diff --git a/build.sh b/build.sh
index b5d54cc..f5d13c9 100755
--- a/build.sh
+++ b/build.sh
@@ -83,6 +83,45 @@ gpgcheck=0
 EOF
 }
 
+# Drop packages listed in a blocklist from the cloned upstream package
+# manifests. rpm-ostree refuses (fatally) to exclude a package that an included
+# manifest declares, so remove those lines at the source instead.
+trim_upstream_packages() {
+  local root="$1"
+  local blocklist="$2"
+  local f
+  for f in "${root}"/packages/*.yaml; do
+    [[ -f "${f}" ]] || continue
+    awk '
+      NR == FNR {
+        if ($0 ~ /^[[:space:]]*#/ || $0 ~ /^[[:space:]]*$/) next
+        skip[$0] = 1
+        next
+      }
+      {
+        line = $0
+        sub(/^[[:space:]]*-[[:space:]]*/, "", line)
+        if (line in skip) next
+        print
+      }
+    ' "${blocklist}" "${f}" > "${f}.tmp"
+    mv "${f}.tmp" "${f}"
+  done
+}
+
+# Generate an exclude-packages snippet from the same blocklist. This blocks the
+# removed packages from being pulled back in as recommends (e.g. linux-firmware
+# recommends the split firmware packages).
+generate_exclude_yaml() {
+  local blocklist="$1"
+  local out="$2"
+  {
+    echo "# Generated by build.sh from $(basename "${blocklist}") - do not edit."
+    echo "exclude-packages:"
+    grep -vE '^[[:space:]]*(#|$)' "${blocklist}" | sed 's/^/  - /'
+  } > "${out}"
+}
+
 case "${BUILD_MODE}" in
   upstream)
     [[ -n "${UPSTREAM_REPO}" ]] || { echo "UPSTREAM_REPO not set in ${CONF}" >&2; exit 1; }
@@ -106,6 +145,12 @@ case "${BUILD_MODE}" in
       setup_token2_repo "${BUILD_DIR}/upstream"
     fi
 
+    if [[ -f "${IMAGE_DIR}/upstream-exclude.txt" ]]; then
+      trim_upstream_packages "${BUILD_DIR}/upstream" "${IMAGE_DIR}/upstream-exclude.txt"
+      generate_exclude_yaml "${IMAGE_DIR}/upstream-exclude.txt" \
+        "${BUILD_DIR}/upstream/hardware-exclude.yaml"
+    fi
+
     MANIFEST="${BUILD_DIR}/upstream/manifest.yaml"
     ;;
   standalone)
diff --git a/images/fedora-cosmic/manifest.yaml b/images/fedora-cosmic/manifest.yaml
index c7db823..b3db71a 100644
--- a/images/fedora-cosmic/manifest.yaml
+++ b/images/fedora-cosmic/manifest.yaml
@@ -25,3 +25,5 @@ repos:
 include:
   - cosmic-atomic.yaml
   - custom.yaml
+  # Generated by build.sh from upstream-exclude.txt (exclude-packages list).
+  - hardware-exclude.yaml
diff --git a/images/fedora-cosmic/upstream-exclude.txt b/images/fedora-cosmic/upstream-exclude.txt
new file mode 100644
index 0000000..a1a877d
--- /dev/null
+++ b/images/fedora-cosmic/upstream-exclude.txt
@@ -0,0 +1,49 @@
+# Packages removed from the cloned upstream manifests at build time.
+#
+# rpm-ostree treats excluding a package that an included manifest declares as a
+# fatal error, so build.sh strips these lines from the upstream package
+# manifests before composing.
+#
+# Target machine: GMKtec NucBox M7
+#   - AMD Ryzen 7 PRO 6850H (Radeon 680M iGPU)   -> amd-gpu-firmware kept
+#   - 2x Intel I226-V Ethernet                    -> kernel driver, no fw pkg
+#   - Intel Wi-Fi 6 AX200                         -> iwlwifi-mvm-firmware kept
+#   - AMD audio (SOF)                             -> alsa-sof-firmware kept
+# No NVIDIA, no Intel GPU/audio, no other wireless vendors, bare metal (no VMs).
+
+# NVIDIA
+nvidia-gpu-firmware
+
+# Intel GPU / platform / audio (Intel wireless firmware is kept below)
+intel-gpu-firmware
+intel-audio-firmware
+intel-lpmd
+intel-vsc-firmware
+libva-intel-media-driver
+
+# Intel-only CPU tooling (AMD uses amd-ucode-firmware)
+microcode_ctl
+thermald
+
+# Wireless firmware for hardware that is not present
+atheros-firmware
+brcmfmac-firmware
+libertas-firmware
+mt7xxx-firmware
+nxpwireless-firmware
+qcom-wwan-firmware
+realtek-firmware
+tiwilink-firmware
+iwlwifi-dvm-firmware
+iwlegacy-firmware
+
+# Audio firmware for other vendors
+cirrus-audio-firmware
+
+# Virtual machine guest agents / drivers
+hyperv-daemons
+open-vm-tools-desktop
+qemu-guest-agent
+spice-vdagent
+spice-webdavd
+virtualbox-guest-additions