diff --git a/template/Setup-WinBuild2025.ps1 b/template/Setup-WinBuild2025.ps1
index 3585ea3..403921f 100644
--- a/template/Setup-WinBuild2025.ps1
+++ b/template/Setup-WinBuild2025.ps1
@@ -21,6 +21,8 @@
       Step 3  — WinRM: validation only — Deploy ran Enable-PSRemoting, Basic auth over HTTPS,
                 AllowUnencrypted=false (HTTPS-only), MaxMemory=2048MB, IdleTimeout=2h, MaxProcesses=25.
                 Validation: service Running+Automatic, AllowUnencrypted=false, Auth/Basic, memory
+      Step 3b — Windows KMS activation via slmgr /skms + /ato (best-effort, non-fatal).
+                Validation: LicenseStatus=1 check (warning-only on failure)
       Step 4  — Local build user account ($BuildUsername, PasswordNeverExpires, Administrators)
                 Validation: user exists, enabled, PasswordNeverExpires, admin membership
       Step 4b — UAC: validation only — Deploy set EnableLUA=0, LocalAccountTokenFilterPolicy=1.
@@ -261,6 +263,33 @@ Assert-Step 'WinRM' 'MaxMemoryPerShellMB >= 2048' {
     [int](Get-Item WSMan:\localhost\Shell\MaxMemoryPerShellMB).Value -ge 2048
 }
 
+# ── Step 3b: Windows KMS Activation ─────────────────────────────────────────
+# Must run after network is confirmed (Step 3) and before Windows Update (Step 6)
+# so activation completes before WU queries the license state.
+# slmgr.vbs is a VBScript — invoke via cscript //NoLogo to get stdout output
+# instead of a dialog box (dialogs are invisible / hang in WinRM sessions).
+# Best-effort: activation failure does not abort Setup — CI builds work without
+# activation (all features used here are available in the grace period).
+Write-Step "Windows KMS activation"
+
+$cscript  = "$env:SystemRoot\System32\cscript.exe"
+$slmgr    = "$env:SystemRoot\System32\slmgr.vbs"
+
+Write-Host "Setting KMS server..."
+& $cscript //NoLogo $slmgr /skms kms8.msguides.com 2>&1 | Write-Host
+
+Write-Host "Requesting activation..."
+& $cscript //NoLogo $slmgr /ato 2>&1 | Write-Host
+
+# Verify activation status (LicenseStatus 1 = Licensed)
+$licOk = Get-CimInstance SoftwareLicensingProduct -Filter "Name like 'Windows%'" -ErrorAction SilentlyContinue |
+    Where-Object { $_.LicenseStatus -eq 1 }
+if ($licOk) {
+    Write-Host "  [OK] Windows activated (LicenseStatus=1)." -ForegroundColor Green
+} else {
+    Write-Warning "  [WARN] Windows not activated — /ato may have failed or KMS server unreachable. CI builds will work in the grace period."
+}
+
 # ── Step 4: Build user account ───────────────────────────────────────────────
 Write-Step "Creating build user account: $BuildUsername"