diff --git a/default.nix b/default.nix
index c595ae9..a7f3cbc 100644
--- a/default.nix
+++ b/default.nix
@@ -157,16 +157,18 @@ in rec {
       unset SOURCE_DATE_EPOCH
 
       appimagetool ./isle.AppDir
-
-      mkdir -p "$out"/bin
-      chmod +w "$out" -R
-      mv Isle-* "$out"/bin/isle
+      mv Isle-* "$out"
     '';
   };
 
+  appImageBin = pkgs.runCommand "isle-AppImage-bin" {} ''
+    mkdir -p "$out"/bin
+    cp ${appImage} "$out"/bin/isle
+  '';
+
   tests = pkgs.writeScript "isle-tests" ''
     export PATH=${pkgs.lib.makeBinPath [
-      appImage
+      appImageBin
       pkgs.busybox
       pkgs.yq-go
       pkgs.jq
diff --git a/dist/linux/arch/default.nix b/dist/linux/arch/default.nix
new file mode 100644
index 0000000..0042d2e
--- /dev/null
+++ b/dist/linux/arch/default.nix
@@ -0,0 +1,86 @@
+{
+  pkgs,
+  buildSystem,
+  releaseName,
+  appImage,
+}: let
+
+  cpuArch = (pkgs.lib.systems.parse.mkSystemFromString buildSystem).cpu.name;
+
+  pkgbuild = pkgs.writeText "isle-arch-PKGBUILD-${releaseName}-${cpuArch}" ''
+    pkgname=isle
+    pkgver=${releaseName}
+    pkgrel=0
+    pkgdesc="The foundation for an autonomous community cloud infrastructure."
+    arch=('${cpuArch}')
+    url="https://code.betamike.com/micropelago/isle"
+    license=('AGPL-3.0-or-later')
+
+    depends=(
+      'fuse2'
+    )
+
+    # The appImage is deliberately kept separate from the src.tar.zst. For some
+    # reason including the appImage within the archive results in a large part
+    # of the binary being stripped away and some weird skeleton appImage comes
+    # out the other end.
+    source=('isle' 'src.tar.zst')
+    md5sums=('SKIP' 'SKIP')
+    noextract=('isle')
+
+    package() {
+      cp -r etc "$pkgdir"/etc
+      cp -r usr "$pkgdir"/usr
+
+      mkdir -p "$pkgdir"/usr/bin/
+      cp isle "$pkgdir"/usr/bin/
+    }
+  '';
+
+in
+  pkgs.stdenv.mkDerivation {
+    name = "isle-arch-pkg-${releaseName}-${cpuArch}";
+
+    nativeBuildInputs = [
+      pkgs.zstd
+      pkgs.pacman
+      pkgs.fakeroot
+      pkgs.libarchive
+    ];
+
+    inherit pkgbuild;
+    src = appImage;
+    appDir = ../../../AppDir;
+    systemdService = ../isle.service;
+    dontUnpack = true;
+
+    buildPhase = ''
+      mkdir -p root/etc/isle/
+      cp "$appDir"/etc/daemon.yml root/etc/isle/daemon.yml
+
+      mkdir -p root/usr/lib/sysusers.d/
+      cat >root/usr/lib/sysusers.d/isle.conf <<EOF
+      u isle - "isle Daemon"
+      EOF
+
+      mkdir -p root/usr/lib/systemd/system
+      cp "$systemdService" root/usr/lib/systemd/system/isle.service
+
+      cp $pkgbuild PKGBUILD
+
+      tar -cf src.tar.zst --zstd --mode=a+rX,u+w -C root .
+      cp "$src" isle
+
+      PKGEXT=".pkg.tar.zst" makepkg \
+        --nodeps \
+        --config ${pkgs.pacman}/etc/makepkg.conf
+    '';
+
+    installPhase = ''
+      mkdir -p $out
+      cp *.pkg.tar.zst $out/
+    '';
+
+    # NOTE if https://github.com/NixOS/nixpkgs/issues/241911 is ever addressed
+    # it'd be nice to add an automatic check using namcap here.
+  }
diff --git a/dist/linux/isle.service b/dist/linux/isle.service
new file mode 100644
index 0000000..3f04424
--- /dev/null
+++ b/dist/linux/isle.service
@@ -0,0 +1,16 @@
+[Unit]
+Description=Isle
+Requires=network.target
+After=network.target
+
+[Service]
+User=isle
+ExecStart=/usr/bin/isle daemon -c /etc/isle/daemon.yml
+RuntimeDirectory=isle
+RuntimeDirectoryMode=0700
+StateDirectory=isle
+StateDirectoryMode=0700
+AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
+
+[Install]
+WantedBy=multi-user.target
diff --git a/go/cmd/entrypoint/daemon.go b/go/cmd/entrypoint/daemon.go
index b3cc912..3901613 100644
--- a/go/cmd/entrypoint/daemon.go
+++ b/go/cmd/entrypoint/daemon.go
@@ -253,12 +253,13 @@ var subCmdDaemon = subCmd{
 		)
 
