diff --git a/image-setup.md b/image-setup.md
index 3d4b544..faa63ee 100644
--- a/image-setup.md
+++ b/image-setup.md
@@ -2,11 +2,13 @@
 
 ## Baseline setup
 
+Replace `$TAG` with whatever version is being built, e.g. `v1.1`.
+
 1. Flash your SD card (assuming OS X):
     1. Get [Ubuntu MATE 15.10.1](https://ubuntu-mate.org/raspberry-pi/) and decompress into an `.img` file
     1. `$ diskutil list` to check correct device
     1. `$ diskutil unmountDisk /dev/disk2` to prepare it for imaging
-    1. `$ sudo dd bs=1m if=ubuntu-mate-15.10.1-desktop-armhf-raspberry-pi-2.img of=/dev/disk2` (may take up to an hour)
+    1. `$ sudo dd bs=1m if=ubuntu-mate-15.10.3-desktop-armhf-raspberry-pi-2.img of=/dev/disk2` (may take up to an hour)
 1. Boot your Raspberry Pi using the SD card
 1. Answer basic questions (timezone, keyboard layout, default user, etc)
     1. Set hostname to `chilipie-kiosk`
@@ -16,9 +18,9 @@
 1. `$ sudo visudo` and add `pi ALL=(ALL) NOPASSWD: ALL` to allow sudo without password prompt
 1. Disable MATE's default desktop with `$ sudo graphical disable` (though later nodm will boot directly to matchbox anyway)
 1. Clean up MATE's desktop cruft with `$ rm -rf ~/*`
-1. Install some packages we'll need:
-    1. `$ sudo apt-get update && sudo apt-get install -y vim nodm matchbox-window-manager unclutter mailutils nitrogen jq chromium-browser=45.0.2454.101-0ubuntu1.1201 chromium-codecs-ffmpeg=45.0.2454.101-0ubuntu1.1201`
-    1. When mailutils prompts about its setup, "local only" is fine
+1. Remove some packages we don't need: `$ sudo apt-get purge -y $(dpkg --get-selections 'sonic*' 'thunderbird*' 'libreoffice*' 'minecraft*' 'scratch*' 'shotwell*' 'simple-scan*' 'hexchat*' 'pidgin*' 'transmission*' 'youtube-dl*' 'atril*' 'idle*' 'brasero*' 'omxplayer*' 'rhythmbox*' 'supercollider*' 'vlc*' | cut -f 1 | tr '\n' ' ')`
+1. Install some packages we'll need: `$ sudo apt-get update && sudo apt-get install -y vim nodm matchbox-window-manager unclutter mailutils nitrogen jq chromium-browser=45.0.2454.101-0ubuntu1.1201 chromium-codecs-ffmpeg=45.0.2454.101-0ubuntu1.1201`
+    * When mailutils prompts about its setup, "local only" is fine (we install mailutils so that you can check `mail` for cronjob output)
 1. Make sure [automatic software updates are disabled](http://ask.xmodulo.com/disable-automatic-updates-ubuntu.html), in `/etc/apt/apt.conf.d/10periodic`:
 
         APT::Periodic::Unattended-Upgrade "0";
@@ -32,6 +34,7 @@
         NODM_USER=pi
         NODM_FIRST_VT=8
 
+1. Check that the version in `.chilipie-kiosk-version` matches `$TAG`, and it's on GitHub
 1. Get default scripts with `$ wget "https://github.com/futurice/chilipie-kiosk/archive/master.zip" && unzip master.zip && cp -v $(find chilipie-kiosk-master/home/ -type f) . && rm -rf chilipie-kiosk-master/ master.zip`
 1. Put in the example crontab with `$ crontab -e`:
 
@@ -40,35 +43,36 @@
         # 0  7 * * 1-5 ~/display-on.sh  # turn display on weekdays at 7 AM
         # 0 19 * * 1-5 ~/display-off.sh # turn display off weekdays at 7 PM
 
-1. Reboot (should land you in Chromium)
-1. Configure Chromium to start from "where you left off", and navigate to https://github.com/futurice/chilipie-kiosk/blob/master/first-boot.md
-
-## Optional: WLAN
-
-1. Check the interface name with `$ ifconfig`, e.g. `wlan0`
-1. Append to `/etc/network/interfaces`:
+1. Set up WiFi (for Raspberry Pi 3 only):
+    1. Check the interface name with `$ ifconfig`, e.g. `wlan0`
+    1. Append to `/etc/network/interfaces`:
 
+        # Internal WiFi adapter
         allow-hotplug wlan0
         iface wlan0 inet dhcp
         wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf
         iface default inet dhcp
 
-1. In `/etc/wpa_supplicant/wpa_supplicant.conf`:
+    1. In `/etc/wpa_supplicant/wpa_supplicant.conf`:
 
         network={
             ssid="networkname"
             psk="secretpassword"
         }
 
-1. Reboot
-
-## Preparing the image
+    1. Symlink the file, for convenience: `$ ln -s /etc/wpa_supplicant/wpa_supplicant.conf wlan.conf`
 
 1. Disable SSH access (because the default credentials aren't very secure): `$ sudo systemctl disable ssh.service`
-1. Shut down the Raspberry Pi
-1. Dump the image to disk (assuming OS X):
-    1. `$ diskutil list` to check correct device
-    1. `$ diskutil unmountDisk /dev/disk2` to prepare it for imaging
-    1. `$ sudo dd bs=1m count=5120 if=/dev/disk2 of=chilipie-kiosk-$TAG.img` (only dump the relevant first 5 GB)
-    1. `$ openssl sha1 chilipie-kiosk-$TAG.img` and include hash in release notes
-    1. `$ zip chilipie-kiosk-$TAG.zip chilipie-kiosk-$TAG.img`
+1. Reboot (should land you in Chromium)
+1. Configure Chromium to start from "where you left off", and navigate to https://github.com/futurice/chilipie-kiosk/blob/$TAG/first-boot.md
+1. Unpower the Pi
+
+## Dumping the image
+
+Assuming OS X:
+
+1. `$ diskutil list` to check correct device
+1. `$ diskutil unmountDisk /dev/disk2` to prepare it for imaging
+1. `$ sudo dd bs=1m count=3750 if=/dev/disk2 of=chilipie-kiosk-$TAG.img` (only dump the relevant first ~3.7 GB, matching the original `ubuntu-mate` image size)
+1. `$ openssl sha1 chilipie-kiosk-$TAG.img` and include hash in release notes
+1. `$ zip chilipie-kiosk-$TAG.img.zip chilipie-kiosk-$TAG.img`