diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
index 1949247..140a38f 100644
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -175,22 +175,17 @@ jobs:
     steps: *build_steps
 
   build-intune:
-    name: ${{ matrix.image }} (44)
+    name: fedora-intune (44)
     needs: changes
     if: needs.changes.outputs.intune == 'true'
     runs-on: job-v2
 
-    strategy:
-      fail-fast: false
-      matrix:
-        image: [fedora-intune, fedora-intune-himmelblau]
-
     container:
       image: "quay.io/fedora-ostree-desktops/buildroot:44"
       options: "--security-opt=label=disable --privileged --user 0:0 --device=/dev/fuse --volume /:/run/host:rw"
 
     env:
-      IMAGE: ${{ matrix.image }}
+      IMAGE: fedora-intune
       DISTRO: "44"
       ARCH: x86_64
       REGISTRY: git.plabble.org/misthios
@@ -220,7 +215,7 @@ jobs:
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
         run: |
-          for image in fedora-cosmic fedora-remote fedora-intune fedora-intune-himmelblau; do
+          for image in fedora-cosmic fedora-remote fedora-intune; do
             ./prune-releases.sh "${image}"
           done
       - name: Prune old registry tags
@@ -232,6 +227,6 @@ jobs:
           authfile=/tmp/prune-auth.json
           echo "${REGISTRY_TOKEN}" | skopeo login -u "${REGISTRY_USERNAME}" \
             --password-stdin --authfile "${authfile}" git.plabble.org
-          for image in fedora-cosmic fedora-remote fedora-intune fedora-intune-himmelblau; do
+          for image in fedora-cosmic fedora-remote fedora-intune; do
             AUTHFILE="${authfile}" ./prune-registry.sh "${image}" Misthios 44 rawhide
           done
diff --git a/build.sh b/build.sh
index 95027c6..c29c9bf 100755
--- a/build.sh
+++ b/build.sh
@@ -201,10 +201,7 @@ case "${BUILD_MODE}" in
     if [[ -d "${IMAGE_DIR}/files" ]]; then
       cp -a "${IMAGE_DIR}/files/." "${BUILD_DIR}/upstream/"
     fi
-    # Shared overlay (manifests/files/repos used by multiple images).
-    if compgen -G "${REPO_ROOT}/images/shared/*.yaml" >/dev/null; then
-      cp "${REPO_ROOT}"/images/shared/*.yaml "${BUILD_DIR}/upstream/"
-    fi
+    # Shared overlay (files/repos used by multiple images).
     if [[ -d "${REPO_ROOT}/images/shared/files" ]]; then
       cp -a "${REPO_ROOT}/images/shared/files/." "${BUILD_DIR}/upstream/"
     fi
diff --git a/ci-changes.sh b/ci-changes.sh
index b5f603b..3e05a0d 100755
--- a/ci-changes.sh
+++ b/ci-changes.sh
@@ -22,8 +22,7 @@ if [[ "${all}" == 1 ]]; then
 fi
 grep -qE '^images/fedora-cosmic/' <<< "${changed}" && cosmic=true
 grep -qE '^images/fedora-remote/' <<< "${changed}" && remote=true
-# Both fedora-intune and fedora-intune-himmelblau.
-grep -qE '^images/fedora-intune' <<< "${changed}" && intune=true
+grep -qE '^images/fedora-intune/' <<< "${changed}" && intune=true
 
 echo "cosmic=${cosmic}"
 echo "remote=${remote}"
diff --git a/images/fedora-intune-himmelblau/build.conf b/images/fedora-intune-himmelblau/build.conf
deleted file mode 100644
index 2029669..0000000
--- a/images/fedora-intune-himmelblau/build.conf
+++ /dev/null
@@ -1,10 +0,0 @@
-# Build configuration for images/fedora-intune-himmelblau. Sourced by build.sh.
-
-BUILD_MODE=upstream
-
-UPSTREAM_REPO="https://gitlab.com/fedora/ostree/ci-test.git"
-
-# Stable only, like fedora-intune.
-declare -A UPSTREAM_REFS=(
-  [44]=f44
-)
diff --git a/images/fedora-intune-himmelblau/manifest.yaml b/images/fedora-intune-himmelblau/manifest.yaml
deleted file mode 100644
index dca6595..0000000
--- a/images/fedora-intune-himmelblau/manifest.yaml
+++ /dev/null
@@ -1,37 +0,0 @@
-# Minimal GNOME workstation where users sign in with their Entra ID account
-# (Himmelblau), with Microsoft Edge and Microsoft Defender for Endpoint.
-# Himmelblau joins the device to Entra ID at the first sign-in and, with
-# apply_policy, enrolls it in Intune and reports compliance itself, so the
-# Microsoft Intune app (fedora-intune) is not included.
-
-metadata:
-  summary: Fedora minimal GNOME workstation with Entra ID sign-in (Himmelblau)
-
-variables:
-  # Opt out of the upstream fedora.yaml so we don't pull the Firefox RPM.
-  distro: "fedora-intune-himmelblau"
-  variant: "intune-himmelblau"
-
-# Keep it small: no weak/optional dependencies.
-recommends: false
-
-default_target: graphical.target
-
-ref: fedora-intune-himmelblau/${releasever_ref}/${basearch}/intune-himmelblau
-
-# /opt as a plain directory; see fedora-intune/manifest.yaml.
-opt-usrlocal: root
-
-repos:
-  - himmelblau
-  - microsoft-rhel10
-  - microsoft-edge
-
-include:
-  - base-atomic.yaml
-  # Shared with fedora-intune (images/shared).
-  - workstation.yaml
-  - microsoft-edge.yaml
-  - defender.yaml
-  # Entra ID sign-in and Intune.
-  - himmelblau.yaml
diff --git a/images/fedora-intune/build.conf b/images/fedora-intune/build.conf
index bc566ac..967992b 100644
--- a/images/fedora-intune/build.conf
+++ b/images/fedora-intune/build.conf
@@ -4,7 +4,7 @@ BUILD_MODE=upstream
 
