diff --git a/wrolpi-portable/config/includes.chroot/usr/local/sbin/wrolpi-portable-bootstrap.sh b/wrolpi-portable/config/includes.chroot/usr/local/sbin/wrolpi-portable-bootstrap.sh
index f70d670c..9e6efa0f 100644
--- a/wrolpi-portable/config/includes.chroot/usr/local/sbin/wrolpi-portable-bootstrap.sh
+++ b/wrolpi-portable/config/includes.chroot/usr/local/sbin/wrolpi-portable-bootstrap.sh
@@ -21,6 +21,18 @@ set -euo pipefail
 
 log() { echo "[wrolpi-portable-bootstrap] $*"; }
 
+# Show progress on the Plymouth splash so the user sees what's happening
+# during the 30-60s first-boot work.  Plymouth is up between initramfs and
+# lightdm starting; we block lightdm via systemd ordering, so the splash
+# owns the screen for our entire run.  Falls back to log-only if Plymouth
+# isn't active (e.g. running this script manually over SSH).
+progress() {
+  plymouth display-message --text="$1" 2>/dev/null || true
+  log "$1"
+}
+
+progress "Preparing WROLPi Portable..."
+
 # --- Identify the boot drive ---------------------------------------------
 
 # live-boot uses one of these mount points depending on version / config.
@@ -42,7 +54,7 @@ log "live medium $BOOT_PART on $BOOT_DRIVE"
 
 PERSIST_PART=$(blkid -L persistence 2>/dev/null || true)
 if [ -z "$PERSIST_PART" ]; then
-  log "no persistence partition found; creating one on $BOOT_DRIVE"
+  progress "Creating persistence partition on $BOOT_DRIVE..."
   # Compute next 1-MiB-aligned start sector after the last existing partition.
   LAST_END=$(sfdisk -d "$BOOT_DRIVE" | awk '/^\/dev\// {n=$4+$6} END{print n}')
   START=$(( ((LAST_END + 2047) / 2048) * 2048 ))
@@ -61,7 +73,7 @@ if [ -z "$PERSIST_PART" ]; then
     log "ERROR: failed to locate the newly created persistence partition"
     exit 1
   fi
-  log "formatting $PERSIST_PART as ext4 with label 'persistence'"
+  progress "Formatting $PERSIST_PART as ext4..."
   mkfs.ext4 -L persistence -F "$PERSIST_PART"
 fi
 
@@ -101,15 +113,16 @@ bind_if_unmounted /mnt/persistence/wrolpi            /media/wrolpi
 # --- Postgres cluster ----------------------------------------------------
 
 if ! pg_lsclusters -h | awk '{print $1,$2}' | grep -q "^15 main$"; then
-  log "creating Postgres cluster 15/main on persistence"
+  progress "Setting up Postgres cluster..."
   pg_createcluster 15 main
 fi
+progress "Starting Postgres..."
 systemctl start postgresql@15-main.service
 
 # --- WROLPi DB schema + initial config import ----------------------------
 
 if ! sudo -iu postgres psql -lqt | cut -d \| -f 1 | grep -qw wrolpi; then
-  log "initializing WROLPi database"
+  progress "Initializing WROLPi database (this can take a minute)..."
   /opt/wrolpi/scripts/initialize_api_db.sh
 fi
 
@@ -117,12 +130,13 @@ fi
 # CA persists in /media/wrolpi/config/ssl/ (created on first run).  Leaf
 # cert is regenerated every boot so SANs reflect the current hostname/IP.
 
+progress "Generating TLS certificate..."
 /opt/wrolpi/scripts/generate_certificates.sh
 
 # --- Caddy: swap onboarding stub for the full Caddyfile if needed --------
 
 if ! diff -q /opt/wrolpi/etc/raspberrypios/Caddyfile /etc/caddy/Caddyfile >/dev/null 2>&1; then
-  log "swapping onboarding Caddyfile for the full Caddyfile"
+  progress "Configuring Caddy..."
   cp /opt/wrolpi/etc/raspberrypios/Caddyfile /etc/caddy/Caddyfile
   systemctl restart caddy || true
 fi
@@ -135,6 +149,8 @@ chown wrolpi:wrolpi /media/wrolpi/config
 
 # --- Enable and start the WROLPi runtime services -----------------------
 
+progress "Starting WROLPi services..."
 systemctl enable --now wrolpi-api.service wrolpi-app.service wrolpi-kiwix.service
 
+progress "WROLPi Portable is ready."
 log "bootstrap complete"