diff --git a/.github/workflows/build-image.yml b/.github/workflows/build-image.yml
index ab8df908..f5ff73c9 100644
--- a/.github/workflows/build-image.yml
+++ b/.github/workflows/build-image.yml
@@ -35,6 +35,11 @@ on:
         description: 'Image size (empty = use board default)'
         required: false
         default: ''
+      kiosk:
+        description: 'rpi400/rpi4 only: include GUI kiosk (chromium fullscreen dashboard)'
+        required: false
+        type: boolean
+        default: false
   push:
     tags:
       - 'v*'
@@ -126,12 +131,20 @@ jobs:
             SIZE_OPT="--size ${{ inputs.size || github.event.inputs.size }}"
           fi
 
+          # rpi400/rpi4 GUI kiosk (chromium fullscreen dashboard). Ignored by
+          # non-rpi boards (build-image.sh only forwards it to build-rpi-usb.sh).
+          KIOSK_OPT=""
+          if [ "${{ inputs.kiosk || github.event.inputs.kiosk }}" = "true" ]; then
+            KIOSK_OPT="--kiosk"
+          fi
+
           sudo -E bash image/build-image.sh \
             --board ${{ matrix.board }} \
             --suite ${{ env.DEBIAN_SUITE }} \
             --out output/ \
             $SIZE_OPT \
-            $SLIPSTREAM_OPT
+            $SLIPSTREAM_OPT \
+            $KIOSK_OPT
           sudo chown -R $(id -u):$(id -g) output/
         timeout-minutes: 90
 
diff --git a/image/build-image.sh b/image/build-image.sh
index 35772b76..b244d2b9 100755
--- a/image/build-image.sh
+++ b/image/build-image.sh
@@ -77,6 +77,7 @@ while [[ $# -gt 0 ]]; do
     --local-cache) USE_LOCAL_CACHE=1;  shift   ;;
     --slipstream)  SLIPSTREAM_DEBS=1;  shift   ;;
     --keep-rootfs) KEEP_ROOTFS=1;      shift   ;;
+    --kiosk)       INCLUDE_KIOSK=1;    shift   ;;
     --help|-h)     usage ;;
     *) err "Argument inconnu: $1" ;;
   esac
@@ -95,7 +96,8 @@ source "${BOARD_DIR}/config.mk" 2>/dev/null || true
 if [[ "${USE_RPI_SCRIPT:-0}" == "1" ]] || [[ "$BOARD" == "rpi400" ]] || [[ "$BOARD" == "rpi4" ]]; then
   log "Raspberry Pi board detected - using build-rpi-usb.sh"
   RPI_ARGS="--out ${OUT_DIR}"
-  [[ $SLIPSTREAM_DEBS -eq 1 ]] && RPI_ARGS="$RPI_ARGS --slipstream"
+  [[ ${SLIPSTREAM_DEBS:-0} -eq 1 ]] && RPI_ARGS="$RPI_ARGS --slipstream"
+  [[ ${INCLUDE_KIOSK:-0} -eq 1 ]] && RPI_ARGS="$RPI_ARGS --kiosk"
   exec bash "${SCRIPT_DIR}/build-rpi-usb.sh" $RPI_ARGS
 fi
 
diff --git a/image/build-rpi-usb.sh b/image/build-rpi-usb.sh
index 06c63bec..52186667 100755
--- a/image/build-rpi-usb.sh
+++ b/image/build-rpi-usb.sh
@@ -135,6 +135,10 @@ INCLUDE_PKGS+=",python3-fastapi,python3-uvicorn,python3-httpx,python3-psutil"
 INCLUDE_PKGS+=",python3-aiosqlite,python3-jinja2,python3-jwt"
 INCLUDE_PKGS+=",python3-aiofiles,python3-pil,python3-tomli,python3-pydantic"
 INCLUDE_PKGS+=",python3-jose,python3-toml,python3-netifaces"
+# Auth/users engine runtime deps — WITHOUT these secubox-auth crashes at import
+# (import pyotp / import qrcode) → nginx 502 → no login. Pure-Python, apt-safe.
+# argon2 (compiled cffi) goes via the pip step below, mirroring cryptography.
+INCLUDE_PKGS+=",python3-pyotp,python3-qrcode"
 
 # Network and security tools
 INCLUDE_PKGS+=",bridge-utils,dnsutils,iputils-arping,avahi-daemon,avahi-utils"
@@ -679,7 +683,7 @@ log "Installing Python dependencies via pip..."
 chroot "${ROOTFS}" pip3 install --break-system-packages -q \
   fastapi uvicorn[standard] python-jose[cryptography] httpx \
   jinja2 tomli toml pyroute2 psutil pydantic \
-  aiofiles aiosqlite authlib cryptography \
+  aiofiles aiosqlite authlib cryptography argon2-cffi \
   python-multipart websockets netifaces email-validator \
   2>&1 | tail -10 || true
 ok "Python dependencies installed"