diff --git a/README.md b/README.md
index 26a9ba3..bff0809 100644
--- a/README.md
+++ b/README.md
@@ -8,8 +8,11 @@ or `dd`) and you get a reproducible, minimal Arch server that's ready for
 self-hosting in minutes.
 
 > **Not affiliated with OMATERM or Once.** `omalocal` is an *ISO builder*. It
-> bundles and runs the official upstream installers; it does not vendor or fork
-> them.
+> bundles and runs the official upstream installers. The one exception: since
+> upstream OMATERM went Docker-only (2026-06), omalocal installs OMATERM from a
+> pinned fork ([`28allday/omaterm`](https://github.com/28allday/omaterm), branch
+> `native-frozen`) that preserves the native, host-level install. AI agents are
+> still pulled live from mise, so they stay current.
 
 ---
 
diff --git a/omalocal.sh b/omalocal.sh
index 33ad295..b71f486 100755
--- a/omalocal.sh
+++ b/omalocal.sh
@@ -406,7 +406,7 @@ cat <<'BANNER'
                    and messaging (the firewall already opens 53317).
 
   Installers (run any of these later if you skip):
-      curl -fsSL https://raw.githubusercontent.com/omacom-io/omaterm/refs/heads/master/install-native.sh | bash
+      curl -fsSL https://raw.githubusercontent.com/28allday/omaterm/native-frozen/install-native.sh | bash
       curl https://get.once.com | ONCE_INTERACTIVE=false sh
       curl -fsSL https://raw.githubusercontent.com/28allday/omarchy-send/main/install.sh | bash
 
@@ -419,7 +419,7 @@ case "$ans" in
     echo
     echo "  Skipped. To set up later, run:"
     echo "      curl https://get.once.com | ONCE_INTERACTIVE=false sh"
-    echo "      curl -fsSL https://raw.githubusercontent.com/omacom-io/omaterm/refs/heads/master/install-native.sh | bash"
+    echo "      curl -fsSL https://raw.githubusercontent.com/28allday/omaterm/native-frozen/install-native.sh | bash"
     echo
     ;;
   *)
@@ -486,12 +486,16 @@ esac
 # OMATERM now also installs the AI agents itself (node, opencode, claude-code,
 # codex, gemini are in its mise.packages), so there's no separate agent step.
 #
-# We call install-native.sh directly rather than omaterm.org/install: the vanity
-# URL is now a dispatcher that interactively asks "native or Docker?" — which would
-# stall this otherwise unattended first-run flow. install-native.sh is the native
-# branch of that dispatcher, is self-contained (it clones the omaterm repo into its
-# own tmpdir), and is exactly what a headless Arch box wants. Same URL pattern the
-# dispatcher itself uses; override the branch with OMATERM_REF if needed.
+# We pull install-native.sh from our PINNED FORK (28allday/omaterm, branch
+# `native-frozen`), NOT upstream. As of 2026-06-01 upstream omacom-io/omaterm
+# deleted the native install path and went Docker-only (omaterm.org/install now
+# installs Docker + an `omaterm` container launcher), which would split this
+# headless box into a host (Once/once-add/omarchy-send) + container (agents)
+# world. native-frozen is the last good native installer, self-consistent (its
+# internal `setup_git_checkout` clones the fork's own native-frozen branch, so
+# the package lists/configs match) — it installs OMATERM + its AI agents
+# natively on the host, keeping everything on one PATH. Agents still come live
+# from mise, so they stay current. See project memory for the freeze rationale.
 #
 # OMATERM's installer ends by exec'ing `bash -l`, whose .bashrc auto-starts tmux
 # (omadots aliases `t`='tmux attach || tmux new -s Work'). Its exact closer is
@@ -518,19 +522,19 @@ if [ "$setup_server" = 1 ]; then
   echo "        into your new shell."
   echo
   omaterm_installer="$(mktemp)"
-  if curl -fsSL https://raw.githubusercontent.com/omacom-io/omaterm/refs/heads/master/install-native.sh -o "$omaterm_installer"; then
+  if curl -fsSL https://raw.githubusercontent.com/28allday/omaterm/native-frozen/install-native.sh -o "$omaterm_installer"; then
     # Neutralise the /dev/tty redirect on OMATERM's final `exec bash -l`.
     sed -i 's@exec bash -l </dev/tty >/dev/tty 2>&1@exec bash -l@' "$omaterm_installer"
     # No </dev/tty here: let OMATERM (and its closing exec) inherit our pts fds.
     bash "$omaterm_installer" || {
       echo "        OMATERM install did not complete — retry later with:"
-      echo "          curl -fsSL https://raw.githubusercontent.com/omacom-io/omaterm/refs/heads/master/install-native.sh | bash"
+      echo "          curl -fsSL https://raw.githubusercontent.com/28allday/omaterm/native-frozen/install-native.sh | bash"
     }
     rm -f "$omaterm_installer"
   else
     rm -f "$omaterm_installer"
     echo "        Could not download the OMATERM installer — retry later with:"
-    echo "          curl -fsSL https://raw.githubusercontent.com/omacom-io/omaterm/refs/heads/master/install-native.sh | bash"
+    echo "          curl -fsSL https://raw.githubusercontent.com/28allday/omaterm/native-frozen/install-native.sh | bash"
   fi
 fi
 OMALOCAL_FIRSTRUN
@@ -717,7 +721,7 @@ Installed by `omalocal.sh`, a single-script patcher that takes a stock Arch ISO
 On the user's first interactive login a self-removing `~/.bash_profile` hook offers to set up the server. Once is installed first; OMATERM is installed last because its installer ends with `exec bash -l` and drops the user straight into their new shell:
 
