diff --git a/diskless.pkr.hcl b/diskless.pkr.hcl
index ac8cde7..cb01190 100644
--- a/diskless.pkr.hcl
+++ b/diskless.pkr.hcl
@@ -133,7 +133,7 @@ variable "boot_splash" {
 variable "enable_stig" {
   type        = bool
   description = "true (default): apply DISA STIG hardening (OpenSCAP + SSG) with a diskless/UKI/kiosk tailoring (files/stig/diskless-tailoring.xml), bake STIG kernel params into the UKI cmdline, and emit a deviations report. false: skip hardening entirely — escape hatch if a build regresses the boot/secure-path bench. FIPS is OFF and audit offload is LOCAL-only regardless (see docs/stig-deviations.md)."
-  default     = true
+  default     = false
 }
 
 variable "debug_shell" {