diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e3a148d4..89387b8a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -26,7 +26,7 @@ jobs:
       - name: Install dependencies
         run: |
           sudo apt-get -y update
-          sudo apt-get -y install pkg-config libconfuse-dev clang
+          sudo apt-get -y install pkg-config libconfuse-dev clang libblkid-dev
           # clang picks the newest gcc tree it finds and needs the
           # matching libstdc++ headers to link the fuzzer runtime
           sudo apt-get -y install libstdc++-14-dev || true
@@ -99,7 +99,7 @@ jobs:
       - name: Install dependencies
         run: |
           sudo apt-get -y update
-          sudo apt-get -y install pkg-config tree jq libcap-dev libconfuse-dev
+          sudo apt-get -y install pkg-config tree jq libcap-dev libconfuse-dev libblkid-dev
           wget https://github.com/troglobit/libuev/releases/download/v2.4.1/libuev-2.4.1.tar.xz
           wget https://github.com/troglobit/libite/releases/download/v2.6.2/libite-2.6.2.tar.gz
           tar xf libuev-2.4.1.tar.xz
diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
index d3090c99..f49b44a0 100644
--- a/.github/workflows/coverity.yml
+++ b/.github/workflows/coverity.yml
@@ -55,7 +55,7 @@ jobs:
       - name: Install dependencies
         run: |
           sudo apt-get -y update
-          sudo apt-get -y install pkg-config libcap-dev libconfuse-dev
+          sudo apt-get -y install pkg-config libcap-dev libconfuse-dev libblkid-dev
           wget https://github.com/troglobit/libuev/releases/download/v2.4.1/libuev-2.4.1.tar.xz
           wget https://github.com/troglobit/libite/releases/download/v2.6.2/libite-2.6.2.tar.gz
           tar xf libuev-2.4.1.tar.xz
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index eb22a67e..cb1a1a24 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,7 +18,7 @@ jobs:
       - name: Installing dependencies ...
         run: |
           sudo apt-get -y update
-          sudo apt-get -y install pkg-config jq libcap-dev libconfuse-dev
+          sudo apt-get -y install pkg-config jq libcap-dev libconfuse-dev libblkid-dev
           wget https://github.com/troglobit/libuev/releases/download/v2.4.1/libuev-2.4.1.tar.xz
           wget https://github.com/troglobit/libite/releases/download/v2.6.2/libite-2.6.2.tar.gz
           tar xf libuev-2.4.1.tar.xz
diff --git a/.github/workflows/weekly.yml b/.github/workflows/weekly.yml
index b8b31da6..3b7508e3 100644
--- a/.github/workflows/weekly.yml
+++ b/.github/workflows/weekly.yml
@@ -34,7 +34,7 @@ jobs:
       - name: Install dependencies
         run: |
           sudo apt-get -y update
-          sudo apt-get -y install pkg-config jq libcap-dev libconfuse-dev
+          sudo apt-get -y install pkg-config jq libcap-dev libconfuse-dev libblkid-dev
           wget https://github.com/troglobit/libuev/releases/download/v2.4.1/libuev-2.4.1.tar.xz
           wget https://github.com/troglobit/libite/releases/download/v2.6.2/libite-2.6.2.tar.gz
           tar xf libuev-2.4.1.tar.xz
diff --git a/doc/build.md b/doc/build.md
index 23c7c13a..309f404c 100644
--- a/doc/build.md
+++ b/doc/build.md
@@ -8,6 +8,13 @@ optional plugins to enable.  It depends on three external libraries:
 - [libite][] (-lite), much needed frog DNA
 - [libConfuse][], the parser behind the .conf format
 
+The bundled device manager, keventd, needs a fourth: libblkid from
+[util-linux][].  It reads the filesystem UUID and label off block
+devices, which is what the curated rules name the `/dev/disk/by-uuid/`
+and `/dev/disk/by-label/` symlinks after.  keventd is enabled by
+default, so this is a hard requirement unless you build with
+`--without-keventd`.
+
 > [!IMPORTANT]
 > Most free/open source software packages that use `configure` default
 > to install to `/usr/local`.  However, some Linux distributions do no
@@ -24,6 +31,7 @@ version of the above mentioned libraries.  Currently required versions:
 - libite v2.2.0, or later
 - libuEv v2.2.0, or later
 - libConfuse v3.3, or later
+- libblkid, any version, when keventd is enabled
 
 
 Configure
@@ -67,6 +75,10 @@ Below are a few of the main switches to configure:
 
 * `--enable-x11-common-plugin`: Enable the optional X Window `x11-common.so` plugin.
 
+* `--without-keventd`: Drop the bundled device manager, for systems that
+  run mdev, mdevd, or udevd instead.  Enabled by default, and the only
+  thing that pulls in libblkid.  See [Bundled Device Manager](keventd.md).
+
 * `--with-sulogin`: Enable bundled `sulogin` program.  Default is to use the
   system `sulogin(8)`.  The sulogin shipped with Finit *allows password-less*
   login if the `root` user is disabled or has no password at all.
@@ -259,3 +271,4 @@ it only for debugging start up issues when Finit crashes.
 [libuEv]:  https://github.com/troglobit/libuev
 [libite]:  https://github.com/troglobit/libite
 [libConfuse]: https://github.com/libconfuse/libconfuse
+[util-linux]: https://github.com/util-linux/util-linux
diff --git a/doc/keventd.md b/doc/keventd.md
index 84dcf5b9..4a3cd576 100644
--- a/doc/keventd.md
+++ b/doc/keventd.md
@@ -6,8 +6,11 @@ with Finit.  It replaces the need for external device managers like
 mdev, mdevd, or udevd on systems where a lighter-weight solution is
 preferred, particularly on embedded systems.
 
-It is enabled by default since Finit v5.  To disable it and use an
-external device manager instead:
+It is enabled by default since Finit v5, and needs libblkid from
+util-linux (the `libblkid-dev` package, or whatever your distribution
+calls it) to read the filesystem UUID and label behind the
+`/dev/disk/by-uuid/` and `/dev/disk/by-label/` symlinks.  To disable it
+and use an external device manager instead:
 
     ./configure --without-keventd
 
@@ -103,6 +106,10 @@ among others:
 They also set up a few fixed names: `/dev/rtc`, `/dev/cdrom`, and
 `/dev/virtio-ports/<name>`.
 
+The `by-uuid` and `by-label` links are why keventd needs libblkid.  The
+rules read the filesystem metadata off the device with
+`IMPORT{builtin}="blkid"`, and libblkid is what that builtin calls.
+
 Built-in and rule-provided symlinks alike are tracked internally and
 removed when the corresponding device is unplugged.
 
@@ -252,8 +259,6 @@ Usage
       -G        Disable netlink rebroadcast entirely
       -h        Show help text
       -n        Run in foreground (no daemon)
-      -p        Passive mode: power supply events only
-      -r DIR    Extra rules directory
       -v        Show version
 
 In normal operation, Finit starts keventd automatically via its system