diff --git a/doc/ChangeLog.md b/doc/ChangeLog.md
index fafcacdd..756e723e 100644
--- a/doc/ChangeLog.md
+++ b/doc/ChangeLog.md
@@ -8,6 +8,12 @@ All relevant changes are documented in this file.
 
 ### Changes
 
+- The generated `/run/finit/system/*.conf` files for built-in services
+  (keventd, watchdogd, runparts) are now read before
+  `/lib/finit/system/*.conf` instead of after.  Built-ins can now be
+  referenced in `if:` statements from system .conf files and overridden
+  by name from both `/lib/finit/system` and `/etc/finit.d`, the latter
+  is still always read last
 - The `dbus.so` plugin, which starts an external `dbus-daemon`, is now
   enabled by default.  It does nothing on systems without a
   `dbus-daemon` installed, and `--disable-dbus-plugin` opts out.  The
diff --git a/doc/config/files.md b/doc/config/files.md
index bfb86d5a..edab5c08 100644
--- a/doc/config/files.md
+++ b/doc/config/files.md
@@ -26,7 +26,6 @@ the following layout is recommended:
         `- finit/
             |- bus         # Finit's own D-Bus socket, see doc/dbus.md
             `- system/
-                |- dbus.conf
                 |- keventd.conf
                 |- runparts.conf
                 |- watchdogd.conf
@@ -36,18 +35,21 @@ Configuration files in `/etc` are provided by the user, or projects like
 [finit-skel](https://github.com/finit-project/finit-skel) and extended by
 the user.
 
+The files in `/run/finit/system/*.conf` are generated by Finit for its
+built-in services: runparts, [watchdog](../watchdog.md), and
+[`keventd`](../keventd.md), if they are enabled.  They are read before
+the other .conf directories, so any later file can reference them in
+`if:` statements and override them by name.
+
 The files in `/lib/finit/system/*.conf` are system critical services and
 setup provided by Finit, e.g. udev/mdev that must run very early at system
 bootstrap.  This system directory was introduced in Finit v4.4 to replace
-the hard-coded services provided by plugins before.  All .conf files in this
-directory be either replaced by a system administrator or overridden by a
-file with the same name in `/etc/finit.d/`.
+the hard-coded services provided by plugins before.
 
-The files in `/run/finit/system/*.conf` are created by plugins and Finit
-bundled services like runparts, [watchdog](../watchdog.md), and
-[`keventd`](../keventd.md) if they are enabled.  Like
-`/lib/finit/system/*.conf`, these files can be overridden by file with
-the same name in `/etc/finit.d/`.
+All .conf files in both directories can be either replaced by a system
+administrator or overridden by a file with the same name in
+`/etc/finit.d/`, which is always read last -- copy a .conf there and
+modify it, or symlink it to `/dev/null` to disable it outright.
 
 Services in the `available/` and `enabled/` sub-directories are called
 dynamic services, in contrast to static services -- the only difference
@@ -56,16 +58,17 @@ with the `enable` and `disable` commands.  An administrator can always
 create files and symlinks manually.
 
 At bootstrap, and `initctl reload`, all .conf files are read, starting
-with `finit.conf`, then `/lib/finit/system/*.conf`, `finit.d/*.conf`,
-and finally all `finit.d/enabled/*.conf` files.  Each directory is a
-unique group, where files within each group are sorted alphabetically.
+with `finit.conf`, then `/run/finit/system/*.conf`,
+`/lib/finit/system/*.conf`, `finit.d/*.conf`, and finally all
+`finit.d/enabled/*.conf` files.  Each directory is a unique group,
+where files within each group are sorted alphabetically.
 
 **Example:**
 
+    /run/finit/system/keventd.conf
+    /run/finit/system/runparts.conf
     /lib/finit/system/10-hotplug.conf
     /lib/finit/system/90-testserv.conf
-    /run/finit/system/dbus.conf
-    /run/finit/system/runparts.conf
     /etc/finit.d/10-abc.conf
     /etc/finit.d/20-abc.conf
     /etc/finit.d/enabled/1-aaa.conf
diff --git a/src/conf.c b/src/conf.c
index 8127569d..53f9f845 100644
--- a/src/conf.c
+++ b/src/conf.c
@@ -701,9 +701,9 @@ char *conf_escape(const char *str, char *buf, size_t len)
 }
 
 /*
- * Called by plugins and similar that dynamically generate system
- * services.  @body holds the block contents, one indented line per
- * setting.
+ * Generates /run/finit/system/<file> for Finit's built-in services,
+ * which must probe the running system before registering.  @fmt holds
+ * the block contents, one indented line per setting.
  */
 void conf_save_service(int type, const char *name, char *file, const char *fmt, ...)
 {
@@ -2307,28 +2307,23 @@ int conf_reload(void)
 	}
 
 	/*
-	 * Next, read all *.conf in /lib/finit/system and /etc/finit.d/
-	 * The system files were previously created at runtime by plugins
-	 * but are now regular files that can be overridden by files in
-	 * /etc/finit.d -- similar to how tmfiles.d(5) work.  E.g., add
-	 * an override .conf, or an ignore by symlinking to /dev/null
+	 * Next, read all *.conf in /run/finit/system, /lib/finit/system,
+	 * and /etc/finit.d/.  The runtime directory holds files Finit
+	 * generates for its built-in services (keventd, watchdogd,
+	 * runparts), read first so later files can reference them in
+	 * if: statements.  A same-named file in a later directory
+	 * overrides an earlier one, similar to how tmpfiles.d(5) work,
+	 * so /etc/finit.d, always read last, is how users override any
+	 * built-in or bundled configuration.
 	 *
-	 * The .conf files (and run/task/service stanzas) are parsed and
-	 * started in order.  Each directory is sorted alphanumerically
-	 * and then the result is appended to the overall order:
-	 *
-	 *     /lib/finit/system/10-hotplug.conf
-	 *     /lib/finit/system/90-testserv.conf
-	 *     /run/finit/system/dbus.conf
-	 *     /run/finit/system/tty.conf
-	 *     /etc/finit.d/10-abc.conf
-	 *     /etc/finit.d/20-abc.conf
-	 *     /etc/finit.d/enabled/1-aaa.conf
-	 *     /etc/finit.d/enabled/1-abc.conf
-	 *     /etc/finit.d/enabled/2-aaa.conf
+	 * The .conf files (and their run/task/service stanzas) are
+	 * parsed and started in order.  Each directory is sorted
+	 * alphanumerically before being appended to the overall order,
+	 * recorded in /run/finit/conf.order at bootstrap.  See
+	 * doc/config/files.md for an example.
 	 */
-	glob_append(&gl, 0, "%s/*.conf", FINIT_SYSPATH_);
-	glob_append(&gl, 1, "%s/*.conf", FINIT_RUNPATH_);
+	glob_append(&gl, 0, "%s/*.conf", FINIT_RUNPATH_);
+	glob_append(&gl, 1, "%s/*.conf", FINIT_SYSPATH_);
 	glob_append(&gl, 1, "%s/*.conf", finit_rcsd);
 	glob_append(&gl, 1, "%s/enabled/*.conf", finit_rcsd);