diff --git a/emmc-provisioning/dashboard/app.py b/emmc-provisioning/dashboard/app.py
index 81516df..69de5bb 100644
--- a/emmc-provisioning/dashboard/app.py
+++ b/emmc-provisioning/dashboard/app.py
@@ -220,6 +220,15 @@ DEFAULT_STATUS = {
 }
 
 
+def _write_status(phase, message, progress=None):
+    try:
+        os.makedirs(os.path.dirname(STATUS_FILE) or ".", exist_ok=True)
+        with open(STATUS_FILE, "w") as f:
+            json.dump({"phase": phase, "message": message, "progress": progress, "updated": time.time()}, f)
+    except (PermissionError, OSError):
+        pass
+
+
 def read_status():
     try:
         with open(STATUS_FILE, "r") as f:
@@ -555,6 +564,11 @@ def api_device_action():
                 d["action"] = action
                 d["action_at"] = time.time()
                 _save_network_devices(data)
+                ip = d.get("ip") or mac
+                if action == "deploy":
+                    _write_status("flashing", f"Deploying to {ip} (network)...")
+                elif action == "backup":
+                    _write_status("backup", f"Backing up {ip} (network)...")
                 return jsonify({"ok": True})
         return jsonify({"ok": False, "error": "Device not found"}), 404
     return jsonify({"ok": False, "error": "source must be 'usb' or 'network'"}), 400
@@ -630,7 +644,13 @@ def api_dhcp_network_boot_post():
 def api_action_done():
     """Called by a device when deploy or backup has completed. Disables DHCP network-boot so the device boots from eMMC next time."""
     mac = request.args.get("mac") or ((request.get_json(silent=True) or {}).get("mac") or "")
+    # Remove device from network-devices list so it doesn't keep showing
+    if mac:
+        data = _load_network_devices()
+        data["devices"] = [d for d in data.get("devices", []) if (d.get("mac") or "").lower() != mac.lower()]
+        _save_network_devices(data)
     ok, _ = _dhcp_network_boot_run("disable")
+    _write_status("done", f"Done ({mac or 'network device'}). Network boot disabled; device will boot from eMMC on next boot.")
     if not ok:
         return jsonify({"ok": False, "error": "Could not disable DHCP network boot"}), 500
     return jsonify({"ok": True, "message": "Network boot disabled; device will boot from eMMC on next boot"})
diff --git a/emmc-provisioning/lxc/toggle-network-boot-dhcp.sh b/emmc-provisioning/lxc/toggle-network-boot-dhcp.sh
old mode 100644
new mode 100755
index 74967e4..a2e2c73
--- a/emmc-provisioning/lxc/toggle-network-boot-dhcp.sh
+++ b/emmc-provisioning/lxc/toggle-network-boot-dhcp.sh
@@ -1,29 +1,45 @@
 #!/usr/bin/env bash
-# Enable or disable DHCP network-boot options (option 66/67) on the provisioning LXC.
-# Does not stop the DHCP server or TFTP; only stops advertising netboot so devices boot from local storage.
-# Usage: toggle-network-boot-dhcp.sh enable | disable
-# Run as root (or with sudo). Install to /opt/cm4-provisioning/toggle-network-boot-dhcp.sh
+# Enable or disable network boot (PXE + TFTP) on the provisioning LXC.
+# When disabled, TFTP is stopped and no boot server is advertised; DHCP still runs.
+# Usage: toggle-network-boot-dhcp.sh enable | disable | status
+# Run as root. Install to /opt/cm4-provisioning/toggle-network-boot-dhcp.sh
 
 set -e
 PXE_CONF="/etc/dnsmasq.d/network-boot-pxe.conf"
-SNIPPET_CONTENT="# PXE options - do not edit; managed by toggle-network-boot-dhcp.sh
-dhcp-option=66,10.20.50.1
-dhcp-option=67,start4cd.elf
-"
+MAIN_CONF="/etc/dnsmasq.d/network-boot.conf"
+
+# Remove enable-tftp / tftp-root from main config if present (legacy; these belong in PXE conf)
+cleanup_main_conf() {
+  if [ -f "$MAIN_CONF" ] && grep -q 'enable-tftp\|tftp-root' "$MAIN_CONF" 2>/dev/null; then
+    sed -i '/^enable-tftp/d; /^tftp-root/d' "$MAIN_CONF"
+  fi
+}
 
 case "${1:-}" in
   enable)
-    echo "$SNIPPET_CONTENT" > "$PXE_CONF"
-    systemctl reload dnsmasq 2>/dev/null || service dnsmasq reload 2>/dev/null || true
-    echo "Network boot (DHCP options) enabled."
+    cleanup_main_conf
+    cat > "$PXE_CONF" << 'EOF'
+# PXE/network boot ENABLED - managed by toggle-network-boot-dhcp.sh
+# TFTP server (only active when network boot is enabled)
+enable-tftp
+tftp-root=/srv/tftpboot
+# BOOTP fields (siaddr = TFTP server, filename = boot file)
+dhcp-boot=start4cd.elf,,10.20.50.1
+# DHCP options 66/67 (some PXE clients prefer these)
+dhcp-option=66,10.20.50.1
+dhcp-option=67,start4cd.elf
+EOF
+    systemctl restart dnsmasq 2>/dev/null || service dnsmasq restart 2>/dev/null || true
+    echo "Network boot enabled."
     ;;
   disable)
+    cleanup_main_conf
     rm -f "$PXE_CONF"
-    systemctl reload dnsmasq 2>/dev/null || service dnsmasq reload 2>/dev/null || true
-    echo "Network boot (DHCP options) disabled. Devices will get DHCP but boot from local storage."
+    systemctl restart dnsmasq 2>/dev/null || service dnsmasq restart 2>/dev/null || true
+    echo "Network boot disabled. DHCP still running but no TFTP or boot options."
     ;;
   status)
-    if [ -f "$PXE_CONF" ]; then
+    if [ -f "$PXE_CONF" ] && grep -q 'enable-tftp' "$PXE_CONF" 2>/dev/null; then
       echo "enabled"
     else
       echo "disabled"
diff --git a/emmc-provisioning/network-boot-initramfs/initrd.img b/emmc-provisioning/network-boot-initramfs/initrd.img
index 8b93538..8dff76e 100644
Binary files a/emmc-provisioning/network-boot-initramfs/initrd.img and b/emmc-provisioning/network-boot-initramfs/initrd.img differ