 UPSTREAM_REPO="https://gitlab.com/fedora/ostree/ci-test.git"
 
-# Stable only; Microsoft builds the Intune app against RHEL, not rawhide.
+# Stable only; Defender comes from Microsoft's RHEL 10 repo, not rawhide.
 declare -A UPSTREAM_REFS=(
   [44]=f44
 )
diff --git a/images/shared/workstation.yaml b/images/fedora-intune/custom.yaml
similarity index 91%
rename from images/shared/workstation.yaml
rename to images/fedora-intune/custom.yaml
index 3d66f76..4faefce 100644
--- a/images/shared/workstation.yaml
+++ b/images/fedora-intune/custom.yaml
@@ -1,5 +1,4 @@
-# Minimal GNOME workstation, shared by the fedora-intune images. Include it
-# from a manifest that sets `opt-usrlocal: root` (finalize.d/60-opt-links).
+# Minimal GNOME workstation.
 
 packages:
   # Fedora integration normally provided by the upstream fedora.yaml (which we
diff --git a/images/shared/defender.yaml b/images/fedora-intune/defender.yaml
similarity index 97%
rename from images/shared/defender.yaml
rename to images/fedora-intune/defender.yaml
index f1a4232..801d529 100644
--- a/images/shared/defender.yaml
+++ b/images/fedora-intune/defender.yaml
@@ -1,5 +1,5 @@
 # Microsoft Defender for Endpoint on Linux (mdatp), RHEL 10 build, from the
-# microsoft-rhel10 repo (shared/repos/microsoft.repo).
+# microsoft-rhel10 repo (repos/microsoft.repo).
 #
 # mdatp's %post does the real install: units, SELinux module, and per-machine
 # state under /var/opt/microsoft/mdatp (machine GUID, definitions database,
diff --git a/images/shared/files/10-workstation-sshd.conf b/images/fedora-intune/files/10-workstation-sshd.conf
similarity index 100%
rename from images/shared/files/10-workstation-sshd.conf
rename to images/fedora-intune/files/10-workstation-sshd.conf
diff --git a/images/shared/files/50-defender.preset b/images/fedora-intune/files/50-defender.preset
similarity index 100%
rename from images/shared/files/50-defender.preset
rename to images/fedora-intune/files/50-defender.preset
diff --git a/images/fedora-intune-himmelblau/files/50-himmelblau-user.preset b/images/fedora-intune/files/50-himmelblau-user.preset
similarity index 100%
rename from images/fedora-intune-himmelblau/files/50-himmelblau-user.preset
rename to images/fedora-intune/files/50-himmelblau-user.preset
diff --git a/images/fedora-intune-himmelblau/files/50-himmelblau.preset b/images/fedora-intune/files/50-himmelblau.preset
similarity index 100%
rename from images/fedora-intune-himmelblau/files/50-himmelblau.preset
rename to images/fedora-intune/files/50-himmelblau.preset
diff --git a/images/fedora-intune/files/50-intune.preset b/images/fedora-intune/files/50-intune.preset
deleted file mode 100644
index 67f1565..0000000
--- a/images/fedora-intune/files/50-intune.preset
+++ /dev/null
@@ -1,3 +0,0 @@
-# Intune daemon (socket-activated). The device identity broker is D-Bus
-# activated and has no [Install] section, so it needs no preset.
-enable intune-daemon.socket
diff --git a/images/shared/files/50-workstation.preset b/images/fedora-intune/files/50-workstation.preset
similarity index 100%
rename from images/shared/files/50-workstation.preset
rename to images/fedora-intune/files/50-workstation.preset
diff --git a/images/fedora-intune-himmelblau/files/himmelblau.conf b/images/fedora-intune/files/himmelblau.conf
similarity index 100%
rename from images/fedora-intune-himmelblau/files/himmelblau.conf
rename to images/fedora-intune/files/himmelblau.conf
diff --git a/images/shared/files/mdatp-firstboot b/images/fedora-intune/files/mdatp-firstboot
similarity index 100%
rename from images/shared/files/mdatp-firstboot
rename to images/fedora-intune/files/mdatp-firstboot
diff --git a/images/shared/files/mdatp-firstboot.conf b/images/fedora-intune/files/mdatp-firstboot.conf
similarity index 100%
rename from images/shared/files/mdatp-firstboot.conf
rename to images/fedora-intune/files/mdatp-firstboot.conf
diff --git a/images/shared/files/mdatp-firstboot.service b/images/fedora-intune/files/mdatp-firstboot.service
similarity index 100%
rename from images/shared/files/mdatp-firstboot.service
rename to images/fedora-intune/files/mdatp-firstboot.service
