diff --git a/README.md b/README.md
index 027ea93..88f466f 100644
--- a/README.md
+++ b/README.md
@@ -28,6 +28,7 @@ These scripts are based on the initial work of [Typecraft](https://www.youtube.c
 (Note: if you're on a laptop and/or don't have a wired internet connection, set up Wi-Fi first. See "A Note About Networking in Arch" below.)
 
 4) You will go through the different options. Mostly choose the defaults.
+   - At "Network configuration", choose "Use NetworkManager", even if you connected with `iwctl`. CoreDesktop uses NetworkManager, and GNOME's Wi-Fi menu needs it. "Copy ISO network configuration" turns on iwd instead, which fights NetworkManager over the Wi-Fi card; CoreDesktop turns iwd off if it finds it (see "Notes about what is installed").
 5) Video cards: IF YOU HAVE AN NVIDIA GPU, CHOOSE THE PROPRIETARY NVIDIA OPTION. Choose the AMD option for AMD cards. Just works better. We've found Arch is very good at maintaining compatibility with Nvidia and AMD options.
 6) When asked what type of system you want, the correct choice is "desktop" and the correct desktop environment is "Gnome".
 7) For sound, "pipewire" is strongly recommended for the sound system choice during install. This is known to work really well with Jitsi, Element, and the other Federated Core SaaS applications, if you're using those. This may no longer be required in the newest installations of Arch Linux.
@@ -47,6 +48,8 @@ To list the wireless adapters type: `device list`. If your wireless device is "w
 
 When you have the wireless network working (check by doing "ping google.com"), then you can proceed to install Arch.
 
+This connection is only for the installer: `iwctl` saves your Wi-Fi password on the USB stick, not on your new system. Choose "Use NetworkManager" at archinstall's network step, and after the first boot choose your Wi-Fi network in GNOME's top-right menu.
+
 ## Installing Federated CoreDesktop
 
 When Arch and Gnome have been successfully installed, you log in to the system then...
@@ -177,6 +180,7 @@ Besides installing software, CoreDesktop changes these settings. They're listed
 - **systemd**: a 10-second stop timeout (/etc/systemd/system.conf.d/ and /etc/systemd/user.conf.d/10-coredesktop-timeout.conf), systemd-oomd for apps (/etc/systemd/user/app.slice.d/10-coredesktop-oomd.conf), and NetworkManager-wait-online is masked.
 - **/etc/security/pam_env.conf**: a PATH line, so SSH commands find ~/.local/bin and mise.
 - **mDNS**: Avahi is on, nss-mdns is added to /etc/nsswitch.conf, and SSH is advertised in /etc/avahi/services/ssh.service.
+- **Wi-Fi**: if iwd is turned on alongside NetworkManager (archinstall's "Copy ISO network configuration" does that), iwd and systemd-networkd are turned off, so that NetworkManager runs the network from the next restart. Choose your Wi-Fi network once in GNOME's top-right menu after that restart. If you set NetworkManager to use iwd itself (`wifi.backend=iwd`), this leaves iwd alone.
 - **Services turned on**: Avahi, Bluetooth, CUPS (printing), fwupd, GDM, NetworkManager, reflector (weekly), sshd, Docker, Tailscale, ufw and systemd-oomd. Your user is added to the docker group.
 - **Snapper** (btrfs only): a config for / in /etc/snapper/configs/root.
 - **NVIDIA** (only if it installs the driver): /etc/mkinitcpio.conf.d/nvidia.conf and NVIDIA's suspend services.
diff --git a/install.sh b/install.sh
index c54140c..021fe17 100755
--- a/install.sh
+++ b/install.sh
@@ -211,6 +211,10 @@ fi
 echo "Applying system defaults..."
 bash ~/.local/share/coredesktop/system/defaults.sh
 
