diff --git a/features.in/cleanup/live/image-scripts.d/80locales b/features.in/cleanup/live/image-scripts.d/80locales
index fe6bafaa..f6c81d29 100755
--- a/features.in/cleanup/live/image-scripts.d/80locales
+++ b/features.in/cleanup/live/image-scripts.d/80locales
@@ -2,6 +2,7 @@
 # FIXME: there should be less brutal i18n tuning
 
 cd /usr/share/locale
+rm -r *@*
 for i in */; do
 	case "$i" in
 	be*|en*|ru*|uk*) continue;;
diff --git a/features.in/cleanup/live/image-scripts.d/90cleanup-docs b/features.in/cleanup/live/image-scripts.d/90cleanup-docs
new file mode 100755
index 00000000..7476d47d
--- /dev/null
+++ b/features.in/cleanup/live/image-scripts.d/90cleanup-docs
@@ -0,0 +1,5 @@
+#!/bin/sh
+# remove all docs
+
+rpmquery -ad |grep ^/ |xargs -r rm -f --
+rm -rf /usr/share/{doc,man,info,license,gfxboot}
diff --git a/features.in/cleanup/live/image-scripts.d/99cleanupdb b/features.in/cleanup/live/image-scripts.d/99cleanupdb
index 3ca8aa03..9de55fdd 100755
--- a/features.in/cleanup/live/image-scripts.d/99cleanupdb
+++ b/features.in/cleanup/live/image-scripts.d/99cleanupdb
@@ -1,3 +1,15 @@
 #!/bin/sh
-# remove rpm, apt databases and cache
-find /var/lib/rpm /var/lib/apt /var/cache/apt -type f -delete
+# dump what's here by this point
+echo "** live packages before rpmdb purge:"
+rpmquery -a --qf='%{NAME} %{VERSION}-%{RELEASE}\n'
+
+# remove apt database and cache
+find /var/lib/apt /var/cache/apt -type f -delete
+
+# not going to need them without rpmdb, it's not even rescue anymore
+rpm -e --nodeps apt libapt rpm librpmbuild librpm 2>/dev/null ||:
+
+# finally, drop rpmdb
+find /var/lib/rpm -type f -delete
+
+:
diff --git a/features.in/dos/stage1/scripts.d/50-make-dos-floppy b/features.in/dos/stage1/scripts.d/50-make-dos-floppy
index 9adeb637..055dca92 100755
--- a/features.in/dos/stage1/scripts.d/50-make-dos-floppy
+++ b/features.in/dos/stage1/scripts.d/50-make-dos-floppy
@@ -1,4 +1,4 @@
-#!/bin/sh -x
+#!/bin/sh
 # create a barebone bootable freedos floppy
 # TODO: some sub-framework to populate it as well
 
diff --git a/features.in/install2/install2/image-scripts.d/90+install2+cleanup+bloat b/features.in/install2/install2/image-scripts.d/90+install2+cleanup+bloat
index 5642f897..74643c1f 100755
--- a/features.in/install2/install2/image-scripts.d/90+install2+cleanup+bloat
+++ b/features.in/install2/install2/image-scripts.d/90+install2+cleanup+bloat
@@ -27,6 +27,4 @@ rpmquery -a cpp\* gcc\* perl-base file ipv6calc \
 rpmquery -a bind-utils libbind \
 | xargs -r rpmi -e --
 
