diff --git a/src/ci_orchestrator/winimage/assets/post-install.win.ps1.tmpl b/src/ci_orchestrator/winimage/assets/post-install.win.ps1.tmpl
index b834b4d..3485b10 100644
--- a/src/ci_orchestrator/winimage/assets/post-install.win.ps1.tmpl
+++ b/src/ci_orchestrator/winimage/assets/post-install.win.ps1.tmpl
@@ -179,9 +179,16 @@ reg add 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' /v AutoAdmi
 reg add 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' /v DefaultUserName  /t REG_SZ /d "{{ADMIN_USER}}" /f | Out-Null
 reg add 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' /v DefaultPassword  /t REG_SZ /d "{{ADMIN_PWD}}" /f | Out-Null
 reg add 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' /v DefaultDomainName /t REG_SZ /d '.'           /f | Out-Null
+# Interactive shell = cmd.exe instead of explorer.exe. A headless CI build VM
+# never needs the desktop shell (builds run over WinRM in Session 0), and a
+# running explorer is fragile: heavy servicing (Windows Update / DISM component
+# cleanup) destabilises the live shell and explorer crash-loops until the next
+# reboot. cmd as the shell removes that surface entirely; explorer can still be
+# launched on demand (run "explorer.exe", or over RDP).
+reg add 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' /v Shell /t REG_SZ /d 'cmd.exe' /f | Out-Null
 # OOBE non-policy key (supplements the Policies\Windows\OOBE key set above)
 reg add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE' /v DisablePrivacyExperience /t REG_DWORD /d 1 /f | Out-Null
-L 'Lock screen, SM GPO policy + task, CAD Winlogon, autologin Administrator, OOBE non-policy key set'
+L 'Lock screen, SM GPO policy + task, CAD Winlogon, autologin Administrator, shell=cmd.exe, OOBE non-policy key set'
 
 # ── IE Enhanced Security Configuration off (Admin) ───────────────────────
 # Long-known CI papercut: ESC blocks every URL in admin sessions.