diff -r b4503723c5d7 -r 6ba7a01c06d8 base/hammerhead-xdm/Xresources
--- a/base/hammerhead-xdm/Xresources	Fri Jul 24 12:52:43 2026 -0500
+++ b/base/hammerhead-xdm/Xresources	Fri Jul 24 13:07:39 2026 -0500
@@ -23,6 +23,7 @@
 ! otherwise show its scary "This is an unsecure session". Use the same host text.
 xlogin*unsecureGreeting: CLIENTHOST
 xlogin*namePrompt: \040\040\040\040\040\040\040Login:
+xlogin*passwdPrompt: \040\040\040\040Password:
 xlogin*fail: Login incorrect or forbidden by policy
 
 #if WIDTH > 800
@@ -77,6 +78,17 @@
 xlogin*useShape: true
 xlogin*logoPadding: 10
 
+! hh-greeter-power: Shutdown/Reboot button bar on the greeter (Zygaena teal).
+HhGreeterPower*background:		#0d1117
+HhGreeterPower*Box.background:		#0d1117
+HhGreeterPower*Command.background:	#12303a
+HhGreeterPower*Command.foreground:	#54e0e0
+HhGreeterPower*Command.borderColor:	#1fb6b6
+HhGreeterPower*Command.borderWidth:	1
+HhGreeterPower*Command.internalWidth:	14
+HhGreeterPower*Command.internalHeight:	8
+HhGreeterPower*Command.font:		-*-helvetica-bold-r-normal-*-14-*-*-*-*-*-iso8859-1
+
 XConsole.text.geometry:	480x130
 XConsole.verbose:	true
 XConsole*iconic:	true
diff -r b4503723c5d7 -r 6ba7a01c06d8 base/hammerhead-xdm/Xsetup_0
--- a/base/hammerhead-xdm/Xsetup_0	Fri Jul 24 12:52:43 2026 -0500
+++ b/base/hammerhead-xdm/Xsetup_0	Fri Jul 24 13:07:39 2026 -0500
@@ -11,3 +11,7 @@
 /usr/local/bin/xsetroot -solid "#0d1117"
 [ -r /usr/local/share/backgrounds/hammerhead.png ] && \
 	/usr/local/bin/feh --bg-fill /usr/local/share/backgrounds/hammerhead.png &
+
+# Shutdown/Reboot button bar, top-right corner (no WM on the greeter). Killed
+# by Xstartup on login so it never leaks into the user's session.
+/usr/local/bin/hh-greeter-power -geometry -40+40 &
diff -r b4503723c5d7 -r 6ba7a01c06d8 base/hammerhead-xdm/Xstartup
--- a/base/hammerhead-xdm/Xstartup	Fri Jul 24 12:52:43 2026 -0500
+++ b/base/hammerhead-xdm/Xstartup	Fri Jul 24 13:07:39 2026 -0500
@@ -2,4 +2,7 @@
 # Xstartup - runs as root at session start on display :0.
 # Give console ownership to the logging-in user (GiveConsole). Absolute paths.
 /bin/chown "$USER" /dev/console
+# Remove the greeter's Shutdown/Reboot button bar so it doesn't leak into the
+# user's session (the foreign server is not reset on login).
+/usr/bin/pkill -x hh-greeter-power 2>/dev/null
 exit 0
diff -r b4503723c5d7 -r 6ba7a01c06d8 base/hammerhead-xdm/build.sh
--- a/base/hammerhead-xdm/build.sh	Fri Jul 24 12:52:43 2026 -0500
+++ b/base/hammerhead-xdm/build.sh	Fri Jul 24 13:07:39 2026 -0500
@@ -24,6 +24,13 @@
 install -m 755 "$PORTDIR/Xstartup" "$XDMDIR/Xstartup"
 install -m 755 "$PORTDIR/Xreset"   "$XDMDIR/Xreset"
 