-# outstanding binaries
-rm -f /sbin/{sln,tc}
-rm -f /usr/bin/openssl
+:
diff --git a/features.in/install2/install2/image-scripts.d/90+install2+cleanup+drivers b/features.in/install2/install2/image-scripts.d/90+install2+cleanup+drivers
index d2653783..a3417a91 100755
--- a/features.in/install2/install2/image-scripts.d/90+install2+cleanup+drivers
+++ b/features.in/install2/install2/image-scripts.d/90+install2+cleanup+drivers
@@ -107,17 +107,3 @@ rm -rf /lib/modules/*/kernel/net/tipc
 rm -rf /lib/modules/*/kernel/net/{wimax,wireless,mac80211}
 rm -rf /lib/modules/*/kernel/net/x25
 rm -rf /lib/modules/*/kernel/sound
-
-# blacklisted kernel modules
-sed -n 's/^blacklist[[:space:]]\+\([^[:space:]]\+\).*/\1/p' /etc/modprobe.d/* |
-	while read i; do
-		find /lib/modules/ -type f -name "$i.ko" -delete
-	done
-
-# regenerate module dependencies
-for i in /lib*/modules/*; do
-	/sbin/depmod -a -F /boot/System.map-${i##*/} ${i##*/}
-done
-
-# kernel images
-rm -rf /boot/*
diff --git a/features.in/install2/install2/image-scripts.d/90+install2+cleanup+l10n b/features.in/install2/install2/image-scripts.d/90+install2+cleanup+l10n
index 1b412c98..3463968f 100755
--- a/features.in/install2/install2/image-scripts.d/90+install2+cleanup+l10n
+++ b/features.in/install2/install2/image-scripts.d/90+install2+cleanup+l10n
@@ -12,11 +12,14 @@ rm -f /usr/lib*/gconv/BIG5*
 rm -f /usr/lib*/gconv/EBCDIC*
 
 # en_* variations
-rm -rf /usr/{lib*,share}/locale/en_[^U]*
+rm -rf /usr/{lib,share}/locale/en_[^U]*
+
+# mods
+rm -rf /usr/{lib,share}/locale/*@*
 
 # non-utf8 locales
-find /usr/lib*/locale -mindepth 1 -maxdepth 1 -type d \! -name '*.utf8' -print0 |
+find /usr/lib/locale -mindepth 1 -maxdepth 1 -type d \! -name '*.utf8' -print0 |
         xargs -r0 rm -rf --
 
 # dangling symlinks
-find /usr/lib*/locale \! -readable -delete
+find /usr/lib/locale \! -readable -delete
diff --git a/features.in/install2/install2/image-scripts.d/99cleanupdb b/features.in/install2/install2/image-scripts.d/99cleanupdb
index 3ca8aa03..38ac5a8f 100755
--- a/features.in/install2/install2/image-scripts.d/99cleanupdb
+++ b/features.in/install2/install2/image-scripts.d/99cleanupdb
@@ -1,3 +1,12 @@
 #!/bin/sh
+# dump what's here by this point
+echo "** install2 packages before rpmdb purge:"
+rpmquery -a --qf='%{NAME} %{VERSION}-%{RELEASE}\n'
+
+# not going to need them without rpmdb, it's not even rescue anymore
+apt-get remove -f -y apt libapt
+
 # remove rpm, apt databases and cache
 find /var/lib/rpm /var/lib/apt /var/cache/apt -type f -delete
+
+:
diff --git a/features.in/live/live/image-scripts.d/30-users b/features.in/live/live/image-scripts.d/30-users
index 8e130ed6..48514d04 100755
--- a/features.in/live/live/image-scripts.d/30-users
+++ b/features.in/live/live/image-scripts.d/30-users
@@ -1,4 +1,4 @@
-#!/bin/sh -x
+#!/bin/sh
 # * reset password for root
 # * add user `altlinux' (without password)
 
diff --git a/features.in/live/live/image-scripts.d/90-cleanup-boot b/features.in/live/live/image-scripts.d/90-cleanup-boot
deleted file mode 100755
index 96dd8f8f..00000000
--- a/features.in/live/live/image-scripts.d/90-cleanup-boot
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/bin/sh
-# we don't really need the kernel in live root,
-# it's been booted already (unless it's a live-install)
-
-rpm -q live-install || rm -f /boot/*
-:
diff --git a/features.in/syslinux/scripts.d/20-propagator-ramdisk b/features.in/syslinux/scripts.d/20-propagator-ramdisk
index f0dd4ed2..739e9bb4 100755
--- a/features.in/syslinux/scripts.d/20-propagator-ramdisk
+++ b/features.in/syslinux/scripts.d/20-propagator-ramdisk
@@ -1,4 +1,4 @@
-#!/bin/sh -x
+#!/bin/sh
 # postprocess isolinux configuration
 # when the image sizes are finally known
 
