diff --git a/image/sbin/secubox-cmdline-handler b/image/sbin/secubox-cmdline-handler
index 8ee6e04b..e245f2bb 100755
--- a/image/sbin/secubox-cmdline-handler
+++ b/image/sbin/secubox-cmdline-handler
@@ -68,15 +68,29 @@ apply_settings() {
             rm -f "${MARKER_DIR}/.kiosk-enabled"
             touch "${MARKER_DIR}/.tui-enabled"
 
-            # Disable kiosk, enable TUI
-            systemctl disable secubox-kiosk.service 2>/dev/null || true
+            # Mask kiosk service to prevent any startup
+            systemctl mask secubox-kiosk.service 2>/dev/null || true
             systemctl stop secubox-kiosk.service 2>/dev/null || true
+
+            # Kill any X11/Chromium if already started
+            pkill -9 Xorg 2>/dev/null || true
+            pkill -9 chromium 2>/dev/null || true
+
+            # Enable TUI service
+            systemctl unmask secubox-console-tui.service 2>/dev/null || true
             systemctl enable secubox-console-tui.service 2>/dev/null || true
 
-            # Set multi-user target (no graphical)
+            # Set multi-user target for current AND future boots
             systemctl set-default multi-user.target 2>/dev/null || true
 
-            # Start TUI service (will run on tty1)
+            # Write to generator drop-in to ensure correct target on this boot
+            mkdir -p /run/systemd/generator
+            echo "[Unit]" > /run/systemd/generator/default.target
+            echo "Requires=multi-user.target" >> /run/systemd/generator/default.target
+
+            systemctl daemon-reload 2>/dev/null || true
+
+            # Start TUI service
             log "Starting console TUI service..."
             systemctl start secubox-console-tui.service 2>/dev/null &
             ;;
diff --git a/image/systemd/secubox-console-tui.service b/image/systemd/secubox-console-tui.service
index a4cedbdb..52dcbcbb 100644
--- a/image/systemd/secubox-console-tui.service
+++ b/image/systemd/secubox-console-tui.service
@@ -1,6 +1,11 @@
 [Unit]
 Description=SecuBox Console TUI Dashboard
 Documentation=https://secubox.in/docs/tui
+
+# Wait for cmdline handler to decide display mode FIRST
+After=secubox-cmdline.service
+Requires=secubox-cmdline.service
+
 After=multi-user.target
 After=network-online.target
 After=secubox-firstboot.service
diff --git a/image/systemd/secubox-kiosk.service b/image/systemd/secubox-kiosk.service
index 02d781e4..6d823f90 100644
--- a/image/systemd/secubox-kiosk.service
+++ b/image/systemd/secubox-kiosk.service
@@ -2,6 +2,10 @@
 Description=SecuBox Kiosk Mode (X11/Chromium)
 Documentation=https://secubox.in/docs/kiosk
 
+# Wait for cmdline handler to decide display mode FIRST
+After=secubox-cmdline.service
+Requires=secubox-cmdline.service
+
 # Proper dependency chain - wait for everything to be ready
 After=systemd-user-sessions.service
 After=plymouth-quit-wait.service