diff --git a/lib/images/windows/templates/generalize.nix b/lib/images/windows/templates/generalize.nix
index d5eafae..5299d7f 100644
--- a/lib/images/windows/templates/generalize.nix
+++ b/lib/images/windows/templates/generalize.nix
@@ -362,6 +362,16 @@ in
     reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "vmixUwf" /t REG_SZ /d "C:\vmix-uwf-config.cmd" /f
     ''}
 
+
+    ${lib.optionalString keepMachineSid ''
+    :: /oobe without /generalize leaves the system set to re-run windeploy (OOBE)
+    :: on every boot -- shutting down here in a FirstLogonCommand cuts OOBE off
+    :: before it resets that state itself. Clear it, or the target boots into a
+    :: Setup with no unattend left to consume and hangs on a black screen.
+    reg add "HKLM\SYSTEM\Setup" /v SetupType /t REG_DWORD /d 0 /f
+    reg delete "HKLM\SYSTEM\Setup" /v OOBEInProgress /f 2>nul
+    reg delete "HKLM\SYSTEM\Setup" /v CmdLine /f 2>nul
+    ''}
     :: Clean up
     del /q C:\oobe-unattend.xml 2>nul
     del /q C:\vmix-audit-script.cmd 2>nul