diff --git a/emmc-provisioning/cloud-init/first-boot.conf b/emmc-provisioning/cloud-init/first-boot.conf
index b1087d8..a00173c 100644
--- a/emmc-provisioning/cloud-init/first-boot.conf
+++ b/emmc-provisioning/cloud-init/first-boot.conf
@@ -58,3 +58,18 @@ RETERMINAL_REPO_URL="https://github.com/Seeed-Studio/seeed-linux-dtoverlays"
 # --- One-shots ---
 # Space-separated names of one-shot scripts (numbered = run order at first login). Leave empty for none.
 ONESHOT_SCRIPTS="01-set-rotation-once 02-set-wallpaper-once"
+
+# --- Step enable flags (1 = run, 0 = skip). All enabled below; set to 0 to disable a step. ---
+ENABLE_STEP_01=1
+ENABLE_STEP_02=1
+ENABLE_STEP_03=1
+ENABLE_STEP_04=1
+ENABLE_STEP_05=1
+ENABLE_STEP_06=1
+ENABLE_STEP_07=1
+ENABLE_STEP_08=1
+ENABLE_STEP_09=1
+ENABLE_STEP_10=1
+ENABLE_STEP_11=1
+ENABLE_STEP_12=1
+ENABLE_STEP_13=1
diff --git a/emmc-provisioning/cloud-init/first-boot.conf.example b/emmc-provisioning/cloud-init/first-boot.conf.example
index 2d011ca..bf5b59c 100644
--- a/emmc-provisioning/cloud-init/first-boot.conf.example
+++ b/emmc-provisioning/cloud-init/first-boot.conf.example
@@ -61,8 +61,9 @@
 # Example: "01-set-rotation-once 02-set-wallpaper-once"
 # ONESHOT_SCRIPTS="01-set-rotation-once 02-set-wallpaper-once"
 
-# --- Step enable flags (1 = run, 0 = skip). Default: all 1. Set in config to disable a step. ---
+# --- Step enable flags (1 = run, 0 = skip). All steps enabled by default. Set ENABLE_STEP_NN=0 to disable. ---
 # 01=hostname, 02=packages, 03=kiosk_files, 04=splash_wallpaper, 05=lightdm, 06=maliit,
 # 07=dark_theme, 08=reterminal_drivers, 09=reapply_splash, 10=cmdline, 11=oneshots, 12=log_permissions, 13=reboot
+# Example: uncomment to disable a step
 # ENABLE_STEP_08=0
 # ENABLE_STEP_13=0
diff --git a/emmc-provisioning/cloud-init/first-boot.sh b/emmc-provisioning/cloud-init/first-boot.sh
index 5fd6971..9542ab3 100644
--- a/emmc-provisioning/cloud-init/first-boot.sh
+++ b/emmc-provisioning/cloud-init/first-boot.sh
@@ -25,7 +25,19 @@ SWIOTLB_SIZE="${SWIOTLB_SIZE:-65536}"
 RETERMINAL_DEVICE="${RETERMINAL_DEVICE:-reTerminal-DM}"
 RETERMINAL_REPO_URL="${RETERMINAL_REPO_URL:-https://github.com/Seeed-Studio/seeed-linux-dtoverlays}"
 ONESHOT_SCRIPTS="${ONESHOT_SCRIPTS:-}"
-# Step enable flags (1 = run, 0 = skip). Default all enabled.
+
+# --- Load config file first (first found); then defaults apply only to unset vars ---
+FIRST_BOOT_CONF=""
+for _f in "$SCRIPT_DIR/first-boot.conf" /tmp/first-boot.conf /etc/cm4-provisioning/first-boot.conf; do
+  if [[ -f "$_f" ]]; then
+    # shellcheck source=first-boot.conf.example
+    set -a && source "$_f" && set +a
+    FIRST_BOOT_CONF="$_f"
+    break
+  fi
+done
+
+# Step enable flags (1 = run, 0 = skip). Default all enabled; only set if not already set by config.
 ENABLE_STEP_01="${ENABLE_STEP_01:-1}"
 ENABLE_STEP_02="${ENABLE_STEP_02:-1}"
 ENABLE_STEP_03="${ENABLE_STEP_03:-1}"
@@ -40,17 +52,6 @@ ENABLE_STEP_11="${ENABLE_STEP_11:-1}"
 ENABLE_STEP_12="${ENABLE_STEP_12:-1}"
 ENABLE_STEP_13="${ENABLE_STEP_13:-1}"
 
-# --- Load config file (first found) ---
-FIRST_BOOT_CONF=""
-for _f in "$SCRIPT_DIR/first-boot.conf" /tmp/first-boot.conf /etc/cm4-provisioning/first-boot.conf; do
-  if [[ -f "$_f" ]]; then
-    # shellcheck source=first-boot.conf.example
-    set -a && source "$_f" && set +a
-    FIRST_BOOT_CONF="$_f"
-    break
-  fi
-done
-
 # --- Derived paths ---
 PI_HOME="/home/$PI_USER"
 AUTOSTART="$PI_HOME/.config/autostart"
@@ -78,10 +79,14 @@ report_status() {
 }
 report_status "started" "First-boot started" "" "" ""
 
-# --- Helper: run step if enabled ---
+# --- Helper: run step if enabled (accepts "1" or "0"; strips CR/LF/whitespace) ---
 run_step() {
-  local n="$1" name="$2" enable_var="ENABLE_STEP_${n}"
-  if [[ "${!enable_var}" == "1" ]]; then
+  local n="$1" name="$2"
+  local enable_var="ENABLE_STEP_${n}" val
+  val="${!enable_var}"
+  val="${val//[^01]/}"
+  val="${val:0:1}"
+  if [[ "$val" == "1" ]]; then
     log "--- Step $n: $name ---"
     "step_${n}_${name}" || return $?
     report_status "running" "Step $n: $name completed" "$n" "$name" ""
@@ -311,3 +316,14 @@ run_step 10 cmdline
 run_step 11 oneshots
 run_step 12 log_permissions
 run_step 13 reboot
+
+# If reboot was disabled, still report done and device IP so the portal shows completion
+_step13_val="${ENABLE_STEP_13:-1}"
+_step13_val="${_step13_val//[^01]/}"
+_step13_val="${_step13_val:0:1}"
+if [[ "$_step13_val" != "1" ]]; then
+  DEVICE_IP="$(hostname -I 2>/dev/null | awk '{print $1}')"
+  report_status "done" "First-boot complete (reboot disabled)" "13" "reboot" "$DEVICE_IP"
+  log "Device IP: ${DEVICE_IP:-unknown}"
+  log "=== first-boot.sh finished (reboot disabled) ==="
+fi