diff --git a/internal/pxe/ipxe.go b/internal/pxe/ipxe.go
index 25079aa..b488898 100644
--- a/internal/pxe/ipxe.go
+++ b/internal/pxe/ipxe.go
@@ -56,6 +56,13 @@ func BuildScript(p IPXEParams) string {
 		// tee to ttyS0 if the port exists, we just don't spawn
 		// a login prompt there.
 		"systemd.mask=serial-getty@ttyS0.service",
+		// systemd-firstboot.service is the interactive "first boot
+		// wizard" (locale/timezone/root-password prompts). In a
+		// PXE live image there's no operator at the console to
+		// answer, so it blocks sysinit.target forever and the
+		// agent never comes up. systemd.firstboot=off short-
+		// circuits it entirely.
+		"systemd.firstboot=off",
 	)
 
 	var b strings.Builder