diff --git a/runners/embedded/Cargo.toml b/runners/embedded/Cargo.toml
index 64d3e33a..46015552 100644
--- a/runners/embedded/Cargo.toml
+++ b/runners/embedded/Cargo.toml
@@ -62,11 +62,39 @@ serde = { version = "1", features = ["derive"] }
 toml = "0.5"
 
 [features]
-default = ["admin-app", "fido-authenticator", "ndef-app", "oath-authenticator",
+complete = ["admin-app", "fido-authenticator", "ndef-app", "oath-authenticator",
 		"piv-authenticator", # "provisioner-app",
 		"fido-authenticator/disable-reset-time-window",
 		"trussed/clients-5", "log-traceP", "log-rtt"]
 
+default = ["admin-app", "fido-authenticator", "ndef-app", "oath-authenticator", "trussed/clients-4"]
+
+# develop = ["no-encrypted-storage", "no-buttons", "no-reset-time-window"]
+# develop = ["no-encrypted-storage", "no-reset-time-window"]
+# develop = ["no-encrypted-storage", "no-buttons"]
+develop = ["no-encrypted-storage", "trussed/clients-4", 
+					 "fido-authenticator/disable-reset-time-window",
+					 "log-traceP", "log-rtt"]
+
+develop-piv = ["develop", "piv-authenticator", "trussed/clients-5"]
+develop-provisioner = ["develop", "provisioner-app", "trussed/clients-5"]
+
+# Do not use encryption for the filesystem
+no-encrypted-storage = []
+
+# Check for undefined flash and write to determined value (for prince provisioning)
+write-undefined-flash = []
+
+# Use to auto-succeed every user presence check
+no-buttons = []
+
+# Allow resetting FIDO authenticator (and possibly others) even after 10s uptime
+no-reset-time-window = ["fido-authenticator/disable-reset-time-window"]
+
+# Format filesystem anyway
+format-filesystem = []
+
+
 board-nrfdk = ["soc-nrf52840", "extflash_qspi"]
 board-proto1 = ["soc-nrf52840"]
 board-nk3am = ["soc-nrf52840", "extflash_qspi"]
@@ -76,10 +104,8 @@ board-okdoe1 = ["soc-lpc55", "board-lpcxpresso55"]
 board-solo2 = ["soc-lpc55"]
 board-nk3xn = ["soc-lpc55"]
 
-soc-nrf52840 = ["nrf52840-hal", "nrf52840-pac", "chacha20",
-		"provisioner-app/nrf52"]
-soc-lpc55 = ["lpc55-hal", "lpc55-pac", "fm11nc08",
-		"provisioner-app/lpc55"]
+soc-nrf52840 = ["nrf52840-hal", "nrf52840-pac", "chacha20", "provisioner-app/nrf52"]
+soc-lpc55 = ["lpc55-hal", "lpc55-pac", "fm11nc08", "provisioner-app/lpc55"]
 
 extflash_qspi = []
 
diff --git a/runners/embedded/Makefile b/runners/embedded/Makefile
index 89396d72..a86a29ab 100644
--- a/runners/embedded/Makefile
+++ b/runners/embedded/Makefile
@@ -1,8 +1,5 @@
 
-# MANUALLY SET - or derive from 'build-*-*' target
-#BOARD ?= 
-#BUILD_PROFILE ?=
-# BUILD_ID fully identifies the build
+
 BUILD_ID ?= $(BUILD_PROFILE)-$(BOARD)
 CFG_PATH ?= profiles/$(BUILD_PROFILE).toml
 
@@ -12,7 +9,6 @@ else
   SOC = nrf52
 endif
 
-
 # also RUST_TARGET
 TARGET = $(shell python -c 'import toml; print(toml.load("$(CFG_PATH)")["platform"]["target"])')
 # also binutils-prefix
@@ -22,15 +18,24 @@ GNU_TARGET = arm-none-eabi
 CFG_VAL_BOARDS = $(shell python -c 'import toml; print(" ".join(toml.load("$(CFG_PATH)")["platform"]["boards"]))')
 CFG_VAL_SOC = $(shell python -c 'import toml; print(toml.load("$(CFG_PATH)")["platform"]["soc"])')
 
