diff --git a/VERSION b/VERSION
index ee1372d..7179039 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.2.2
+0.2.3
diff --git a/preseed.cfg b/preseed.cfg
index b93e332..15f6396 100644
--- a/preseed.cfg
+++ b/preseed.cfg
@@ -9,6 +9,9 @@ d-i debian-installer/locale string en_US.UTF-8
 d-i keyboard-configuration/xkb-keymap select us
 
 # ── Network ────────────────────────────────────────────────────────
+# Auto, but early_command will pin to the first wired (eth/en) interface
+# if one exists — prevents installer from defaulting to WiFi and asking
+# for a WPA passphrase. Ethernet must be plugged in during install.
 d-i netcfg/choose_interface select auto
 d-i netcfg/get_hostname string kiosk
 d-i netcfg/get_domain string local
@@ -36,7 +39,9 @@ d-i passwd/root-password-again password kiosk
 d-i preseed/early_command string \
   DISK=$(ls /sys/block/ | grep -Ev '^(loop|sr|fd|ram)' | head -1); \
   debconf-set partman-auto/disk "/dev/$DISK"; \
-  debconf-set grub-installer/bootdev "/dev/$DISK"
+  debconf-set grub-installer/bootdev "/dev/$DISK"; \
+  ETH=$(ls /sys/class/net/ | grep -E '^(eth|en)' | head -1); \
+  [ -n "$ETH" ] && debconf-set netcfg/choose_interface "$ETH"
 
 d-i partman-auto/method string regular
 d-i partman-auto/choose_recipe select atomic