diff --git a/preseed-bootstrap.sh b/preseed-bootstrap.sh
index 3e3187f..0939a4f 100644
--- a/preseed-bootstrap.sh
+++ b/preseed-bootstrap.sh
@@ -22,14 +22,17 @@ EOF
 echo "==> SeniorNet: configuring setup to run on first login..."
 cat >> /root/.bash_profile << 'EOF'
 
-# SeniorNet first-boot setup — runs once then removes itself
-if [ -x /usr/local/bin/kiosk-setup ]; then
-    /usr/local/bin/kiosk-setup
+# SeniorNet first-boot setup — always pulls latest from Gitea, runs once
+if [ -f /usr/local/bin/kiosk-setup ]; then
+    curl -fsSL https://gitea.jgitta.com/jgitta/senior-kiosk/raw/branch/master/install-kiosk.sh \
+      -o /usr/local/bin/kiosk-setup 2>/dev/null || true
+    bash /usr/local/bin/kiosk-setup
 fi
 EOF
 
-# Allow root SSH login for debugging during setup
-sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin yes/' /etc/ssh/sshd_config
+# Allow root SSH login with password for debugging during setup
+echo 'PermitRootLogin yes' >> /etc/ssh/sshd_config
+echo 'PasswordAuthentication yes' >> /etc/ssh/sshd_config
 
 # Boot to text mode for the setup wizard
 systemctl set-default multi-user.target