diff --git a/src/ci_orchestrator/commands/template.py b/src/ci_orchestrator/commands/template.py
index ea6e167..f10c43d 100644
--- a/src/ci_orchestrator/commands/template.py
+++ b/src/ci_orchestrator/commands/template.py
@@ -668,6 +668,19 @@ def template_prepare_win(
     click.echo("[prepare-win] WinRM ready.")
 
     try:
+        # Switch the interactive shell to cmd.exe up front, before the toolchain
+        # runs, so every reboot in the Windows Update 3010 loop already boots
+        # without explorer — no shell crash-loop during heavy servicing. Drop the
+        # live explorer now too (Winlogon relaunches the shell = cmd). Re-affirmed
+        # before the final reboot and baked into post-install for redundancy.
+        click.echo("[prepare-win] Setting interactive shell to cmd.exe ...")
+        transport.run(
+            "Set-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\Windows NT"
+            "\\CurrentVersion\\Winlogon' Shell 'cmd.exe' -Type String -Force\n"
+            "Stop-Process -Name explorer -Force -ErrorAction SilentlyContinue\n",
+            check=False,
+        )
+
         # Ensure C:\CI exists
         transport.run(
             "if (-not (Test-Path 'C:\\CI')) "