diff --git a/.ci/shellcheck.sh b/.ci/shellcheck.sh
index a8fd45811..cad7aadc1 100755
--- a/.ci/shellcheck.sh
+++ b/.ci/shellcheck.sh
@@ -16,6 +16,7 @@ fi
 # Shell: shellcheck
 sh_files="
 	./main/mdss-fb-init-hack/mdss-fb-init-hack.sh
+	./main/osk-sdl/unlock.sh
 	./main/postmarketos-base/rootfs-usr-lib-firmwareload.sh
 	./main/postmarketos-installkernel/installkernel-pmos
 	./main/postmarketos-mkinitfs/init.sh
diff --git a/main/osk-sdl/APKBUILD b/main/osk-sdl/APKBUILD
index aaf0b980c..1f20b09a9 100644
--- a/main/osk-sdl/APKBUILD
+++ b/main/osk-sdl/APKBUILD
@@ -5,7 +5,7 @@
 # https://gitlab.alpinelinux.org/alpine/apk-tools/-/issues/10712
 pkgname=osk-sdl
 pkgver=0.66
-pkgrel=0
+pkgrel=1
 pkgdesc="Onscreen keyboard for unlocking LUKS devices"
 url="https://gitlab.com/postmarketOS/osk-sdl"
 arch="all"
@@ -25,7 +25,11 @@ makedepends="
 	sdl2-dev
 	sdl2_ttf-dev
 	"
-source="https://gitlab.com/postmarketOS/osk-sdl/-/archive/$pkgver/osk-sdl-$pkgver.tar.gz"
+source="
+	https://gitlab.com/postmarketOS/osk-sdl/-/archive/$pkgver/osk-sdl-$pkgver.tar.gz
+	osk-sdl.files
+	unlock.sh
+	"
 options="!strip !check" # No tests
 subpackages="$pkgname-doc"
 provides="postmarketos-fde-unlocker"
@@ -39,12 +43,20 @@ build() {
 package() {
 	DESTDIR="$pkgdir" meson install --no-rebuild -C build
 
+	install -Dm755 "$srcdir"/unlock.sh \
+		"$pkgdir"/bin/fde-unlock
+
 	# needed to trigger initfs rebuild:
 	touch osk-sdl
 	install -Dm644 osk-sdl \
 		"$pkgdir"/usr/share/postmarketos-mkinitfs-triggers/osk-sdl
+
+	install -Dm644 "$srcdir"/osk-sdl.files \
+		"$pkgdir"/etc/postmarketos-mkinitfs/files/30-osk-sdl.files
 }
 
 sha512sums="
 e4bc5bf6c6faa536a66c48451b88dd9228f2ff2f82e23963607a111df83a48296158b0408b1889c93d3cfe31e48c089f7be68bb5b7c06b01bd43970a824babdb  osk-sdl-0.66.tar.gz
+e1017bc0667756b82527d88f47a77e2f5a44e0769b5ccdea0c6c1f86bd3d0a1df9d9f5bbb224888748cfef5edc3375036a25099eb02c963302f155c3b2e8fefd  osk-sdl.files
+5e2de0da40f3b409cb01c388ab61e8072db30789af6f8a7fec817699dcb928b8aec25288fb1e59403e99769dec032f1b446bcc5f761d9a6504e238fa205281fd  unlock.sh
 "
diff --git a/main/osk-sdl/osk-sdl.files b/main/osk-sdl/osk-sdl.files
new file mode 100644
index 000000000..2ddddd33b
--- /dev/null
+++ b/main/osk-sdl/osk-sdl.files
@@ -0,0 +1 @@
+/bin/fde-unlock
diff --git a/main/osk-sdl/unlock.sh b/main/osk-sdl/unlock.sh
new file mode 100644
index 000000000..eac5446c5
--- /dev/null
+++ b/main/osk-sdl/unlock.sh
@@ -0,0 +1,55 @@
+#!/bin/sh
+# shellcheck disable=SC1091
+
+partition=$1
+. /etc/deviceinfo
+
+# $1: SDL_VIDEODRIVER value (e.g. 'kmsdrm', 'directfb')
+run_osk_sdl() {
+	unset ETNA_MESA_DEBUG
+	unset SDL_VIDEODRIVER
+	unset DFBARGS
+	unset TSLIB_TSDEVICE
+	unset OSK_EXTRA_ARGS
+	case "$1" in
+		"kmsdrm")
+			# Set up SDL and Mesa env to use kmsdrm backend
+			export SDL_VIDEODRIVER="kmsdrm"
+			# needed for librem 5
+			export ETNA_MESA_DEBUG="no_supertile"
+			;;
+		"directfb")
+			# Set up directfb and tslib
+			# Note: linux_input module is disabled since it will try to take over
+			# the touchscreen device from tslib (e.g. on the N900)
+			# Note: ps2mouse module is disabled because it causes
+			# jerky/inconsistent touch input on some devices
+			export DFBARGS="system=fbdev,no-cursor,disable-module=linux_input,disable-module=ps2mouse"
+			export SDL_VIDEODRIVER="directfb"
+			# SDL/directfb tries to use gles even though it's not
+			# actually available, so disable it in osk-sdl
+			export OSK_EXTRA_ARGS="--no-gles"
+			# shellcheck disable=SC2154
+			if [ -n "$deviceinfo_dev_touchscreen" ]; then
+				export TSLIB_TSDEVICE="$deviceinfo_dev_touchscreen"
+			fi
+			;;
+	esac
+
+	# osk-sdl needs evdev for input and doesn't launch without it, so
+	# make sure the module isn't missed
+	modprobe evdev
+	osk-sdl $OSK_EXTRA_ARGS -n root -d "$partition" -c /etc/osk.conf \
+		-o /boot/osk.conf -v > /osk-sdl.log 2>&1
+}
+
+# shellcheck disable=SC2154
+if [ -n "$deviceinfo_mesa_driver" ]; then
+    # try to run osk-sdl with kmsdrm driver, then fallback to
+    # directfb if that fails
+    if ! run_osk_sdl "kmsdrm"; then
+        run_osk_sdl "directfb"
+    fi
+else
+    run_osk_sdl "directfb"
+fi