diff --git a/images/fedora-intune-himmelblau/himmelblau.yaml b/images/fedora-intune/himmelblau.yaml
similarity index 100%
rename from images/fedora-intune-himmelblau/himmelblau.yaml
rename to images/fedora-intune/himmelblau.yaml
diff --git a/images/fedora-intune/intune.yaml b/images/fedora-intune/intune.yaml
deleted file mode 100644
index 4b28509..0000000
--- a/images/fedora-intune/intune.yaml
+++ /dev/null
@@ -1,71 +0,0 @@
-# Microsoft Intune app for Linux (intune-portal) and the Microsoft identity
-# broker, from the microsoft-rhel10 repo (shared/repos/microsoft.repo).
-#
-# Fedora is not a supported Intune distribution. The RHEL 10 builds are used
-# because they link against the same library generation as Fedora 44.
-
-repo-packages:
-  - repo: microsoft-rhel10
-    packages:
-      - intune-portal
-      - microsoft-identity-broker
-
-packages:
-  # intune-portal scriptlet dependencies (authselect profile + SELinux module)
-  # and the sssd base its authselect profile is derived from.
-  - authselect
-  - checkpolicy
-  - policycoreutils
-  - sssd-client
-  - nss-altfiles
-  # Secret storage for the identity broker tokens.
-  - gnome-keyring
-  - libsecret
-
-add-files:
-  - ["50-intune.preset", "/usr/lib/systemd/system-preset/50-intune.preset"]
-
-postprocess:
-  # The intune-portal %post builds an authselect profile with pam_intune.so and
-  # an SELinux module, but neither reliably survives a compose (no running
-  # SELinux, authselect state under /etc). Redo both here so the image is
-  # deterministic either way.
-  - |
-    #!/usr/bin/env bash
-    set -xeuo pipefail
-    profile=/etc/authselect/custom/intune-profile
-    if [[ ! -d "${profile}" ]]; then
-      authselect create-profile intune-profile -b sssd --symlink-meta --symlink-pam
-    fi
-    for f in system-auth password-auth; do
-      grep -q pam_intune.so "${profile}/${f}" && continue
-      sed -i \
-        -e 's/^\(auth[[:space:]]\+\)sufficient\([[:space:]]\+pam_unix.so\)/\1required  \2/' \
-        -e 's/^\(password[[:space:]]\+\)sufficient\([[:space:]]\+pam_unix.so\)/\1required  \2/' \
-        "${profile}/${f}"
-      sed -i \
-        -e '/^auth[[:space:]]\+required[[:space:]]\+pam_unix.so/a auth        sufficient                                   pam_intune.so' \
-        -e '/^password[[:space:]]\+required[[:space:]]\+pam_unix.so/a password    sufficient                                   pam_intune.so' \
-        -e '/^session[[:space:]]\+required[[:space:]]\+pam_unix.so/a session     optional                                     pam_intune.so' \
-        "${profile}/${f}"
-    done
-    # with-altfiles: system users (gdm, pipewire, mdatp, ...) live in
-    # /usr/lib/passwd on rpm-ostree systems, not in /etc/passwd as on RHEL.
-    authselect select custom/intune-profile with-altfiles --force --nobackup
-    getent passwd gdm >/dev/null
-
-  - |
-    #!/usr/bin/env bash
-    set -xeuo pipefail
-    cd /usr/share/selinux/packages/intune
-    tmp="$(mktemp -d)"
-    checkmodule -M -m -o "${tmp}/intune.mod" intune.te
-    semodule_package -o "${tmp}/intune.pp" -m "${tmp}/intune.mod"
-    semodule -n -i "${tmp}/intune.pp"
-    rm -rf "${tmp}"
-
-  # intune-agent (user timer) reports compliance; enable it for every user.
-  - |
-    #!/usr/bin/env bash
-    set -xeuo pipefail
-    systemctl --user --global preset-all
diff --git a/images/fedora-intune/manifest.yaml b/images/fedora-intune/manifest.yaml
index acecd60..84107b0 100644
--- a/images/fedora-intune/manifest.yaml
+++ b/images/fedora-intune/manifest.yaml
@@ -1,10 +1,10 @@
-# Minimal GNOME workstation with the Microsoft Intune app, Microsoft Edge and
-# Microsoft Defender for Endpoint, for testing Intune enrollment and Linux
-# compliance policies. Local accounts only: no Kanidm, because the Intune app
-# needs its own authselect profile (pam_intune) for the password checks.
+# Minimal GNOME workstation where users sign in with their Entra ID account
+# (Himmelblau), with Microsoft Edge and Microsoft Defender for Endpoint.
+# Himmelblau joins the device to Entra ID at the first sign-in and, with
+# apply_policy, enrolls it in Intune and reports compliance.
 
