diff --git a/NOTICE b/NOTICE
index 490c02d..2a3c730 100644
--- a/NOTICE
+++ b/NOTICE
@@ -15,9 +15,9 @@ respective source files.
 1. The LineageOS Project / The CyanogenMod Project
 ---------------------------------------------------
 Files adapted from android_vendor_lineage:
-  - build/envsetup.sh          (breakfast, brunch, mka, cmka, cout,
-                                 aospremote, repopick, reposync, repodiff)
-  - build/tasks/bacon.mk       (bacon OTA package target)
+  - build/envsetup.sh          (breakfast, brunch, mka, cmka, cout)
+  - build/tasks/bacon.mk       (bacon OTA package target, here in
+                                 build/core/definitions.mk)
   - config/version.mk          (buildtype filtering, version string structure)
 
 Files in the Updater application whose architecture is derived from
@@ -57,7 +57,7 @@ structure follows the AOSP reference implementation.
   - hal/boot_control/rpi/android.hardware.boot-service.pawlet_rpi.rc
   - hal/boot_control/rpi/android.hardware.boot-service.pawlet_rpi.xml
 
-Build system hook files (build/core/config.mk, Android.mk files, soong
+Build system hook files (build/core/definitions.mk, Android.mk files, soong
 Android.bp files) follow AOSP vendor integration conventions.
 
