diff --git a/docs/TODO.md b/docs/TODO.md
index dc85576..4f10069 100644
--- a/docs/TODO.md
+++ b/docs/TODO.md
@@ -1106,20 +1106,23 @@ SELinux AVC for `dri_device_t` from the kiosk domain (Wazuh `fleet_audit` 100120
 will surface any — if present, add a scoped SELinux allow or confirm the kiosk
 user's SELinux mapping is unconfined). Confirm VMs still render (software path).
 
-**DECISION OPEN — Chromium flag ownership (security).** The distro chromium
-wrapper PREPENDS vendor defaults we don't control, including capability-broadening
-ones a locked kiosk arguably shouldn't carry: `--enable-extensions`,
-`--enable-user-scripts`, `--enable-plugins`, `--enable-printing`,
-`--auto-ssl-client-auth`, `--enable-sync`. Today the managed policy neutralises
-the security-relevant ones (sync off via `SyncDisabled`; sign-in/metrics/etc.),
-but extensions/user-scripts/auto-ssl-client-auth are NOT policy-locked. Option to
-**own the full flag set**: bypass/neutralise the wrapper (invoke the real binary,
-or empty its default-flags source) and specify everything ourselves incl. the
-VA-API `--enable-features` (now known:
-`AllowQt,WaylandLinuxDrmSyncobj,WaylandPerSurfaceScale,WaylandUiScale,AcceleratedVideoDecodeLinuxGL,AcceleratedVideoDecodeLinuxZeroCopyGL,AcceleratedVideoEncoder`).
-Tradeoff: full determinism + drop unwanted capabilities, vs we then track Chromium
-feature renames ourselves instead of inheriting the distro's. Also fully dedupes
-`--disable-features`/`--enable-sync`. Needs locating the wrapper's flag source on
-the box first (so we don't lose VA-API or break its env setup). Pairs with policy
-adds: `ExtensionInstallBlocklist=["*"]`, disable user scripts, restrict
-AutoSelectCertificateForUrls.
+**DECIDED 2026-06-28 — Option 1 (policy lock), APPLIED.** The distro chromium
+wrapper (`/usr/bin/chromium-browser`) layers flags as `$CHROMIUM_FLAGS`
+(`/etc/chromium/chromium.conf` → VA-API enables + AI disables; overridable via
+`CHROMIUM_USER_FLAGS`) + **hardcoded** `$CHROMIUM_DISTRO_FLAGS`
+(`--enable-plugins --enable-extensions --enable-user-scripts --enable-printing
+--enable-sync --auto-ssl-client-auth`) + our `"$@"` (last). The hardcoded layer
+isn't removable via env/conf — only by bypassing the wrapper. Rather than bypass
+(Option 2, which would force us to replicate the wrapper's stdio sanitisation +
+own the VA-API feature list across updates), we **neutralise in managed policy**
+(policy beats cmdline flags, survives updates): `ExtensionInstallBlocklist=["*"]`
+added to `files/kiosk/chromium-kiosk-policy.json` (blocks all extensions → also
+kills the user-scripts surface). `--enable-sync` already locked by `SyncDisabled`;
+`--auto-ssl-client-auth` is moot (no browser-store client cert; the TPM 802.1X
+cert isn't one) — `AutoSelectCertificateForUrls` left unset. VA-API enables
+inherited from `chromium.conf` unchanged. Option 2 (full flag ownership, bypass
+the wrapper, own the VA-API `--enable-features`:
+`AllowQt,WaylandLinuxDrmSyncobj,WaylandPerSurfaceScale,WaylandUiScale,AcceleratedVideoDecodeLinuxGL,AcceleratedVideoDecodeLinuxZeroCopyGL,AcceleratedVideoEncoder`)
+remains documented here if a minimal/auditable cmdline is ever wanted.
+**BENCH-VERIFY:** `chrome://policy` shows `ExtensionInstallBlocklist=["*"]` active;
+extensions can't install.
diff --git a/files/kiosk/chromium-kiosk-policy.json b/files/kiosk/chromium-kiosk-policy.json
index 27e7613..722f97d 100644
--- a/files/kiosk/chromium-kiosk-policy.json
+++ b/files/kiosk/chromium-kiosk-policy.json
@@ -33,6 +33,9 @@
   "ShoppingListEnabled": false,
   "EnableMediaRouter": false,
 
+  "_comment_capability_lockdown": "The distro chromium WRAPPER hardcodes --enable-extensions --enable-user-scripts --enable-printing --enable-sync --auto-ssl-client-auth (not removable via env/conf, only by bypassing the wrapper). Neutralise the capability-broadening ones HERE — policy beats cmdline flags and survives Chromium updates. ExtensionInstallBlocklist=['*'] blocks ALL extension installs, which also kills the user-scripts surface (user scripts need an extension/dev-mode). --enable-sync is already locked by SyncDisabled above. --auto-ssl-client-auth is moot: it only auto-presents a BROWSER-store client cert, and the TPM 802.1X cert isn't one — there are none; to govern explicitly, set AutoSelectCertificateForUrls (left unset = no auto-select). See files/kiosk/kiosk-session + TODO #13.",
+  "ExtensionInstallBlocklist": ["*"],
+
   "_comment_pna": "Private Network Access: the kiosk page (insecure http boot-server origin) fetches the workstation host-info agent at http://localhost:9099 — a cross-origin PRIVATE-network request Chromium blocks by default. The agent sends Access-Control-Allow-Private-Network: true; this is the matching browser-side allowance, scoped to the kiosk ORIGIN ONLY (not '*'). MUST list the origin of kiosk_url (default http://boot.fleet.lab). The machine talking to itself; no internet egress (see HOST-API.md).",
   "InsecurePrivateNetworkRequestsAllowedForUrls": [
     "http://boot.fleet.lab",