diff --git a/hive-ag3nt/assets/screen.html b/hive-ag3nt/assets/screen.html
index 29b7622c..31c1db13 100644
--- a/hive-ag3nt/assets/screen.html
+++ b/hive-ag3nt/assets/screen.html
@@ -221,12 +221,18 @@ canvas { display: block; cursor: default; }
         if (types.indexOf(1) !== -1)       prefer = 1;   // plain None
         else if (types.indexOf(19) !== -1) prefer = 19;  // VeNCrypt
         else                               prefer = types[0];
+        // Only handle known-safe types; reject everything else.
+        if (prefer !== 1 && prefer !== 19) {
+          dbg('no supported security type in [' + Array.from(types).join(', ') + '] — need 1 (None) or 19 (VeNCrypt)', 'err');
+          setStatus('unsupported security types: [' + Array.from(types).join(', ') + ']', 'error');
+          ws.close();
+          return false;
+        }
         dbg('→ choosing security type ' + prefer +
-          (prefer === 1 ? ' (None)' : prefer === 19 ? ' (VeNCrypt)' : prefer === 2 ? ' (VncAuth)' : ''));
+          (prefer === 1 ? ' (None)' : ' (VeNCrypt)'));
         send(new Uint8Array([prefer]));
         if (prefer === 1)        state = 'security-result';
-        else if (prefer === 19)  state = 'vencrypt-version';
-        else                     state = 'security-vnc-challenge';
+        else                     state = 'vencrypt-version';
         return true;
       }
       case 'security-vnc-challenge': {
diff --git a/nix/templates/weston-vnc.nix b/nix/templates/weston-vnc.nix
index 0c278aa5..8b0350b4 100644
--- a/nix/templates/weston-vnc.nix
+++ b/nix/templates/weston-vnc.nix
@@ -57,6 +57,26 @@
   };
 
   config = lib.mkIf config.hyperhive.gui.enable {
+    # Build weston linked against a neatvnc without auth/crypto support.
+    # neatvnc ≥ 0.9 compiled with gnutls/nettle always advertises RSA-AES
+    # and Apple-DH security types (types 129, 5, 30) regardless of the
+    # weston.ini auth-method setting, causing the in-browser RFB client to
+    # fail with "auth failed" (it has no RSA key to complete the handshake).
+    # Removing gnutls + nettle from neatvnc's buildInputs disables the auth
+    # module at compile time, so nvnc_has_auth() returns false and weston
+    # skips nvnc_enable_auth() — neatvnc then advertises only type 1 (None).
+    nixpkgs.overlays = [
+      (_final: prev: {
+        weston = prev.weston.override {
+          neatvnc = prev.neatvnc.overrideAttrs (old: {
+            buildInputs = builtins.filter
+              (p: (p.pname or p.name or "") != "gnutls")
+              old.buildInputs;
+          });
+        };
+      })
+    ];
+
     systemd.services.weston = {
       description = "Weston Wayland compositor (VNC backend)";
       after = [ "network.target" ];
@@ -104,23 +124,14 @@
           ${pkgs.coreutils}/bin/printf '{"vnc_port":%d,"auth":"none"}\n' \
             "$VNC_PORT" > /etc/hyperhive/gui.json || true
 
-          # Write a weston.ini that disables VNC authentication.
-          # Without this, neatvnc offers VNC password auth (type 2) by default
-          # which causes the in-browser RFB client to fail with "auth failed".
-          # auth-method=none makes neatvnc offer security type 1 (None).
-          # --disable-transport-layer-security additionally disables the
-          # VeNCrypt TLS wrapper — VNC is loopback-only via the harness
-          # WebSocket relay so neither TLS nor a password is needed.
-          WESTON_INI=$(${pkgs.coreutils}/bin/mktemp /tmp/weston-XXXXXX.ini)
-          ${pkgs.coreutils}/bin/printf '[core]\nbackend=vnc\n\n[vnc]\nauth-method=none\n' \
-            > "$WESTON_INI"
-
+          # neatvnc is built without gnutls (see nixpkgs.overlays above),
+          # so nvnc_has_auth() returns false and weston skips auth setup
+          # entirely — neatvnc advertises only security type 1 (None).
+          # No weston.ini or --disable-transport-layer-security needed.
           exec ${pkgs.weston}/bin/weston \
-            --config="$WESTON_INI" \
             --backend=vnc-backend.so \
             --renderer=pixman \
-            --port="$VNC_PORT" \
-            --disable-transport-layer-security
+            --port="$VNC_PORT"
         '';
         Restart = "on-failure";
         RestartSec = "5s";