+# --- A2. hh-greeter-power: Xaw Shutdown/Reboot button bar for the greeter ---
+mkdir -p "$PKGDIR$PREFIX/bin"
+gcc "$PORTDIR/hh-greeter-power.c" \
+    -I"$PREFIX/include" -L"$PREFIX/lib" -R"$PREFIX/lib" \
+    -lXaw7 -lXmu -lXt -lX11 \
+    -o "$PKGDIR$PREFIX/bin/hh-greeter-power"
+
 # --- B. zyginit service (shipped DISABLED) -> /etc/zyginit/services/xdm/ ---
 # Absolute /etc, OUTSIDE $PREFIX. No enabled.d symlink is created.
 SVCDIR="$PKGDIR/etc/zyginit/services/xdm"
diff -r b4503723c5d7 -r 6ba7a01c06d8 base/hammerhead-xdm/hh-greeter-power.c
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/base/hammerhead-xdm/hh-greeter-power.c	Fri Jul 24 13:07:39 2026 -0500
@@ -0,0 +1,60 @@
+/*
+ * hh-greeter-power.c - a tiny Athena (Xaw) button bar with Shutdown and
+ * Reboot buttons for the xdm greeter.
+ *
+ * xdm's classic xlogin greeter has no power buttons, and the greeter display
+ * runs with no window manager. This standalone client is launched by
+ * Xsetup_0 (as root, so `zygctl poweroff`/`reboot` have the privilege to run)
+ * and killed by Xstartup when a session begins, so it never leaks into the
+ * user's desktop. Styling + placement come from the HhGreeterPower* resources
+ * in Xresources (loaded onto the server by xrdb) plus the -geometry passed by
+ * Xsetup_0.
+ *
+ * Build: cc hh-greeter-power.c -I$PREFIX/include -L$PREFIX/lib -R$PREFIX/lib \
+ *        -lXaw7 -lXmu -lXt -lX11 -o hh-greeter-power
+ */
+#include <X11/Intrinsic.h>
+#include <X11/StringDefs.h>
+#include <X11/Shell.h>
+#include <X11/Xaw/Box.h>
+#include <X11/Xaw/Command.h>
+#include <stdlib.h>
+
+static void
+poweroff_cb(Widget w, XtPointer client, XtPointer call)
+{
+    (void) w; (void) client; (void) call;
+    (void) system("/sbin/zygctl poweroff");
+}
+
+static void
+reboot_cb(Widget w, XtPointer client, XtPointer call)
+{
+    (void) w; (void) client; (void) call;
+    (void) system("/sbin/zygctl reboot");
+}
+
+int
+main(int argc, char **argv)
+{
+    XtAppContext app;
+    Widget top, box, sd, rb;
+
+    top = XtOpenApplication(&app, "HhGreeterPower", NULL, 0, &argc, argv,
+        NULL, applicationShellWidgetClass, NULL, 0);
+
+    box = XtVaCreateManagedWidget("box", boxWidgetClass, top,
+        XtNorientation, XtorientHorizontal, (char *)NULL);
+
+    sd = XtVaCreateManagedWidget("Shutdown", commandWidgetClass, box,
+        (char *)NULL);
+    XtAddCallback(sd, XtNcallback, poweroff_cb, NULL);
+
+    rb = XtVaCreateManagedWidget("Reboot", commandWidgetClass, box,
+        (char *)NULL);
+    XtAddCallback(rb, XtNcallback, reboot_cb, NULL);
+
+    XtRealizeWidget(top);
+    XtAppMainLoop(app);
+    return 0;
+}
diff -r b4503723c5d7 -r 6ba7a01c06d8 base/hammerhead-xdm/package.toml
--- a/base/hammerhead-xdm/package.toml	Fri Jul 24 12:52:43 2026 -0500
+++ b/base/hammerhead-xdm/package.toml	Fri Jul 24 13:07:39 2026 -0500
@@ -10,7 +10,7 @@
 [package]
 name = "hammerhead-xdm"
 version = "1.0.0"
-release = 9
+release = 10
 description = "Zygaena marine-dark xdm greeter branding, system Xsession/Xservers wiring, and a disabled zyginit xdm service"
 url = "https://git.sharkos.one/zygaena/hammerhead"
 license = "CDDL-1.0"
@@ -22,6 +22,9 @@
 # Xresources onto the greeter; xauth: start.sh sets the MIT-MAGIC-COOKIE for
 # the decoupled (foreign) server (release 3).
 runtime = ["xdm", "hammerhead-desktop", "xsetroot", "xrdb", "xauth"]
+# libXaw/libXt/libXmu: to compile hh-greeter-power (the greeter's Xaw
+# Shutdown/Reboot button bar).
+build = ["libXaw", "libXt", "libXmu", "libX11"]
 
 [build]
 parallel = false