 metadata:
-  summary: Fedora minimal GNOME workstation with Microsoft Intune and Defender
+  summary: Fedora minimal GNOME workstation with Entra ID sign-in and Intune
 
 variables:
   # Opt out of the upstream fedora.yaml so we don't pull the Firefox RPM.
@@ -21,18 +21,19 @@ ref: fedora-intune/${releasever_ref}/${basearch}/intune
 # Ship /opt as a plain read-only directory instead of a symlink to /var/opt.
 # Defender installs to /opt/microsoft/mdatp and keeps its state in
 # /var/opt/microsoft/mdatp; with the default symlink those are the same,
-# read-only directory. Needs composefs, which upstream enables.
+# read-only directory. Needs composefs, which upstream enables. The vendor
+# directories are linked into /opt by finalize.d/60-opt-links.
 opt-usrlocal: root
 
 repos:
+  - himmelblau
   - microsoft-rhel10
   - microsoft-edge
 
 include:
   - base-atomic.yaml
-  # Shared with fedora-intune-himmelblau (images/shared).
-  - workstation.yaml
+  - custom.yaml
+  # Entra ID sign-in and Intune.
+  - himmelblau.yaml
   - microsoft-edge.yaml
   - defender.yaml
-  # Microsoft Intune app.
-  - intune.yaml
diff --git a/images/shared/microsoft-edge.yaml b/images/fedora-intune/microsoft-edge.yaml
similarity index 66%
rename from images/shared/microsoft-edge.yaml
rename to images/fedora-intune/microsoft-edge.yaml
index fefb37f..a61069a 100644
--- a/images/shared/microsoft-edge.yaml
+++ b/images/fedora-intune/microsoft-edge.yaml
@@ -1,4 +1,4 @@
-# Microsoft Edge, from the microsoft-edge repo (shared/repos/microsoft.repo).
+# Microsoft Edge, from the microsoft-edge repo (repos/microsoft.repo).
 # Conditional Access to Microsoft 365 web apps on Linux requires Edge.
 
 repo-packages:
diff --git a/images/fedora-intune-himmelblau/repos/himmelblau.repo b/images/fedora-intune/repos/himmelblau.repo
similarity index 100%
rename from images/fedora-intune-himmelblau/repos/himmelblau.repo
rename to images/fedora-intune/repos/himmelblau.repo
diff --git a/images/shared/repos/microsoft.repo b/images/fedora-intune/repos/microsoft.repo
similarity index 76%
rename from images/shared/repos/microsoft.repo
rename to images/fedora-intune/repos/microsoft.repo
index 7ae2a91..3c6438f 100644
--- a/images/shared/repos/microsoft.repo
+++ b/images/fedora-intune/repos/microsoft.repo
@@ -1,5 +1,5 @@
-# packages.microsoft.com, limited with includepkgs to the packages the images
-# use, so nothing else from the RHEL repo can replace a Fedora package.
+# packages.microsoft.com, limited with includepkgs to the packages the image
+# uses, so nothing else from the RHEL repo can replace a Fedora package.
 
 [microsoft-rhel10]
 name=Microsoft Production (RHEL 10)
@@ -8,7 +8,7 @@ enabled=1
 gpgcheck=1
 repo_gpgcheck=1
 gpgkey=https://packages.microsoft.com/keys/microsoft-2025.asc
-includepkgs=intune-portal microsoft-identity-broker mdatp
+includepkgs=mdatp
 
 [microsoft-edge]
 name=Microsoft Edge