 		tryLoadBootstrap := func(path string) bool {
+			ctx := mctx.Annotate(ctx, "bootstrapFilePath", path)
 
 			if err != nil {
 				return false
 
 			} else if hostBootstrap, err = bootstrap.FromFile(path); errors.Is(err, fs.ErrNotExist) {
-				fmt.Fprintf(os.Stderr, "bootstrap file not found at %q\n", path)
+				logger.WarnString(ctx, "bootstrap file not found")
 				err = nil
 				return false
 
@@ -267,10 +268,7 @@ var subCmdDaemon = subCmd{
 				return false
 			}
 
-			logger.Info(
-				mctx.Annotate(ctx, "bootstrapFilePath", path),
-				"bootstrap file found",
-			)
+			logger.Info(ctx, "bootstrap file found")
 
 			hostBootstrapPath = path
 			return true
diff --git a/go/cmd/entrypoint/main.go b/go/cmd/entrypoint/main.go
index 3023fe5..52ed00d 100644
--- a/go/cmd/entrypoint/main.go
+++ b/go/cmd/entrypoint/main.go
@@ -25,10 +25,25 @@ func getAppDirPath() string {
 	return appDirPath
 }
 
+func envOr(name, fallback string) string {
+	if v := os.Getenv(name); v != "" {
+		return v
+	}
+	return fallback
+}
+
+// RUNTIME_DIRECTORY/STATE_DIRECTORY are used by the systemd service in
+// conjunction with the RuntimeDirectory/StateDirectory directives.
 var (
 	envAppDirPath     = getAppDirPath()
-	envRuntimeDirPath = filepath.Join(xdg.RuntimeDir, "isle")
-	envStateDirPath   = filepath.Join(xdg.StateHome, "isle")
+	envRuntimeDirPath = envOr(
+		"RUNTIME_DIRECTORY",
+		filepath.Join(xdg.RuntimeDir, "isle"),
+	)
+	envStateDirPath = envOr(
+		"STATE_DIRECTORY",
+		filepath.Join(xdg.StateHome, "isle"),
+	)
 )
 
 func binPath(name string) string {
diff --git a/release.nix b/release.nix
index 7dd99e2..cb14aa4 100644
--- a/release.nix
+++ b/release.nix
@@ -16,15 +16,21 @@
       inherit buildSystem hostSystem releaseName revision;
     }).appImage;
 
+    archPkg = ((import ./dist/linux/arch) {
+      inherit pkgs buildSystem releaseName appImage;
+    });
+
   in pkgs.stdenv.mkDerivation {
     name = "isle-release-${hostSystem}";
-    inherit releaseName appImage hostSystem;
+    inherit releaseName hostSystem;
+    inherit appImage archPkg;
 
     builder = builtins.toFile "build.sh" ''
       source $stdenv/setup
 
       mkdir -p "$out"/
-      cp "$appImage"/bin/isle "$out"/isle-$releaseName-$hostSystem
+      cp "$appImage" "$out"/isle-$releaseName-$hostSystem.AppImage
+      cp "$archPkg"/*.tar.zst "$out"/isle-$releaseName-$hostSystem.pkg.tar.zst
     '';
   };
 
@@ -43,7 +49,7 @@ in
 
       mkdir -p "$out"
       for p in $releases; do
-        cp "$p"/isle-* "$out"/
+        cp "$p"/* "$out"/
       done
 
       (cd "$out" && sha256sum * > sha256.txt)