diff --git a/image/sbin/secubox-kiosk-launcher b/image/sbin/secubox-kiosk-launcher
index d4f6af67..2329c4a4 100755
--- a/image/sbin/secubox-kiosk-launcher
+++ b/image/sbin/secubox-kiosk-launcher
@@ -10,7 +10,7 @@ readonly KIOSK_USER="secubox-kiosk"
 readonly KIOSK_HOME="/home/secubox-kiosk"
 readonly LOG_TAG="secubox-kiosk"
 
-log() { echo "[kiosk] $*"; logger -t "$LOG_TAG" "$*" 2>/dev/null || true; }
+log() { echo "[kiosk] $*" >&2; logger -t "$LOG_TAG" "$*" 2>/dev/null || true; }
 err() { echo "[kiosk] ERROR: $*" >&2; logger -t "$LOG_TAG" -p err "$*" 2>/dev/null || true; }
 
 # ══════════════════════════════════════════════════════════════════
diff --git a/scripts/run-qemu.sh b/scripts/run-qemu.sh
new file mode 100755
index 00000000..7036fcac
--- /dev/null
+++ b/scripts/run-qemu.sh
@@ -0,0 +1,125 @@
+#!/bin/bash
+# ═══════════════════════════════════════════════════════════════════
+# SecuBox — QEMU Launcher
+# Launch SecuBox Live image in QEMU with proper port forwarding
+# ═══════════════════════════════════════════════════════════════════
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
+
+# Defaults
+IMAGE="${PROJECT_DIR}/output/secubox-live-amd64-bookworm.img"
+RAM="4096"
+CPUS="4"
+SSH_PORT="2222"
+HTTPS_PORT="9443"
+HTTP_PORT="8080"
+DISPLAY_TYPE="gtk"
+EFI="yes"
+
+usage() {
+    cat <<EOF
+Usage: $(basename "$0") [OPTIONS] [IMAGE]
+
+Launch SecuBox in QEMU with port forwarding.
+
+Options:
+    -m, --memory MB     RAM size (default: 4096)
+    -c, --cpus N        Number of CPUs (default: 4)
+    -s, --ssh PORT      Host SSH port (default: 2222)
+    -w, --https PORT    Host HTTPS port (default: 9443)
+    -d, --display TYPE  Display: gtk, sdl, none, vnc (default: gtk)
+    --no-efi            Use BIOS instead of EFI
+    -h, --help          Show this help
+
+Port Forwarding:
+    SSH:    localhost:${SSH_PORT} → guest:22
+    HTTPS:  localhost:${HTTPS_PORT} → guest:443
+    HTTP:   localhost:${HTTP_PORT} → guest:80
+
+Examples:
+    $(basename "$0")                    # Default settings
+    $(basename "$0") -m 8192 -c 8       # More resources
+    $(basename "$0") -d vnc             # VNC display on :5900
+    $(basename "$0") /path/to/image.img # Custom image
+
+EOF
+    exit 0
+}
+
+# Parse arguments
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        -m|--memory) RAM="$2"; shift 2 ;;
+        -c|--cpus) CPUS="$2"; shift 2 ;;
+        -s|--ssh) SSH_PORT="$2"; shift 2 ;;
+        -w|--https) HTTPS_PORT="$2"; shift 2 ;;
+        -d|--display) DISPLAY_TYPE="$2"; shift 2 ;;
+        --no-efi) EFI="no"; shift ;;
+        -h|--help) usage ;;
+        -*) echo "Unknown option: $1"; exit 1 ;;
+        *) IMAGE="$1"; shift ;;
+    esac
+done
+
+# Validate image
+if [[ ! -f "$IMAGE" ]]; then
+    echo "Error: Image not found: $IMAGE"
+    echo "Build with: sudo bash image/build-live-usb.sh"
+    exit 1
+fi
+
+# Build QEMU command
+QEMU_CMD=(
+    qemu-system-x86_64
+    -enable-kvm
+    -m "$RAM"
+    -cpu host
+    -smp "$CPUS"
+    -drive "file=$IMAGE,format=raw"
+    -vga virtio
+)
+
+# EFI/BIOS
+if [[ "$EFI" == "yes" ]]; then
+    if [[ -f /usr/share/ovmf/OVMF.fd ]]; then
+        QEMU_CMD+=(-bios /usr/share/ovmf/OVMF.fd)
+    elif [[ -f /usr/share/OVMF/OVMF_CODE.fd ]]; then
