diff --git a/compose.yaml b/compose.yaml
index b0e1aca..41a8e4d 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -51,6 +51,7 @@ services:
       # included. Bump generously so we have room for follow-on
       # features without re-tripping this validation.
       MAX_DEFAULTS_LENGTH: "65536"
+      MAX_CUSTOM_ROOTFS_SIZE_MB: "4096"
     volumes:
       - ${PUBLIC_PATH}/store:${PUBLIC_PATH}/store:ro
       - ${PUBLIC_PATH}/logs:${PUBLIC_PATH}/logs:ro
@@ -71,6 +72,7 @@ services:
     environment:
       REDIS_URL: redis://redis:6379/0
       MAX_DEFAULTS_LENGTH: "65536"
+      MAX_CUSTOM_ROOTFS_SIZE_MB: "4096"
     volumes:
       - ${PUBLIC_PATH}:${PUBLIC_PATH}:rw
       - ${CONTAINER_SOCKET_PATH}:${CONTAINER_SOCKET_PATH}:rw
diff --git a/firmware-selector b/firmware-selector
index 1e95222..ff2b09a 160000
--- a/firmware-selector
+++ b/firmware-selector
@@ -1 +1 @@
-Subproject commit 1e952225f9616022c57302f728ef283a7dd8cffb
+Subproject commit ff2b09a26241673bc6305896c8d98dfab881bae9
diff --git a/recipes/README.md b/recipes/README.md
index 1a43c67..bad8592 100644
--- a/recipes/README.md
+++ b/recipes/README.md
@@ -40,6 +40,7 @@ Each block is Mustache-rendered with the form inputs, then joined, then sent as
 | `docs_url`        | string | URL to the orb.net setup guide for this device (e.g. `https://orb.net/docs/devices/radxa-e20c`). Rendered as an "orb.net docs" link alongside the vendor URL. |
 | `install_notes`   | string | Markdown-formatted device-specific flashing and setup instructions, rendered via [snarkdown](https://github.com/developit/snarkdown) in the download area after a successful build. Supports **bold**, *italic*, [links](url), numbered/unordered lists, `code`, and headings. Use YAML block scalar (`\|`) for multi-line content. See the Radxa E20C recipe for an example. |
 | `version`         | string | OpenWrt version the recipe is pinned to. Sent verbatim to ASU as the build target. Pin to a version you have actually validated on the target hardware — silent regressions across OpenWrt patch releases have broken overlay formatting, driver init, and other boot-path things for specific boards in the past. |
+| `rootfs_size_mb`  | number | Optional custom rootfs partition size in MB. Sent to ASU as `rootfs_size_mb`, which ImageBuilder applies as `ROOTFS_PARTSIZE`. Useful for eMMC/SD-card devices whose physical storage is much larger than the OpenWrt profile default. |
 | `capabilities`    | object | Hardware capability flags — see below.                                |
 | `packages`        | list   | Extra packages beyond the profile defaults. `orb` is contributed by every recipe that wants Orb baked in. |
 | `repositories`    | object | Name → URL mapping for extra apk feeds. Merged with `_common.yaml`'s repos.  |
diff --git a/recipes/radxa_e20c.yaml b/recipes/radxa_e20c.yaml
index c4c5392..d67d7d7 100644
--- a/recipes/radxa_e20c.yaml
+++ b/recipes/radxa_e20c.yaml
@@ -19,6 +19,10 @@ arch: aarch64_generic
 # on real hardware — 25.12.0 for this target has a broken overlay-format
 # path that leaves the rootfs on a tmpfs fallback and breaks persistence.
 version: "25.12.2"
+# The E20C variants we target have 16 GB eMMC. OpenWrt ImageBuilder's
+# default rootfs partition is much smaller and can fail when optional
+# runtime packages like Docker/Compose are selected.
+rootfs_size_mb: 2048
 
 capabilities:
   wifi: false
diff --git a/selector/nginx.conf.template b/selector/nginx.conf.template
index 5c2de5e..5d65603 100644
--- a/selector/nginx.conf.template
+++ b/selector/nginx.conf.template
@@ -19,6 +19,7 @@ server {
     # Static firmware-selector assets (from the submodule, overlaid with our
     # config.js via a second bind mount in compose.yaml).
     location / {
+        add_header Cache-Control "no-store, max-age=0" always;
         try_files $uri $uri/ =404;
     }
 
@@ -27,6 +28,7 @@ server {
     # /orb-recipes-src/. Not under /usr/share/nginx/html/ because that tree
     # is a read-only bind mount from the firmware-selector submodule.
     location /recipes/ {
+        add_header Cache-Control "no-store, max-age=0" always;
         alias /orb-recipes/;
         try_files $uri =404;
     }