diff --git a/src/ci_orchestrator/winimage/assets/autounattend.win2025.xml b/src/ci_orchestrator/winimage/assets/autounattend.win2025.xml
index f833d68..bbb37b7 100644
--- a/src/ci_orchestrator/winimage/assets/autounattend.win2025.xml
+++ b/src/ci_orchestrator/winimage/assets/autounattend.win2025.xml
@@ -128,9 +128,17 @@
       <RegisteredOrganization>CI Lab</RegisteredOrganization>
     </component>
 
-    <!-- Set the interactive shell to cmd.exe before the first logon, so a
-         headless CI build VM never starts explorer (which crash-loops during
-         heavy servicing). post-install.ps1 / prepare-win re-affirm this. -->
+    <!-- Stop Server Manager auto-launching even at the first logon: the
+         ServerManager scheduled task is the actual launcher on WS2025; the
+         registry keys are belt-and-suspenders. These are shell-independent.
+
+         NOTE: the interactive shell is intentionally NOT switched to cmd.exe
+         here. autounattend FirstLogonCommands (which run post-install.ps1) are
+         triggered by explorer starting as the shell — replacing the shell in
+         specialize stops explorer, so post-install would never run. explorer
+         runs once for the first logon (deploy-win does no heavy servicing), and
+         post-install.ps1 sets Shell=cmd.exe at its end; subsequent boots, and
+         all of prepare-win, then run under cmd. -->
     <component name="Microsoft-Windows-Deployment"
                processorArchitecture="amd64"
                publicKeyToken="31bf3856ad364e35"
@@ -139,24 +147,16 @@
       <RunSynchronous>
         <RunSynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <Path>reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d cmd.exe /f</Path>
-          <Description>Set interactive shell to cmd.exe</Description>
-        </RunSynchronousCommand>
-        <!-- Stop Server Manager auto-launching even at the first logon: the
-             ServerManager scheduled task is the actual launcher on WS2025;
-             the registry keys are belt-and-suspenders. -->
-        <RunSynchronousCommand wcm:action="add">
-          <Order>2</Order>
           <Path>schtasks /Change /TN "\Microsoft\Windows\Server Manager\ServerManager" /Disable</Path>
           <Description>Disable Server Manager auto-launch task</Description>
         </RunSynchronousCommand>
         <RunSynchronousCommand wcm:action="add">
-          <Order>3</Order>
+          <Order>2</Order>
           <Path>reg add "HKLM\SOFTWARE\Microsoft\ServerManager" /v DoNotOpenServerManagerAtLogon /t REG_DWORD /d 1 /f</Path>
           <Description>Do not open Server Manager at logon (HKLM)</Description>
         </RunSynchronousCommand>
         <RunSynchronousCommand wcm:action="add">
-          <Order>4</Order>
+          <Order>3</Order>
           <Path>reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\ServerManager" /v DoNotOpenAtLogon /t REG_DWORD /d 1 /f</Path>
           <Description>Do not open Server Manager at logon (policy)</Description>
         </RunSynchronousCommand>