts(context)["mkosi-install"]
++        cls.invoke(context, cls.installroot, packages, options=prefix, apivfs=apivfs)
++
++    @classmethod
++    def remove(
++        cls,
++        context: Context,
++        packages: Sequence[str],
++        *,
++        apivfs: bool = True,
++    ) -> None:
++        prefix = cls.scripts(context)["mkosi-remove"]
++        cls.invoke(context, cls.installroot, arguments=list(packages), options=prefix, apivfs=True)