 Copyright (C) The Android Open Source Project
diff --git a/build/Android.mk b/build/Android.mk
deleted file mode 100644
index cccc4fa..0000000
--- a/build/Android.mk
+++ /dev/null
@@ -1,8 +0,0 @@
-#
-# Copyright (C) 2025 oxmc / PawletOS
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-
-LOCAL_PATH := $(call my-dir)
-include $(call all-makefiles-under,$(LOCAL_PATH))
diff --git a/build/core/Android.mk b/build/core/Android.mk
deleted file mode 100644
index cccc4fa..0000000
--- a/build/core/Android.mk
+++ /dev/null
@@ -1,8 +0,0 @@
-#
-# Copyright (C) 2025 oxmc / PawletOS
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-
-LOCAL_PATH := $(call my-dir)
-include $(call all-makefiles-under,$(LOCAL_PATH))
diff --git a/build/core/config.mk b/build/core/config.mk
deleted file mode 100644
index 8c5af0a..0000000
--- a/build/core/config.mk
+++ /dev/null
@@ -1,10 +0,0 @@
-#
-# Copyright (C) 2025 oxmc / PawletOS
-# SPDX-License-Identifier: Apache-2.0
-#
-# Vendor build config — included by AOSP's build/make/core/config.mk
-# via: -include $(TOPDIR)vendor/*/build/core/config.mk
-#
-
-# Include PawletOS build tasks (bacon, etc.)
-include $(TOPDIR)vendor/pawlet/build/tasks/bacon.mk
diff --git a/build/core/definitions.mk b/build/core/definitions.mk
new file mode 100644
index 0000000..12a5249
--- /dev/null
+++ b/build/core/definitions.mk
@@ -0,0 +1,31 @@
+#
+# Copyright (C) 2012 The CyanogenMod Project
+# Copyright (C) 2017 The LineageOS Project
+# Copyright (C) 2025 oxmc / PawletOS
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# PawletOS build targets, loaded through the one vendor hook stock AOSP
+# provides:
+#   build/make/core/definitions.mk:
+#     -include $(TOPDIR)vendor/*/build/core/definitions.mk
+# The vendor/*/build/core/config.mk and vendor/*/build/tasks/*.mk hooks that
+# LineageOS uses exist only in Lineage's build/make fork, not in AOSP.
+#
+# This file is parsed long before build/make/core/Makefile defines
+# INTERNAL_OTA_PACKAGE_TARGET, so bacon is a phony target on the `otapackage`
+# goal: prerequisite names are resolved at build time, and everything in the
+# recipe expands at execution time, when all variables exist.
+#
+
+# ---------------------------------------------------------------------------
+# bacon — PawletOS OTA package: PawletOS-<version>.zip + .sha256sum
+# Adapted from vendor/lineage/build/tasks/bacon.mk (The LineageOS Project).
+# ---------------------------------------------------------------------------
+.PHONY: bacon
+bacon: otapackage
+	$(if $(PAWLET_VERSION),,$(error bacon: $(TARGET_PRODUCT) is not a PawletOS product))
+	$(hide) ln -f $(INTERNAL_OTA_PACKAGE_TARGET) $(PRODUCT_OUT)/PawletOS-$(PAWLET_VERSION).zip
+	$(hide) prebuilts/build-tools/path/$(HOST_PREBUILT_TAG)/sha256sum $(PRODUCT_OUT)/PawletOS-$(PAWLET_VERSION).zip \
+	    | sed "s|$(PRODUCT_OUT)/||" > $(PRODUCT_OUT)/PawletOS-$(PAWLET_VERSION).zip.sha256sum
+	@echo "Package Complete: $(PRODUCT_OUT)/PawletOS-$(PAWLET_VERSION).zip" >&2
diff --git a/build/core/tasks/pawlet.mk b/build/core/tasks/pawlet.mk
deleted file mode 100644
index f847f7b..0000000
--- a/build/core/tasks/pawlet.mk
+++ /dev/null
@@ -1,7 +0,0 @@
-#
-# Copyright (C) 2025 oxmc / PawletOS
-# SPDX-License-Identifier: Apache-2.0
-#
-# Intentionally empty — bacon is defined in build/tasks/bacon.mk and loaded
-# by build/core/config.mk. Nothing extra goes here.
-#
diff --git a/build/soong/Android.bp b/build/soong/Android.bp
deleted file mode 100644
index a192c51..0000000
--- a/build/soong/Android.bp
+++ /dev/null
@@ -1,5 +0,0 @@
-// Copyright (C) 2025 oxmc / PawletOS
-// SPDX-License-Identifier: Apache-2.0
-
-soong_namespace {
-}
diff --git a/build/tasks/Android.mk b/build/tasks/Android.mk
deleted file mode 100644
index 426216f..0000000
--- a/build/tasks/Android.mk
+++ /dev/null
@@ -1,8 +0,0 @@
-#
-# Copyright (C) 2025 oxmc / PawletOS
-# SPDX-License-Identifier: Apache-2.0
-#
-# bacon.mk is already included by build/core/config.mk (which AOSP picks up
-# via -include vendor/*/build/core/config.mk). Do NOT include it again here
-# or the bacon rule will be defined twice, causing Make warnings/errors.
-#
diff --git a/build/tasks/bacon.mk b/build/tasks/bacon.mk
deleted file mode 100644
index 94560b5..0000000
--- a/build/tasks/bacon.mk
+++ /dev/null
@@ -1,23 +0,0 @@
-#
-# Copyright (C) 2012 The CyanogenMod Project
-# Copyright (C) 2017 The LineageOS Project
-# Copyright (C) 2025 oxmc / PawletOS
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# PawletOS OTA package ("bacon") build target.
-# Adapted from vendor/lineage/build/tasks/bacon.mk (The LineageOS Project).
-# Produces: PawletOS-<version>.zip + .sha256sum
-#
-
-PAWLET_TARGET_PACKAGE := $(PRODUCT_OUT)/PawletOS-$(PAWLET_VERSION).zip
-
-SHA256 := prebuilts/build-tools/path/$(HOST_PREBUILT_TAG)/sha256sum
-
-$(PAWLET_TARGET_PACKAGE): $(INTERNAL_OTA_PACKAGE_TARGET)
-	$(hide) ln -f $(INTERNAL_OTA_PACKAGE_TARGET) $(PAWLET_TARGET_PACKAGE)
-	$(hide) $(SHA256) $(PAWLET_TARGET_PACKAGE) | sed "s|$(PRODUCT_OUT)/||" > $(PAWLET_TARGET_PACKAGE).sha256sum
-	@echo "Package Complete: $(PAWLET_TARGET_PACKAGE)" >&2
-
-.PHONY: bacon
-bacon: $(PAWLET_TARGET_PACKAGE) $(DEFAULT_GOAL)
diff --git a/config/version.mk b/config/version.mk
index 7e3607d..fb24838 100644
--- a/config/version.mk
+++ b/config/version.mk
@@ -13,28 +13,15 @@ PAWLET_MINOR_VERSION := 0
 
 PAWLET_BUILD_DATE := $(shell date -u +%Y%m%d)
 
-# Accept PAWLET_BUILDTYPE from env or RELEASE_TYPE (CI compat)
-ifndef PAWLET_BUILDTYPE
-    ifdef RELEASE_TYPE
-        RELEASE_TYPE := $(shell echo $(RELEASE_TYPE) | sed -e 's|^PAWLET_||g')
-        PAWLET_BUILDTYPE := $(RELEASE_TYPE)
-    endif
-endif
-
-# Only recognised types; everything else becomes UNOFFICIAL
+# PAWLET_BUILDTYPE comes from the environment; only recognised types are
+# kept, everything else becomes UNOFFICIAL. ro.pawlet.releasetype must match
+# the update server channel ("romtype"), so keep these in sync with it.
 ifeq ($(filter RELEASE NIGHTLY SNAPSHOT EXPERIMENTAL,$(PAWLET_BUILDTYPE)),)
     PAWLET_BUILDTYPE := UNOFFICIAL
-    PAWLET_EXTRAVERSION :=
 endif
 
