diff --git a/image-recipe/build-auto-installer-iso.sh b/image-recipe/build-auto-installer-iso.sh
index fc0ba719..e5110db7 100755
--- a/image-recipe/build-auto-installer-iso.sh
+++ b/image-recipe/build-auto-installer-iso.sh
@@ -1234,8 +1234,14 @@ echo "   [5/7] Encrypting data partition (LUKS2)..."
 dd if=/dev/urandom of=/mnt/target/root/.luks-archipelago.key bs=4096 count=1 2>/dev/null
 chmod 600 /mnt/target/root/.luks-archipelago.key
 
-# Bind-mount /dev so cryptsetup can access the data partition from chroot
+# Load dm_mod kernel module (required for device-mapper / LUKS)
+modprobe dm_mod 2>/dev/null || true
+modprobe dm_crypt 2>/dev/null || true
+
+# Bind-mount /dev, /proc, /sys so cryptsetup works in chroot
 mount --bind /dev /mnt/target/dev
+mount --bind /proc /mnt/target/proc
+mount --bind /sys /mnt/target/sys
 
 # Detect AES-NI support for cipher selection
 if grep -q aes /proc/cpuinfo 2>/dev/null; then
@@ -1258,7 +1264,9 @@ chroot /mnt/target cryptsetup open --type luks2 \
     --key-file /root/.luks-archipelago.key \
     "$DATA_PART" archipelago-data
 
-# Unmount /dev (will be re-mounted later for grub-install)
+# Unmount chroot bind mounts (will be re-mounted later for grub-install)
+umount /mnt/target/sys 2>/dev/null || true
+umount /mnt/target/proc 2>/dev/null || true
 umount /mnt/target/dev
 
 # Format the inner filesystem