diff --git a/image/sbin/secubox-kiosk-launcher b/image/sbin/secubox-kiosk-launcher
index b06e5add..c07ea74b 100755
--- a/image/sbin/secubox-kiosk-launcher
+++ b/image/sbin/secubox-kiosk-launcher
@@ -261,15 +261,30 @@ XWRAP
         log "No GPU detected → vesa driver (safe mode)"
     fi
 
-    # Clean existing configs
+    # Clean existing configs that might cause issues
     rm -f /etc/X11/xorg.conf /etc/X11/xorg.conf.d/*.conf
     mkdir -p /etc/X11/xorg.conf.d
 
-    # Write X11 config with VM-appropriate settings
+    # BARE METAL: Skip X11 config entirely - auto-detection works best
+    # Intel/AMD/NVIDIA drivers work perfectly without explicit config
+    if [[ "$vm_type" == "none" ]]; then
+        log "Bare metal detected - skipping X11 config (auto-detection is best)"
+        # Just ensure Xwrapper is configured
+        cat > /etc/X11/Xwrapper.config <<'XWRAP'
+allowed_users=anybody
+needs_root_rights=yes
+XWRAP
+        return 0
+    fi
+
+    # VMs only: Write X11 config with explicit driver
+    # Sanitize gpu_info to avoid special chars breaking the config
+    local gpu_info_safe
+    gpu_info_safe=$(echo "$gpu_info" | tr -d '<>()[]{}' | head -c 100)
     cat > /etc/X11/xorg.conf.d/10-kiosk.conf <<XCONF
-# Generated by secubox-kiosk-launcher
+# Generated by secubox-kiosk-launcher (VM mode)
 # VM Type: $vm_type
-# GPU: $gpu_info
+# GPU: $gpu_info_safe
 # Driver: $driver
 
 Section "Device"