+        QEMU_CMD+=(-bios /usr/share/OVMF/OVMF_CODE.fd)
+    else
+        echo "Warning: OVMF not found, using BIOS"
+    fi
+fi
+
+# Display
+case "$DISPLAY_TYPE" in
+    gtk) QEMU_CMD+=(-display gtk) ;;
+    sdl) QEMU_CMD+=(-display sdl) ;;
+    none) QEMU_CMD+=(-display none) ;;
+    vnc) QEMU_CMD+=(-display vnc=:0) ;;
+    *) echo "Unknown display: $DISPLAY_TYPE"; exit 1 ;;
+esac
+
+# Network with port forwarding
+QEMU_CMD+=(
+    -netdev "user,id=net0,hostfwd=tcp::${SSH_PORT}-:22,hostfwd=tcp::${HTTPS_PORT}-:443,hostfwd=tcp::${HTTP_PORT}-:80"
+    -device virtio-net-pci,netdev=net0
+)
+
+echo "═══════════════════════════════════════════════════════════════"
+echo "SecuBox QEMU Launcher"
+echo "═══════════════════════════════════════════════════════════════"
+echo "Image:   $IMAGE"
+echo "RAM:     ${RAM}MB"
+echo "CPUs:    $CPUS"
+echo "Display: $DISPLAY_TYPE"
+echo ""
+echo "Port Forwarding:"
+echo "  SSH:   ssh -p $SSH_PORT root@localhost"
+echo "  Web:   https://localhost:$HTTPS_PORT"
+echo ""
+echo "Default credentials: root / secubox"
+echo "═══════════════════════════════════════════════════════════════"
+
+exec "${QEMU_CMD[@]}"
diff --git a/scripts/run-vbox.sh b/scripts/run-vbox.sh
new file mode 100755
index 00000000..61b1daa2
--- /dev/null
+++ b/scripts/run-vbox.sh
@@ -0,0 +1,157 @@
+#!/bin/bash
+# ═══════════════════════════════════════════════════════════════════
+# SecuBox — VirtualBox Launcher
+# Create and launch SecuBox VM in VirtualBox with port forwarding
+# ═══════════════════════════════════════════════════════════════════
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
+
+# Defaults
+IMAGE="${PROJECT_DIR}/output/secubox-live-amd64-bookworm.img"
+VM_NAME="SecuBox-Live"
+RAM="4096"
+CPUS="4"
+SSH_PORT="2222"
+HTTPS_PORT="9443"
+HTTP_PORT="8080"
+VRAM="128"
+
+usage() {
+    cat <<EOF
+Usage: $(basename "$0") [OPTIONS] [IMAGE]
+
+Create and launch SecuBox VM in VirtualBox.
+
+Options:
+    -n, --name NAME     VM name (default: SecuBox-Live)
+    -m, --memory MB     RAM size (default: 4096)
+    -c, --cpus N        Number of CPUs (default: 4)
+    -s, --ssh PORT      Host SSH port (default: 2222)
+    -w, --https PORT    Host HTTPS port (default: 9443)
+    --delete            Delete existing VM first
+    -h, --help          Show this help
+
+Port Forwarding:
+    SSH:    localhost:${SSH_PORT} → guest:22
+    HTTPS:  localhost:${HTTPS_PORT} → guest:443
+    HTTP:   localhost:${HTTP_PORT} → guest:80
+
+Examples:
+    $(basename "$0")                    # Create/start VM
+    $(basename "$0") --delete           # Recreate VM from scratch
+    $(basename "$0") -m 8192 -c 8       # More resources
+
+EOF
+    exit 0
+}
+
+DELETE_VM="no"
+
+# Parse arguments
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        -n|--name) VM_NAME="$2"; shift 2 ;;
+        -m|--memory) RAM="$2"; shift 2 ;;
+        -c|--cpus) CPUS="$2"; shift 2 ;;
+        -s|--ssh) SSH_PORT="$2"; shift 2 ;;
+        -w|--https) HTTPS_PORT="$2"; shift 2 ;;
+        --delete) DELETE_VM="yes"; shift ;;
+        -h|--help) usage ;;
+        -*) echo "Unknown option: $1"; exit 1 ;;
+        *) IMAGE="$1"; shift ;;
+    esac
+done
+
+# Check VBoxManage
+if ! command -v VBoxManage &>/dev/null; then
+    echo "Error: VBoxManage not found. Install VirtualBox."
