diff --git a/.env.template b/.env.template
index da3b5ba..b8bdda6 100644
--- a/.env.template
+++ b/.env.template
@@ -1,28 +1,28 @@
-# ============================================================
-#  Solphyr Arch Linux Installer Configuration
-# ============================================================
+# =============================
+# Arch Secure Install Template
+# =============================
 
-# --- System ---
-HOSTNAME="solphyr-dev"
-USERNAME="solphyr"
-KEYMAP="uk"
-TIMEZONE="Europe/London"
-LOCALE="en_GB.UTF-8"
+DISK=/dev/nvme0n1
+HOSTNAME=elysium
+USERNAME=solphyr
+USER_PASSWORD=changeme
+ROOT_PASSWORD=changeme
 
-# --- Disk ---
-DISK=""           # e.g. /dev/nvme0n1 (leave blank for interactive)
+TIMEZONE=Europe/London
+LOCALE=en_GB.UTF-8
+KEYMAP=uk
 
-# --- Network ---
-WIFI_SSID=""
-WIFI_PASS=""
+LUKS_NAME=cryptroot
+LUKS_PASSPHRASE=changeme
 
-# --- Passwords (leave blank for secure prompt) ---
-LUKS_PASSWORD=""
-USER_PASSWORD=""
-ROOT_PASSWORD=""
+SECUREBOOT_ENABLE=true
+SECUREBOOT_KEY_DIR=/etc/secureboot
+TPM2_ENABLE=true
 
-# --- Optional Components ---
-INSTALL_YAY="yes"             # Install yay AUR helper
-ENABLE_WIREGUARD="yes"        # Install WireGuard if wg0.conf present
-WIREGUARD_CONF_PATH="./wg0.conf"
-ENABLE_HARDENING="yes"        # Apply UFW/sysctl/AppArmor/Fail2ban baseline
+BTRFS_SUBVOLS=(@ @home @log @cache)
+BTRFS_OPTS="compress=zstd,noatime,ssd,space_cache=v2"
+
+NETWORK_DHCP=true
+NETWORK_INTERFACE=auto
+
+AUTO_MODE=false