-ifeq ($(PAWLET_BUILDTYPE),UNOFFICIAL)
-    ifneq ($(TARGET_UNOFFICIAL_BUILD_ID),)
-        PAWLET_EXTRAVERSION := -$(TARGET_UNOFFICIAL_BUILD_ID)
-    endif
-endif
-
-# Full version suffix: <date>-<type>[-extraver]-<device>
-PAWLET_VERSION_SUFFIX := $(PAWLET_BUILD_DATE)-$(PAWLET_BUILDTYPE)$(PAWLET_EXTRAVERSION)-$(PAWLET_BUILD)
+# Full version suffix: <date>-<type>-<device>
+PAWLET_VERSION_SUFFIX := $(PAWLET_BUILD_DATE)-$(PAWLET_BUILDTYPE)-$(PAWLET_BUILD)
 
 # Canonical version (used in OTA zip filename)
 PAWLET_VERSION := $(PAWLET_MAJOR_VERSION).$(PAWLET_MINOR_VERSION)-$(PAWLET_VERSION_SUFFIX)
diff --git a/vendorsetup.sh b/vendorsetup.sh
index 63e9c06..636edc2 100644
--- a/vendorsetup.sh
+++ b/vendorsetup.sh
@@ -10,71 +10,6 @@
 # Adapted from vendor/lineage/build/envsetup.sh (The LineageOS Project).
 #
 
-# ---------------------------------------------------------------------------
-# check_product — verify the product is a pawlet_* target
-# ---------------------------------------------------------------------------
-function check_product()
-{
-    local T=$(gettop)
-    if [ ! "$T" ]; then
-        echo "Couldn't locate the top of the tree. Try setting TOP." >&2
-        return
-    fi
-    if (echo -n $1 | grep -q -e "^pawlet_"); then
-        PAWLET_BUILD=$(echo -n $1 | sed -e 's/^pawlet_//g')
-    else
-        PAWLET_BUILD=
-    fi
-    export PAWLET_BUILD
-
-    TARGET_PRODUCT=$1 \
-    TARGET_BUILD_VARIANT= \
-    TARGET_BUILD_TYPE= \
-    TARGET_BUILD_APPS= \
-    _get_build_var_cached TARGET_DEVICE > /dev/null
-}
-
-# ---------------------------------------------------------------------------
-# breakfast <device> [variant] — configure build for a PawletOS device
-# ---------------------------------------------------------------------------
-function breakfast()
-{
-    local target=$1
-    local variant=$2
-    source ${ANDROID_BUILD_TOP}/vendor/pawlet/vars/aosp_target_release
-
-    if [ $# -eq 0 ]; then
-        lunch
-    else
-        if [[ "$target" =~ -(user|userdebug|eng)$ ]]; then
-            lunch $target
-        else
-            if [ -z "$variant" ]; then
-                variant="userdebug"
-            fi
-            lunch pawlet_${target}-${aosp_target_release}-${variant}
-        fi
-    fi
-    return $?
-}
-
-alias bib=breakfast
-
-# ---------------------------------------------------------------------------
-# brunch <device> — breakfast + make bacon
-# ---------------------------------------------------------------------------
-function brunch()
-{
-    breakfast $*
-    if [ $? -eq 0 ]; then
-        mka bacon
-    else
-        echo "No such item in brunch menu. Try 'breakfast'"
-        return 1
-    fi
-    return $?
-}
-
 # ---------------------------------------------------------------------------
 # mka — invoke the Android build system
 # ---------------------------------------------------------------------------
@@ -120,51 +55,42 @@ function cout()
 }
 
 # ---------------------------------------------------------------------------
-# pawlet_img <device> — build the flashable SD-card image via mkimg.sh
+# breakfast <device> [variant] — configure build for a PawletOS device
 # ---------------------------------------------------------------------------
-function pawlet_img()
+function breakfast()
 {
-    local device=${1:-${PAWLET_BUILD}}
-    if [[ -z "$device" ]]; then
-        echo "Usage: pawlet_img <device>"
+    local target=$1
+    local variant=$2
+    source ${ANDROID_BUILD_TOP}/vendor/pawlet/vars/aosp_target_release
+
+    if [ $# -eq 0 ]; then
+        lunch
+    else
+        if [[ "$target" =~ -(user|userdebug|eng)$ ]]; then
+            lunch $target
+        else
+            if [ -z "$variant" ]; then
+                variant="userdebug"
+            fi
+            lunch pawlet_${target}-${aosp_target_release}-${variant}
+        fi
+    fi
+    return $?
+}
+
+# ---------------------------------------------------------------------------
+# brunch <device> — breakfast + make bacon
+# ---------------------------------------------------------------------------
+function brunch()
+{
+    breakfast $*
+    if [ $? -eq 0 ]; then
+        mka bacon
+    else
+        echo "No such item in brunch menu. Try 'breakfast'"
         return 1
     fi
-    local mkimg="device/brcm/${device}/mkimg.sh"
-    if [[ ! -f "$mkimg" ]]; then
-        echo "mkimg.sh not found: $mkimg"
-        return 1
-    fi
-    bash "$mkimg"
-}
-
-# ---------------------------------------------------------------------------
-# repopick — cherry-pick patches from a Gerrit-style review server
-# ---------------------------------------------------------------------------
-function repopick()
-{
-    local T=$(gettop)
-    $T/vendor/pawlet/build/tools/repopick.py "$@"
-}
-
-# ---------------------------------------------------------------------------
-# reposync — wrapper around 'repo sync'
-# ---------------------------------------------------------------------------
-function reposync()
-{
-    repo sync -j4 "$@"
-}
-
-# ---------------------------------------------------------------------------
-# repodiff — show diff across all repos between two refs
-# ---------------------------------------------------------------------------
-function repodiff()
-{
-    if [ -z "$*" ]; then
-        echo "Usage: repodiff <ref-from> [[ref-to] [--numstat]]"
-        return
-    fi
-    diffopts=$* repo forall -c \
-        'echo "$REPO_PATH ($REPO_REMOTE)"; git diff ${diffopts} 2>/dev/null;'
+    return $?
 }
 
