diff --git a/src/ci_orchestrator/commands/template.py b/src/ci_orchestrator/commands/template.py
index 7868de1..ea6e167 100644
--- a/src/ci_orchestrator/commands/template.py
+++ b/src/ci_orchestrator/commands/template.py
@@ -839,13 +839,18 @@ Register-ScheduledTask -TaskName 'CI-StaticIp' `
                 raise click.ClickException(f"Disk cleanup failed (exit {cleanup_ec}).")
             click.echo("[prepare-win] Post-update cleanup complete.")
 
-        # Re-affirm autologin (registry persists across the reboot below).
-        click.echo("[prepare-win] Re-affirming autologin registry settings ...")
+        # Re-affirm autologin + enforce the cmd.exe shell (registry persists
+        # across the reboot below). Setting Shell here — not only in the
+        # install-time post-install — means existing templates pick it up on the
+        # next prepare-win. A headless CI VM never needs explorer, and a running
+        # explorer crash-loops during heavy servicing; cmd removes that surface.
+        click.echo("[prepare-win] Re-affirming autologin + shell=cmd.exe ...")
         transport.run(
             "$wl = 'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon'\n"
             "Set-ItemProperty $wl AutoAdminLogon '1' -Type String -Force\n"
             f"Set-ItemProperty $wl DefaultUserName '{e(admin_username)}' -Type String -Force\n"
             "Set-ItemProperty $wl DefaultDomainName '.' -Type String -Force\n"
+            "Set-ItemProperty $wl Shell 'cmd.exe' -Type String -Force\n"
             f"if ('{e(admin_password)}' -ne '') {{\n"
             f"    Set-ItemProperty $wl DefaultPassword '{e(admin_password)}' -Type String -Force\n"
             "}\n"