diff --git a/src/backend_win/disk_util.c b/src/backend_win/disk_util.c
index 469f1fe..c7d6583 100644
--- a/src/backend_win/disk_util.c
+++ b/src/backend_win/disk_util.c
@@ -2780,6 +2780,51 @@ static BOOL generate_ubuntu_setup_sh(const wchar_t *path, BOOL ssh_enabled)
         "                       appsandbox-input.service || true\n"
         "systemctl set-default graphical.target\n"
         "\n"
+        "# --- 9. Disable all sleep / screen-blank paths ---\n"
+        "# The VM is a guest console — there is no user at a physical seat to\n"
+        "# wake it. A blanked screen or a suspended VM looks identical to a\n"
+        "# crashed VM from the host UI, and a suspended guest stops servicing\n"
+        "# the agent's vsock heartbeat (host marks it offline). Two layers:\n"
+        "#\n"
+        "#  (a) systemd/logind  — masks the four sleep targets so no caller\n"
+        "#      (GNOME, dbus, `systemctl suspend`) can reach them, plus a\n"
+        "#      logind drop-in that neutralises idle-action / lid-switch in\n"
+        "#      case the targets are ever unmasked.\n"
+        "#\n"
+        "#  (b) GNOME / dconf  — these are per-user gsettings; writing them\n"
+        "#      to a dconf system-db makes them apply to every user (and to\n"
+        "#      GDM's greeter) with no per-session setup. idle-delay=0 is\n"
+        "#      GNOME's 'never blank' magic value.\n"
+        "systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target\n"
+        "install -d /etc/systemd/logind.conf.d\n"
+        "cat > /etc/systemd/logind.conf.d/10-appsandbox-nosleep.conf <<'EOF'\n"
+        "[Login]\n"
+        "HandleLidSwitch=ignore\n"
+        "HandleLidSwitchDocked=ignore\n"
+        "HandleLidSwitchExternalPower=ignore\n"
+        "IdleAction=ignore\n"
+        "EOF\n"
+        "install -d /etc/dconf/db/local.d /etc/dconf/profile\n"
+        "cat > /etc/dconf/profile/user <<'EOF'\n"
+        "user-db:user\n"
+        "system-db:local\n"
+        "EOF\n"
+        "cat > /etc/dconf/db/local.d/00-appsandbox-nosleep <<'EOF'\n"
+        "[org/gnome/desktop/session]\n"
+        "idle-delay=uint32 0\n"
+        "\n"
+        "[org/gnome/desktop/screensaver]\n"
+        "lock-enabled=false\n"
+        "idle-activation-enabled=false\n"
+        "\n"
+        "[org/gnome/settings-daemon/plugins/power]\n"
+        "sleep-inactive-ac-type='nothing'\n"
+        "sleep-inactive-battery-type='nothing'\n"
+        "idle-dim=false\n"
+        "power-button-action='nothing'\n"
+        "EOF\n"
+        "dconf update 2>&1 || echo \"WARN: dconf update failed\"\n"
+        "\n"
         "echo \"=== AppSandbox setup.sh finished $(date -u +%Y-%m-%dT%H:%M:%SZ), rebooting ===\"\n"
         "# Reboot so the desktop install + new units take effect cleanly.\n"
         "# firstboot.service's ExecStartPost will rm the marker after this\n"