Ummm sure. Basically I didn't want to irrecoverably screw up my steam deck. So, I setup a partition on the SD card and pointed a /usr overlay at it. mount

Ummm sure. Basically I didn't want to irrecoverably screw up my steam deck. So, I setup a partition on the SD card and pointed a /usr overlay at it. mount -t overlay -o "lowerdir=/usr,upperdir=/run/media/OVERLAY/overlay/usr,workdir=/run/media/OVERLAY/workdir/usr" none /usr Personal choice, I didn't set it to automount, since I really wanted to ensure boot process was same. I just mount it later. Idea being that every once in a while I pop out the SD card, run the standard steam update, then wipe the overlay and reinstall the stuff I was using (I have a script to make that more convenient). If it seems I really did somehow mess up their setup beyond repair I can just remove the card, reboot (I did do that once, but I don't think it was my fault). Main issue I've run into is the fact that Valve upstream repo is a hackish snapshot of Arch that is not maintained and was not entirely consistent at time of creation and is using old gpg keys. So, while 95% of stuff installs using it, there's 5% that requires installing while ignoring the signature and just trusting valve's server, or pulling in an older lib (I symlinked in one from valve's steam runtime once). The other not-ideal thing about Valve is they really don't prioritise security patching, at all. It's astounding given the device does have an sshd running. Not to mention older problems like wifi vulnerabilities. Fortunately the recent ssh cve has a config workaround, or I'd probably just force-install an sshd from arch instead, or disable starting at boot. ... oh and pulling in new signatures for people does help sometimes. pacman -S archlinux-keyring , pacman-key / --populate / --refresh-keys /-r exact@name.org ... and since /etc persists during updates, sometimes you have to tell pacman to --overwrite since a prior install might still exist there. You could work around that by backing up /etc but, eh, it hasn't been a problem so far :D - there were no collisions on first install to /etc for any of them, so I assume everything was playing nice with existing valve /etc. And, well, valve did make that directory writeable ...