+# input files and outputs
 SRCS = $(shell find . -name "*.rs" | grep -v '/target/')
 OUT = runner-$(BUILD_ID).bin
 OUT_IHEX = $(OUT).ihex
 RAW_OUT = $(SOC)_runner
 
+# util fn/paths
 LOG ?= build-$(BUILD_ID).err.log
 SYMBOLS ?= symbols-$(BUILD_ID).txt
 
-EXTRA_FEATURES ?= 
+# feature definition
+FEATURES ?= develop
+BUILD_FEATURES := board-$(BOARD) $(FEATURES)
+# assemble comma-seperated list to pass to `cargo build`
+delim = ,
+space := $(null) #
+COMMA_FEATURES = $(subst $(space),$(delim),$(BUILD_FEATURES))
+
 
 .PHONY: list build reset program clean clean-all check-env set-vars
 
@@ -45,6 +50,9 @@ help:
 	##
 	## Or build using one of the pre-defined "target shortcuts" (see `make list`):
 	## $ make build-proto1
+	##
+	## AND pass EXTRA_FEATURES="A B C" for build feature-variants
+	## $ make build-nk3am FEATURES=complete
 	###############################################################################
 	###############################################################################
 
@@ -74,10 +82,10 @@ check-var-%:
 
 %-banner:
 	@echo "******************************************************************************************"
-	@echo "**** MAKE EMBEDDED RUNNER:"
-	@echo "****  BOARD:   $(shell printf %18s $(BOARD)) | SOC:      $(SOC)"
-	@echo "****  PROFILE: $(shell printf %18s $(BUILD_PROFILE)) | BUILD_ID: $(BUILD_ID)"
-	@echo "****  TARGET:  $(shell printf %18s $(GET_TARGET)) | BINARY:   $(OUT)(.ihex)"
+	@echo "**** TARGET:   $(shell printf %18s $(GET_TARGET)) | BINARY:   $(OUT)(.ihex)"
+	@echo "**** BOARD:    $(shell printf %18s $(BOARD)) | SOC:      $(SOC)"
+	@echo "**** PROFILE:  $(shell printf %18s $(BUILD_PROFILE)) | BUILD_ID: $(BUILD_ID)"
+	@echo "**** FEATURES: $(BUILD_FEATURES)"
 	@echo "******************************************************************************************"
 
 list:
@@ -111,11 +119,9 @@ build: build-banner $(SRCS) check-var-BOARD check-var-BUILD_PROFILE check-var-SO
 	rm -f target/$(TARGET)/release/$(RAW_OUT)
 
 	BUILD_PROFILE=$(BUILD_PROFILE) BOARD=$(BOARD) \
-		cargo build --release \
-		--target $(TARGET) \
-		--features board-$(BOARD) $(EXTRA_FEATURES) \
-		--color always 2> $(LOG) \
-			|| ( cat $(LOG); exit 1 )
+		cargo build --release --target $(TARGET) \
+		--features $(COMMA_FEATURES) \
+		--color always 2> $(LOG) || ( cat $(LOG); exit 1 )
 
 	cp target/$(TARGET)/release/$(RAW_OUT) ./$(OUT)
 
diff --git a/runners/embedded/src/bin/app-lpc.rs b/runners/embedded/src/bin/app-lpc.rs
index 509ad27c..387743f2 100644
--- a/runners/embedded/src/bin/app-lpc.rs
+++ b/runners/embedded/src/bin/app-lpc.rs
@@ -131,7 +131,11 @@ mod app {
 
 		/* -> initializer::initialize_filesystem() */
 		// TODO: make fs encryption configurable
+		#[cfg(feature = "no-encrypted-storage")]
+		let internal_fs = ERL::soc::types::InternalFilesystem::new(flash_gordon);
+		#[cfg(not(feature = "no-encrypted-storage"))]
 		let internal_fs = ERL::soc::types::InternalFilesystem::new(flash_gordon, prince);
+
 		let external_fs = ERL::soc::types::ExternalRAMStorage::new();
 		let store: ERL::types::RunnerStore = ERL::init_store(internal_fs, external_fs);
 		// out: { store, internal_storage_fs }