+    exit 1
+fi
+
+# Validate image
+if [[ ! -f "$IMAGE" ]]; then
+    echo "Error: Image not found: $IMAGE"
+    exit 1
+fi
+
+# Convert to VDI if needed
+VDI_PATH="${IMAGE%.img}.vdi"
+if [[ ! -f "$VDI_PATH" ]] || [[ "$IMAGE" -nt "$VDI_PATH" ]]; then
+    echo "Converting image to VDI format..."
+    VBoxManage convertfromraw "$IMAGE" "$VDI_PATH" --format VDI 2>/dev/null || {
+        # If exists, delete and retry
+        rm -f "$VDI_PATH"
+        VBoxManage convertfromraw "$IMAGE" "$VDI_PATH" --format VDI
+    }
+fi
+
+# Delete existing VM if requested
+if [[ "$DELETE_VM" == "yes" ]]; then
+    echo "Deleting existing VM: $VM_NAME"
+    VBoxManage unregistervm "$VM_NAME" --delete 2>/dev/null || true
+fi
+
+# Check if VM exists
+if VBoxManage showvminfo "$VM_NAME" &>/dev/null; then
+    echo "VM '$VM_NAME' already exists. Starting..."
+else
+    echo "Creating VM: $VM_NAME"
+
+    # Create VM
+    VBoxManage createvm --name "$VM_NAME" --ostype "Debian_64" --register
+
+    # Configure VM
+    VBoxManage modifyvm "$VM_NAME" \
+        --memory "$RAM" \
+        --cpus "$CPUS" \
+        --vram "$VRAM" \
+        --graphicscontroller vmsvga \
+        --firmware efi64 \
+        --boot1 disk \
+        --boot2 none \
+        --nic1 nat \
+        --nictype1 virtio \
+        --audio-enabled off \
+        --usb-ehci off \
+        --usb-xhci on
+
+    # Add storage controller
+    VBoxManage storagectl "$VM_NAME" --name "SATA" --add sata --controller IntelAhci
+
+    # Attach VDI
+    VBoxManage storageattach "$VM_NAME" \
+        --storagectl "SATA" \
+        --port 0 \
+        --device 0 \
+        --type hdd \
+        --medium "$VDI_PATH"
+
+    # Port forwarding
+    VBoxManage modifyvm "$VM_NAME" \
+        --natpf1 "SSH,tcp,,${SSH_PORT},,22" \
+        --natpf1 "HTTPS,tcp,,${HTTPS_PORT},,443" \
+        --natpf1 "HTTP,tcp,,${HTTP_PORT},,80"
+
+    echo "VM created successfully"
+fi
+
+echo ""
+echo "═══════════════════════════════════════════════════════════════"
+echo "SecuBox VirtualBox VM"
+echo "═══════════════════════════════════════════════════════════════"
+echo "VM Name: $VM_NAME"
+echo "RAM:     ${RAM}MB"
+echo "CPUs:    $CPUS"
+echo ""
+echo "Port Forwarding:"
+echo "  SSH:   ssh -p $SSH_PORT root@localhost"
+echo "  Web:   https://localhost:$HTTPS_PORT"
+echo ""
+echo "Default credentials: root / secubox"
+echo "═══════════════════════════════════════════════════════════════"
+
+# Start VM
+echo "Starting VM..."
+VBoxManage startvm "$VM_NAME" --type gui