diff --git a/dist/linux/arch/default.nix b/dist/linux/arch/default.nix
index fa61e36..47e8d2f 100644
--- a/dist/linux/arch/default.nix
+++ b/dist/linux/arch/default.nix
@@ -51,13 +51,13 @@ in
 
     inherit pkgbuild;
     src = appImage;
-    appDir = ../../../AppDir;
+    defaultDaemonYml = ../../../go/daemon/daecommon/daemon.yml;
     systemdService = ../isle.service;
     dontUnpack = true;
 
     buildPhase = ''
       mkdir -p root/etc/isle/
-      cp "$appDir"/etc/daemon.yml root/etc/isle/daemon.yml
+      cp "$defaultDaemonYml" root/etc/isle/daemon.yml
 
       mkdir -p root/usr/lib/sysusers.d/
       cat >root/usr/lib/sysusers.d/isle.conf <<EOF
diff --git a/go/bootstrap/bootstrap.go b/go/bootstrap/bootstrap.go
index 6160928..edbd38f 100644
--- a/go/bootstrap/bootstrap.go
+++ b/go/bootstrap/bootstrap.go
@@ -23,12 +23,6 @@ func StateDirPath(dataDirPath string) string {
 	return filepath.Join(dataDirPath, "bootstrap.json")
 }
 
-// AppDirPath returns the path within the AppDir where an embedded bootstrap
-// file might be found.
-func AppDirPath(appDirPath string) string {
-	return filepath.Join(appDirPath, "share/bootstrap.json")
-}
-
 // CreationParams are general parameters used when creating a new network. These
 // are available to all hosts within the network via their bootstrap files.
 type CreationParams struct {
diff --git a/go/cmd/entrypoint/daemon.go b/go/cmd/entrypoint/daemon.go
index a8407c2..ef8d475 100644
--- a/go/cmd/entrypoint/daemon.go
+++ b/go/cmd/entrypoint/daemon.go
@@ -41,7 +41,7 @@ var subCmdDaemon = subCmd{
 		}
 
 		if *dumpConfig {
-			return daecommon.CopyDefaultConfig(os.Stdout, envAppDirPath)
+			return daecommon.CopyDefaultConfig(os.Stdout)
 		}
 
 		logLevel := mlog.LevelFromString(*logLevelStr)
diff --git a/go/cmd/entrypoint/garage.go b/go/cmd/entrypoint/garage.go
index 25e84b6..f67a136 100644
--- a/go/cmd/entrypoint/garage.go
+++ b/go/cmd/entrypoint/garage.go
@@ -90,7 +90,7 @@ var subCmdGarageMC = subCmd{
 				*keyID, *keySecret, s3APIAddr,
 			)
 
-			binPath = filepath.Join(envAppDirPath, "bin/mc")
+			binPath = binPath("mc")
 			cliEnv  = append(
 				os.Environ(),
 				mcHostVar,
diff --git a/go/daemon/daecommon/config.go b/go/daemon/daecommon/config.go
index 249450d..f30c139 100644
--- a/go/daemon/daecommon/config.go
+++ b/go/daemon/daecommon/config.go
@@ -1,15 +1,17 @@
 package daecommon
 
 import (
+	"bytes"
 	"fmt"
 	"io"
 	"isle/bootstrap"
 	"isle/toolkit"
 	"net"
 	"os"
-	"path/filepath"
 	"strconv"
 
+	_ "embed"
+
 	"gopkg.in/yaml.v3"
 )
 
@@ -19,9 +21,8 @@ const (
 	DeprecatedNetworkID = "_" // DEPRECATED
 )
 
-func defaultConfigPath(appDirPath string) string {
-	return filepath.Join(appDirPath, "etc", "daemon.yml")
-}
+//go:embed daemon.yml
+var defaultConfigB []byte
 
 type ConfigTun struct {
 	Device string `yaml:"device"`
@@ -180,22 +181,9 @@ func (c Config) Validate() error {
 
 // CopyDefaultConfig copies the daemon config file embedded in the AppDir into
 // the given io.Writer.
-func CopyDefaultConfig(into io.Writer, appDirPath string) error {
-
-	defaultConfigPath := defaultConfigPath(appDirPath)
-
-	f, err := os.Open(defaultConfigPath)
-	if err != nil {
-		return fmt.Errorf("opening daemon config at %q: %w", defaultConfigPath, err)
-	}
-
-	defer f.Close()
-
-	if _, err := io.Copy(into, f); err != nil {
-		return fmt.Errorf("copying daemon config from %q: %w", defaultConfigPath, err)
-	}
-
-	return nil
+func CopyDefaultConfig(into io.Writer) error {
+	_, err := io.Copy(into, bytes.NewReader(defaultConfigB))
+	return err
 }
 
 // LoadConfig loads the daemon config from userConfigPath.
diff --git a/AppDir/etc/daemon.yml b/go/daemon/daecommon/daemon.yml
similarity index 100%
rename from AppDir/etc/daemon.yml
rename to go/daemon/daecommon/daemon.yml
diff --git a/nix/nebula.nix b/nix/nebula.nix
index e221fd5..aad26ca 100644
--- a/nix/nebula.nix
+++ b/nix/nebula.nix
@@ -8,7 +8,7 @@
   pname = "nebula";
 
   # If this changes, remember to change:
-  # - the AppDir/etc/daemon.yml vpn.firewall docs
+  # - the go/daemon/daecommon/daemon.yml vpn.firewall docs
   # - the version imported in go-workspace
   version = "1.6.1";