diff --git a/playbook/shopfloor-setup/Run-ShopfloorSetup.ps1 b/playbook/shopfloor-setup/Run-ShopfloorSetup.ps1
index 306e47a..49adb43 100644
--- a/playbook/shopfloor-setup/Run-ShopfloorSetup.ps1
+++ b/playbook/shopfloor-setup/Run-ShopfloorSetup.ps1
@@ -199,9 +199,11 @@ if (Test-Path -LiteralPath $enrollScript) {
     Write-Host "run-enrollment.ps1 not found - skipping enrollment."
 }
 
-# Set auto-logon to expire after 2 more logins
-reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoLogonCount /t REG_DWORD /d 2 /f | Out-Null
-Write-Host "Auto-logon set to 2 remaining logins."
+# Set auto-logon to expire after 4 more logins (2 needed for sync_intune
+# pre-reboot + post-reboot, plus 2 margin for unexpected reboots from
+# Windows Update, PPKG file operations, or script crashes).
+reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoLogonCount /t REG_DWORD /d 4 /f | Out-Null
+Write-Host "Auto-logon set to 4 remaining logins."
 
 Write-Host ""
 Write-Host "================================================================"