diff --git a/sub.in/stage2/image-scripts.d/85cleanup-cjk b/sub.in/stage2/image-scripts.d/85cleanup-cjk
index db7c44a0..102fdca9 100755
--- a/sub.in/stage2/image-scripts.d/85cleanup-cjk
+++ b/sub.in/stage2/image-scripts.d/85cleanup-cjk
@@ -14,7 +14,7 @@ cd /usr/share/X11/locale && rm -rf ja* ko* th* vi* zh*
 cd /usr/share/X11/xkb/symbols && rm -rf jp kr th vn cn
 
 # locales
-cd /usr/lib*/locale && rm -rf ja_* ko_* th_* zh_*
+cd /usr/lib/locale && rm -rf ja_* ko_* th_* zh_*
 
 # gconv
 cd /usr/lib*/gconv && rm -f JIS* T*
diff --git a/sub.in/stage2/image-scripts.d/90cleanup-bloat-bin b/sub.in/stage2/image-scripts.d/90cleanup-bloat-bin
new file mode 100755
index 00000000..4403fb05
--- /dev/null
+++ b/sub.in/stage2/image-scripts.d/90cleanup-bloat-bin
@@ -0,0 +1,6 @@
+#!/bin/sh
+# outstanding binaries
+
+rm -f /sbin/{sash,sln,tc}
+rm -f /usr/bin/{openssl,ipv6log*}
+rm -f /bin/ipv6calc
diff --git a/sub.in/stage2/image-scripts.d/90cleanup-drm b/sub.in/stage2/image-scripts.d/90cleanup-drm
new file mode 100755
index 00000000..241160dc
--- /dev/null
+++ b/sub.in/stage2/image-scripts.d/90cleanup-drm
@@ -0,0 +1,5 @@
+#!/bin/sh
+# no sense in xorg-dri-* without kernel-modules-drm*
+
+stat /lib/modules/*/kernel/drivers/gpu/drm >&/dev/null \
+|| rm -rf /usr/lib*/X11/modules/dri/
diff --git a/sub.in/stage2/image-scripts.d/97cleanup-blacklisted b/sub.in/stage2/image-scripts.d/97cleanup-blacklisted
new file mode 100755
index 00000000..9c372598
--- /dev/null
+++ b/sub.in/stage2/image-scripts.d/97cleanup-blacklisted
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+# blacklisted kernel modules
+sed -n 's/^blacklist[[:space:]]\+\([^[:space:]]\+\).*/\1/p' /etc/modprobe.d/* |
+	while read i; do
+		find /lib/modules/ -type f -name "$i.ko" -delete
+	done
diff --git a/sub.in/stage2/image-scripts.d/98depmod b/sub.in/stage2/image-scripts.d/98depmod
new file mode 100755
index 00000000..2e4be5e6
--- /dev/null
+++ b/sub.in/stage2/image-scripts.d/98depmod
@@ -0,0 +1,8 @@
+#!/bin/sh
+# regenerate module dependencies after pruning kernel modules
+# (this script must run after anything touching /lib/modules)
+
+cd /lib/modules
+for i in *.*; do
+	depmod -a -F /boot/System.map-$i $i
+done
diff --git a/sub.in/stage2/image-scripts.d/99cleanup-boot b/sub.in/stage2/image-scripts.d/99cleanup-boot
new file mode 100755
index 00000000..b98ecf16
--- /dev/null
+++ b/sub.in/stage2/image-scripts.d/99cleanup-boot
@@ -0,0 +1,6 @@
+#!/bin/sh
+# no need for the kernel in live root
+# (unless it's a live-install):
+# it's been booted already
+
+[ -x /usr/sbin/live-install ] || rm -f /boot/*