diff --git a/internal/pxe/supervisor.go b/internal/pxe/supervisor.go
index 8c6970b..9bd6145 100644
--- a/internal/pxe/supervisor.go
+++ b/internal/pxe/supervisor.go
@@ -204,13 +204,15 @@ dhcp-ignore=tag:!known
 enable-tftp
 tftp-root={{.TFTPRoot}}
 
-# PXE boot menu (timeout 0 = boot immediately)
-pxe-prompt="Provisioning",0
-pxe-service=x86PC,"Provisioning",undionly
-pxe-service=X86-64_EFI,"Provisioning",ipxe
-
-# iPXE chainload: once iPXE boots, serve HTTP script
+# Detect iPXE (user-class "iPXE") to break chainload loop
 dhcp-userclass=set:ipxe,iPXE
+
+# Initial PXE firmware: serve iPXE bootloader (skip if already iPXE)
+pxe-prompt="Provisioning",0
+pxe-service=tag:!ipxe,x86PC,"Provisioning",undionly
+pxe-service=tag:!ipxe,X86-64_EFI,"Provisioning",ipxe
+
+# iPXE: serve HTTP boot script
 dhcp-boot=tag:ipxe,{{.PublicURL}}/ipxe/${mac:hexhyp}
 
 log-dhcp