diff --git a/src/ci_orchestrator/winimage/assets/autounattend.win2025.xml b/src/ci_orchestrator/winimage/assets/autounattend.win2025.xml
index b02fd12..0425956 100644
--- a/src/ci_orchestrator/winimage/assets/autounattend.win2025.xml
+++ b/src/ci_orchestrator/winimage/assets/autounattend.win2025.xml
@@ -127,6 +127,23 @@
       <RegisteredOwner>CI</RegisteredOwner>
       <RegisteredOrganization>CI Lab</RegisteredOrganization>
     </component>
+
+    <!-- Set the interactive shell to cmd.exe before the first logon, so a
+         headless CI build VM never starts explorer (which crash-loops during
+         heavy servicing). post-install.ps1 / prepare-win re-affirm this. -->
+    <component name="Microsoft-Windows-Deployment"
+               processorArchitecture="amd64"
+               publicKeyToken="31bf3856ad364e35"
+               language="neutral"
+               versionScope="nonSxS">
+      <RunSynchronous>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>1</Order>
+          <Path>reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d cmd.exe /f</Path>
+          <Description>Set interactive shell to cmd.exe</Description>
+        </RunSynchronousCommand>
+      </RunSynchronous>
+    </component>
   </settings>
 
   <settings pass="oobeSystem">