diff --git a/pkgbuilds/omarchy-dev/PKGBUILD b/pkgbuilds/omarchy-dev/PKGBUILD
index fac61dba5..75d856697 100644
--- a/pkgbuilds/omarchy-dev/PKGBUILD
+++ b/pkgbuilds/omarchy-dev/PKGBUILD
@@ -94,16 +94,16 @@ prepare() {
 package() {
   cd "$srcdir/omarchy"
 
-  # Runtime binaries — ship everything in bin/ except the debug helpers
-  # that ship from omarchy-settings (needed before omarchy is installed,
-  # e.g. on the ISO live env).
+  # Runtime binaries — omarchy-settings-dev owns the debug helpers and their
+  # shared security library because they are needed before omarchy-dev is
+  # installed (for example, in the ISO live environment).
   install -d "$pkgdir/usr/bin" "$pkgdir/usr/share/omarchy/bin"
   for bin in bin/*; do
     [[ -f $bin ]] || continue
     local base
     base=$(basename "$bin")
     case "$base" in
-      omarchy-debug|omarchy-debug-idle|omarchy-upload-log)
+      omarchy-debug|omarchy-debug-idle|omarchy-upload-log|omarchy-security-functions)
         continue
         ;;
     esac
diff --git a/pkgbuilds/omarchy-settings-dev/PKGBUILD b/pkgbuilds/omarchy-settings-dev/PKGBUILD
index 9fe2d8af4..7e1793e1a 100644
--- a/pkgbuilds/omarchy-settings-dev/PKGBUILD
+++ b/pkgbuilds/omarchy-settings-dev/PKGBUILD
@@ -351,4 +351,10 @@ EOF
   install -Dm755 bin/omarchy-upload-log "$pkgdir/usr/bin/omarchy-upload-log"
   install -Dm755 bin/omarchy-debug      "$pkgdir/usr/bin/omarchy-debug"
   install -Dm755 bin/omarchy-debug-idle "$pkgdir/usr/bin/omarchy-debug-idle"
+  if [[ -f bin/omarchy-security-functions ]]; then
+    install -Dm755 bin/omarchy-security-functions "$pkgdir/usr/bin/omarchy-security-functions"
+    install -d "$pkgdir/usr/share/omarchy/bin"
+    ln -s /usr/bin/omarchy-security-functions \
+      "$pkgdir/usr/share/omarchy/bin/omarchy-security-functions"
+  fi
 }
diff --git a/pkgbuilds/omarchy-settings/PKGBUILD b/pkgbuilds/omarchy-settings/PKGBUILD
index e48f36bc5..cc522167d 100644
--- a/pkgbuilds/omarchy-settings/PKGBUILD
+++ b/pkgbuilds/omarchy-settings/PKGBUILD
@@ -346,4 +346,10 @@ EOF
   install -Dm755 bin/omarchy-upload-log "$pkgdir/usr/bin/omarchy-upload-log"
   install -Dm755 bin/omarchy-debug      "$pkgdir/usr/bin/omarchy-debug"
   install -Dm755 bin/omarchy-debug-idle "$pkgdir/usr/bin/omarchy-debug-idle"
+  if [[ -f bin/omarchy-security-functions ]]; then
+    install -Dm755 bin/omarchy-security-functions "$pkgdir/usr/bin/omarchy-security-functions"
+    install -d "$pkgdir/usr/share/omarchy/bin"
+    ln -s /usr/bin/omarchy-security-functions \
+      "$pkgdir/usr/share/omarchy/bin/omarchy-security-functions"
+  fi
 }
diff --git a/pkgbuilds/omarchy/PKGBUILD b/pkgbuilds/omarchy/PKGBUILD
index a3af2e870..76beb969f 100644
--- a/pkgbuilds/omarchy/PKGBUILD
+++ b/pkgbuilds/omarchy/PKGBUILD
@@ -94,16 +94,16 @@ prepare() {
 package() {
   cd "$srcdir/omarchy"
 
-  # Runtime binaries — ship everything in bin/ except the debug helpers
-  # that ship from omarchy-settings (needed before omarchy is installed,
-  # e.g. on the ISO live env).
+  # Runtime binaries — omarchy-settings owns the debug helpers and their
+  # shared security library because they are needed before omarchy is installed
+  # (for example, in the ISO live environment).
   install -d "$pkgdir/usr/bin" "$pkgdir/usr/share/omarchy/bin"
   for bin in bin/*; do
     [[ -f $bin ]] || continue
     local base
     base=$(basename "$bin")
     case "$base" in
-      omarchy-debug|omarchy-debug-idle|omarchy-upload-log)
+      omarchy-debug|omarchy-debug-idle|omarchy-upload-log|omarchy-security-functions)
         continue
         ;;
     esac