diff --git a/deploy/pi-gen/stage-betterframe-client/01-install-kiosk/01-run-chroot.sh b/deploy/pi-gen/stage-betterframe-client/01-install-kiosk/01-run-chroot.sh
index 2fbd7e6..e1c066b 100755
--- a/deploy/pi-gen/stage-betterframe-client/01-install-kiosk/01-run-chroot.sh
+++ b/deploy/pi-gen/stage-betterframe-client/01-install-kiosk/01-run-chroot.sh
@@ -37,6 +37,11 @@ cat > /etc/default/betterframe-kiosk <<'EOF'
 # Override the BF server discovery (default tries localhost → betterframe.local
 # → frame-eu.betterportal.net):
 # BETTERFRAME_SERVER=https://frame.example.com
+
+# Enable kiosk-app OTA. This image is curated and signed by us — fresh dev
+# builds auto-deploy once they land in the BF server (via the build workflow's
+# auto-import step). Set to 0 to pin a kiosk to its current binary.
+BF_ENABLE_APP_OTA=1
 EOF
 
 # Plymouth boot splash