 - **Once** (https://once.com) — `curl https://get.once.com | ONCE_INTERACTIVE=false sh` — Basecamp's self-hosted app deployment platform.
-- **Omaterm** (https://omaterm.org) — `curl -fsSL https://raw.githubusercontent.com/omacom-io/omaterm/refs/heads/master/install-native.sh | bash` — terminal-first toolkit: starship, neovim, tmux, mise, docker, lazygit, yay, plus AI agents (claude-code, codex, opencode, gemini), etc. OMATERM installs the AI agents itself (they're in its `mise.packages`), so there's no separate agent step. We call `install-native.sh` directly because `omaterm.org/install` is now a dispatcher that interactively prompts native-vs-Docker; the native branch is what a headless Arch box wants.
+- **Omaterm** (https://omaterm.org) — `curl -fsSL https://raw.githubusercontent.com/28allday/omaterm/native-frozen/install-native.sh | bash` — terminal-first toolkit: starship, neovim, tmux, mise, docker, lazygit, yay, plus AI agents (claude-code, codex, opencode, gemini), etc. OMATERM installs the AI agents itself (they're in its `mise.packages`), so there's no separate agent step. We pull `install-native.sh` from our pinned fork (`28allday/omaterm`, branch `native-frozen`) because upstream went Docker-only on 2026-06-01 and deleted the native path; the frozen fork keeps OMATERM + its agents installed natively on the host (one PATH alongside `once`/`once-add`/`omarchy-send`), rather than in a separate container. Agents still come live from mise.
 
 If the user declined, install them manually with those same two commands.
 
@@ -1118,7 +1122,7 @@ echo "    ssh $USERNAME@<this-host-ip>     (or ssh $USERNAME@$HOSTNAME)"
 echo
 echo "  On your first login you'll be offered the omalocal setup. To set"
 echo "  them up manually at any time:"
-echo "    curl -fsSL https://raw.githubusercontent.com/omacom-io/omaterm/refs/heads/master/install-native.sh | bash"
+echo "    curl -fsSL https://raw.githubusercontent.com/28allday/omaterm/native-frozen/install-native.sh | bash"
 echo "    curl https://get.once.com | ONCE_INTERACTIVE=false sh"
 echo "=================================================================="
 echo