diff --git a/.gitea/workflows/gitea-main-ci.yaml b/.gitea/workflows/gitea-main-ci.yaml
index f521a62..aeb92c0 100644
--- a/.gitea/workflows/gitea-main-ci.yaml
+++ b/.gitea/workflows/gitea-main-ci.yaml
@@ -63,7 +63,7 @@ env:
   # DISA STIG hardening (OpenSCAP + SSG, diskless/UKI/kiosk tailoring). Report-only
   # in CI: the scan + deviations report are published as artifacts; the build is
   # never failed on score. Set "false" to skip hardening (boot/secure-path bench).
-  ENABLE_STIG: "true"
+  ENABLE_STIG: "false"
   # ===========================================================================
   # TEMPORARY: 802.1X + MACsec are DISABLED for this build (rd.dot1x=0) so the
   # UKI / rootfs / NVMe-oF boot path can be validated on an OPEN switch port.
diff --git a/diskless.pkr.hcl b/diskless.pkr.hcl
index cb01190..ac8cde7 100644
--- a/diskless.pkr.hcl
+++ b/diskless.pkr.hcl
@@ -133,7 +133,7 @@ variable "boot_splash" {
 variable "enable_stig" {
   type        = bool
   description = "true (default): apply DISA STIG hardening (OpenSCAP + SSG) with a diskless/UKI/kiosk tailoring (files/stig/diskless-tailoring.xml), bake STIG kernel params into the UKI cmdline, and emit a deviations report. false: skip hardening entirely — escape hatch if a build regresses the boot/secure-path bench. FIPS is OFF and audit offload is LOCAL-only regardless (see docs/stig-deviations.md)."
-  default     = false
+  default     = true
 }
 
 variable "debug_shell" {