diff --git a/desktop.commands b/desktop.commands
index 17ccdd9..dda4647 100644
--- a/desktop.commands
+++ b/desktop.commands
@@ -2,6 +2,10 @@ root-password password:weakpassword
 update
 selinux-relabel
 install @workstation-product-environment
-link /usr/lib/systemd/system/graphical.target:/etc/systemd/system/default.target
 firstboot-command useradd -m -p '' test
 firstboot-command echo 'test:weakpassword' | chpasswd
+# we do this on firstboot (i.e. when createhdds boots to do the selinux
+# relabel) so the selinux label on the symlink is correct; see RHBZ #1349586
+firstboot-command systemctl set-default graphical.target
+# workaround RHBZ #1349664
+firstboot-command systemctl enable gdm.service
diff --git a/kde.commands b/kde.commands
index b586b10..0ce6392 100644
--- a/kde.commands
+++ b/kde.commands
@@ -2,8 +2,12 @@ root-password password:weakpassword
 update
 selinux-relabel
 install @kde-desktop-environment
-link /usr/lib/systemd/system/graphical.target:/etc/systemd/system/default.target
 delete /etc/systemd/system/multi-user.target.wants/initial-setup-text.service
 delete /etc/systemd/system/graphical.target.wants/initial-setup-graphical.service
 firstboot-command useradd -m -p '' test
 firstboot-command echo 'test:weakpassword' | chpasswd
+# we do this on firstboot (i.e. when createhdds boots to do the selinux
+# relabel) so the selinux label on the symlink is correct; see RHBZ #1349586
+firstboot-command systemctl set-default graphical.target
+# workaround RHBZ #1349664
+firstboot-command systemctl enable sddm.service