+# Leave Wi-Fi to NetworkManager alone if archinstall turned on iwd as well
+echo "Checking Wi-Fi..."
+bash ~/.local/share/coredesktop/system/wifi.sh
+
 # SSH logins with keys only, not passwords
 echo "Configuring the SSH server..."
 bash ~/.local/share/coredesktop/system/sshd.sh
diff --git a/migrations/1794084215.sh b/migrations/1794084215.sh
new file mode 100644
index 0000000..df65954
--- /dev/null
+++ b/migrations/1794084215.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+
+# Machines set up with iwctl and archinstall's "copy ISO network configuration"
+# can have iwd and systemd-networkd running alongside NetworkManager, fighting
+# over the Wi-Fi card. Leave Wi-Fi to NetworkManager alone.
+bash "$HOME/.local/share/coredesktop/system/wifi.sh"
diff --git a/system/wifi.sh b/system/wifi.sh
new file mode 100644
index 0000000..0f4e455
--- /dev/null
+++ b/system/wifi.sh
@@ -0,0 +1,39 @@
+#!/bin/bash
+#
+# Purpose : Leave Wi-Fi to NetworkManager alone. archinstall's "copy ISO network
+#           configuration" turns on iwd and systemd-networkd, so a machine set
+#           up with iwctl from the Arch ISO can have them running alongside
+#           NetworkManager, which CoreDesktop turns on. Then two services fight
+#           over the Wi-Fi card: connections drop, or Wi-Fi is missing from
+#           GNOME.
+#
+# This disables iwd and systemd-networkd without stopping them, so the network
+# stays up until the next boot; after it, NetworkManager runs Wi-Fi and wired
+# connections. iwd's saved Wi-Fi passwords don't carry over: choose the network
+# once in GNOME's top-right menu.
+#
+# Changes nothing when NetworkManager isn't enabled, or when it is set up to
+# use iwd itself (wifi.backend=iwd in /etc/NetworkManager/conf.d/).
+
+systemctl is-enabled -q NetworkManager.service 2> /dev/null || exit 0
+systemctl is-enabled -q iwd.service 2> /dev/null || exit 0
+
+# Unset settings print commented out, so this matches only one someone set
+if NetworkManager --print-config 2> /dev/null \
+    | grep -qE '^[[:space:]]*wifi\.backend[[:space:]]*=[[:space:]]*iwd[[:space:]]*$'; then
+  exit 0
+fi
+
+echo "Turning off iwd, so that NetworkManager runs Wi-Fi from the next restart..."
+sudo systemctl disable iwd.service || exit 1
+
+# archinstall turns systemd-networkd on with iwd. Its wait-online would hold up
+# boot with nothing for it to wait for.
+if systemctl is-enabled -q systemd-networkd.service 2> /dev/null; then
+  echo "Turning off systemd-networkd, so that NetworkManager runs the network..."
+  sudo systemctl disable systemd-networkd.service systemd-networkd.socket \
+    systemd-networkd-wait-online.service || exit 1
+fi
+
+echo "After you restart, choose your Wi-Fi network in GNOME's top-right menu"
+echo "and enter its password once. The network stays up until then."
diff --git a/tests/wifi.bats b/tests/wifi.bats
new file mode 100644
index 0000000..f880632
--- /dev/null
+++ b/tests/wifi.bats
@@ -0,0 +1,62 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+# system/wifi.sh with fake systemctl, sudo and NetworkManager. $ENABLED lists
+# the enabled units; $NM_CONFIG is what NetworkManager --print-config prints.
+
+setup() {
+  common_setup
+  export ENABLED="NetworkManager.service iwd.service systemd-networkd.service"
+  export NM_CONFIG=$'[device]\n# wifi.backend=wpa_supplicant'
+  stub systemctl '[ "$1" = is-enabled ] || exit 0
+    [[ " $ENABLED " == *" ${!#} "* ]]'
+  stub sudo '"$@"'
+  stub NetworkManager 'echo "$NM_CONFIG"'
+}
+
+@test "wifi.sh turns off iwd and systemd-networkd alongside NetworkManager" {
+  run bash "$REPO/system/wifi.sh"
+  [ "$status" -eq 0 ]
+  called systemctl disable iwd.service
+  called systemctl disable systemd-networkd.service systemd-networkd.socket systemd-networkd-wait-online.service
+  [[ "$output" == *"GNOME's top-right menu"* ]]
+}
+
+@test "wifi.sh leaves systemd-networkd alone when it's off" {
+  ENABLED="NetworkManager.service iwd.service"
+  run bash "$REPO/system/wifi.sh"
+  [ "$status" -eq 0 ]
+  called systemctl disable iwd.service
+  uncalled systemctl disable systemd-networkd.service systemd-networkd.socket systemd-networkd-wait-online.service
+}
+
+@test "wifi.sh does nothing without iwd" {
+  ENABLED="NetworkManager.service systemd-networkd.service"
+  run bash "$REPO/system/wifi.sh"
+  [ "$status" -eq 0 ]
+  [ -z "$output" ]
+  not_called sudo
+}
+
+@test "wifi.sh does nothing when NetworkManager is off" {
+  ENABLED="iwd.service systemd-networkd.service"
+  run bash "$REPO/system/wifi.sh"
+  [ "$status" -eq 0 ]
+  [ -z "$output" ]
+  not_called sudo
+}
+
+@test "wifi.sh leaves iwd to NetworkManager set up to use it" {
+  NM_CONFIG=$'[device]\nwifi.backend=iwd'
+  run bash "$REPO/system/wifi.sh"
+  [ "$status" -eq 0 ]
+  [ -z "$output" ]
+  not_called sudo
+}
+
+@test "wifi.sh fails when it can't turn iwd off" {
+  stub sudo 'exit 1'
+  run bash "$REPO/system/wifi.sh"
+  [ "$status" -eq 1 ]
+}