diff --git a/playbook/shopfloor-setup/run-enrollment.ps1 b/playbook/shopfloor-setup/run-enrollment.ps1
index a38b940..7fb77a4 100755
--- a/playbook/shopfloor-setup/run-enrollment.ps1
+++ b/playbook/shopfloor-setup/run-enrollment.ps1
@@ -47,6 +47,41 @@ try {
     }
 }
 
+# --- Wait for PPKG provisioning to finish ---
+# Install-ProvisioningPackage is async — it queues the provisioning engine
+# and returns immediately. The actual app installs (Chrome, Office, Tanium,
+# CyberArk, etc.) run in the background as BPRT steps. Each step writes a
+# Log.txt under C:\Logs\BPRT\<step name>\. "Remove Staging Locations" is
+# the LAST step — when its Log.txt exists, all provisioning is done.
+# We poll for that marker before writing the stage file, so the PPKG reboot
+# doesn't fire while installs are still in progress.
+$bprtMarker = 'C:\Logs\BPRT\Remove Staging Locations\Log.txt'
+$maxWait = 900   # 15 minutes (Office install can be slow)
+$pollInterval = 10
+$elapsed = 0
+
+Log "Waiting for PPKG provisioning to complete (polling for $bprtMarker)..."
+while (-not (Test-Path -LiteralPath $bprtMarker) -and $elapsed -lt $maxWait) {
+    Start-Sleep -Seconds $pollInterval
+    $elapsed += $pollInterval
+    # Show progress every 30 seconds
+    if ($elapsed % 30 -eq 0) {
+        $completedSteps = @(Get-ChildItem 'C:\Logs\BPRT' -Directory -ErrorAction SilentlyContinue |
+            Where-Object { Test-Path (Join-Path $_.FullName 'Log.txt') } |
+            Select-Object -ExpandProperty Name)
+        Log "  $elapsed s elapsed, $($completedSteps.Count) BPRT steps done: $($completedSteps -join ', ')"
+    }
+}
+
+if (Test-Path -LiteralPath $bprtMarker) {
+    Log "PPKG provisioning complete after $elapsed s."
+    $allSteps = @(Get-ChildItem 'C:\Logs\BPRT' -Directory -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Name)
+    Log "  Completed steps: $($allSteps -join ', ')"
+} else {
+    Log "WARNING: PPKG provisioning timeout after $maxWait s — some apps may not be installed."
+    Log "  Proceeding anyway. The SYSTEM logon task will retry incomplete items on next boot."
+}
+
 # --- Set OOBE complete ---
 Log "Setting OOBE as complete..."
 reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\OOBE" /v OOBEComplete /t REG_DWORD /d 1 /f | Out-Null