 # ---------------------------------------------------------------------------
@@ -200,25 +126,37 @@ function pdist()
 #   psign                          →  auto-detects latest zip in dist/
 #   psign input.zip                →  sign specific zip → signed-target_files.zip
 #   psign input.zip output.zip     →  explicit input and output
+#   psign -c <certs-dir> ...       →  explicit certificate directory
 #
+# The release-key directory comes from the -c flag or the PAWLET_CERTS_DIR
+# environment variable — there is no default path.
 # Presigned microG/FDroid APKs are excluded from re-signing automatically.
 # ---------------------------------------------------------------------------
 function psign()
 {
     local T=$(gettop)
+    local certs="${PAWLET_CERTS_DIR}"
+    if [ "$1" = "-c" ]; then
+        certs=$2
+        shift 2
+    fi
     local distdir="${DIST_DIR:-${OUT_DIR:-out}/dist}"
     local input="${1:-$(ls -t "${distdir}"/*-target_files-*.zip 2>/dev/null | head -1)}"
     local output="${2:-signed-target_files.zip}"
 
+    if [ -z "$certs" ] || [ ! -d "$certs" ]; then
+        echo "psign: no certs dir${certs:+ at '$certs'} — pass -c <dir> or set PAWLET_CERTS_DIR." >&2
+        return 1
+    fi
     if [ -z "$input" ] || [ ! -f "$input" ]; then
         echo "psign: no target_files zip found — run pdist first, or pass the path explicitly." >&2
         return 1
     fi
 
-    echo "psign: signing $input → $output"
+    echo "psign: signing $input → $output (keys: $certs)"
     "${T}/build/make/tools/releasetools/sign_target_files_apks" \
         -o \
-        --default_key_mappings ~/pawlet-certs \
+        --default_key_mappings "$certs" \
         --extra_apks GmsCore= \
         --extra_apks GsfProxy= \
         --extra_apks FakeStore= \
@@ -233,10 +171,15 @@ function psign()
 #   pota -i prev-signed.zip        →  incremental OTA against a previous build
 #   pota signed.zip out.zip        →  explicit input/output
 #   pota -i prev.zip new.zip out.zip
+#   pota -c <certs-dir> ...        →  explicit certificate directory
+#
+# The release-key directory comes from the -c flag or the PAWLET_CERTS_DIR
+# environment variable — there is no default path.
 # ---------------------------------------------------------------------------
 function pota()
 {
     local T=$(gettop)
+    local certs="${PAWLET_CERTS_DIR}"
     local incremental_flag=""
     local input="signed-target_files.zip"
     local output="pawlet-ota.zip"
@@ -244,6 +187,7 @@ function pota()
 
     while [[ $# -gt 0 ]]; do
         case $1 in
+            -c) certs=$2; shift 2 ;;
             -i) incremental_flag="-i $2"; shift 2 ;;
             *)
                 if [ -z "$input_set" ]; then
@@ -255,9 +199,14 @@ function pota()
         esac
     done
 
-    echo "pota: building OTA $input → $output${incremental_flag:+ (incremental)}"
+    if [ -z "$certs" ] || [ ! -d "$certs" ]; then
+        echo "pota: no certs dir${certs:+ at '$certs'} — pass -c <dir> or set PAWLET_CERTS_DIR." >&2
+        return 1
+    fi
+
+    echo "pota: building OTA $input → $output${incremental_flag:+ (incremental)} (keys: $certs)"
     "${T}/build/make/tools/releasetools/ota_from_target_files" \
-        -k ~/pawlet-certs/releasekey \
+        -k "${certs}/releasekey" \
         $incremental_flag \
         "$input" "$output"