Thanks for your help josch, but I decided to start from scratch since it was easy to restore my drive state. For future reference, these were my basic steps:
- Copy
reform-system-a311d.imgto SD card withdd - Boot from new SD image
- Login as root
- Create normal user account, make sudoable, and switch to that account
- Run
sudo umount /boot(see below) - Run
sudo reform-setup-encrypted-nvme(and agree to migrate) - Reboot into NVME
When I first ran reform-setup-encrypted-nvme it complained that a partition was still mounted, and I got a warning about /etc/crypttab not having an entry for my LUKS partition.
I unmounted /boot before running the script again. This time there were no
obvious errors or warnings—except that it said that reform-setup-encrypted-nvme had failed. Despite the failure message, rebooting
worked as expected. I didn’t think to capture the output until it
was too late!