diff --git a/hive-ag3nt/assets/screen.html b/hive-ag3nt/assets/screen.html
index 31c1db13..29b7622c 100644
--- a/hive-ag3nt/assets/screen.html
+++ b/hive-ag3nt/assets/screen.html
@@ -221,18 +221,12 @@ canvas { display: block; cursor: default; }
         if (types.indexOf(1) !== -1)       prefer = 1;   // plain None
         else if (types.indexOf(19) !== -1) prefer = 19;  // VeNCrypt
         else                               prefer = types[0];
-        // Only handle known-safe types; reject everything else.
-        if (prefer !== 1 && prefer !== 19) {
-          dbg('no supported security type in [' + Array.from(types).join(', ') + '] — need 1 (None) or 19 (VeNCrypt)', 'err');
-          setStatus('unsupported security types: [' + Array.from(types).join(', ') + ']', 'error');
-          ws.close();
-          return false;
-        }
         dbg('→ choosing security type ' + prefer +
-          (prefer === 1 ? ' (None)' : ' (VeNCrypt)'));
+          (prefer === 1 ? ' (None)' : prefer === 19 ? ' (VeNCrypt)' : prefer === 2 ? ' (VncAuth)' : ''));
         send(new Uint8Array([prefer]));
         if (prefer === 1)        state = 'security-result';
-        else                     state = 'vencrypt-version';
+        else if (prefer === 19)  state = 'vencrypt-version';
+        else                     state = 'security-vnc-challenge';
         return true;
       }
       case 'security-vnc-challenge': {
diff --git a/nix/templates/weston-vnc.nix b/nix/templates/weston-vnc.nix
index 8b0350b4..0c278aa5 100644
--- a/nix/templates/weston-vnc.nix
+++ b/nix/templates/weston-vnc.nix
@@ -57,26 +57,6 @@
   };
 
   config = lib.mkIf config.hyperhive.gui.enable {
-    # Build weston linked against a neatvnc without auth/crypto support.
-    # neatvnc ≥ 0.9 compiled with gnutls/nettle always advertises RSA-AES
-    # and Apple-DH security types (types 129, 5, 30) regardless of the
-    # weston.ini auth-method setting, causing the in-browser RFB client to
-    # fail with "auth failed" (it has no RSA key to complete the handshake).
-    # Removing gnutls + nettle from neatvnc's buildInputs disables the auth
-    # module at compile time, so nvnc_has_auth() returns false and weston
-    # skips nvnc_enable_auth() — neatvnc then advertises only type 1 (None).
-    nixpkgs.overlays = [
-      (_final: prev: {
-        weston = prev.weston.override {
-          neatvnc = prev.neatvnc.overrideAttrs (old: {
-            buildInputs = builtins.filter
-              (p: (p.pname or p.name or "") != "gnutls")
-              old.buildInputs;
-          });
-        };
-      })
-    ];
-
     systemd.services.weston = {
       description = "Weston Wayland compositor (VNC backend)";
       after = [ "network.target" ];
@@ -124,14 +104,23 @@
           ${pkgs.coreutils}/bin/printf '{"vnc_port":%d,"auth":"none"}\n' \
             "$VNC_PORT" > /etc/hyperhive/gui.json || true
 
-          # neatvnc is built without gnutls (see nixpkgs.overlays above),
-          # so nvnc_has_auth() returns false and weston skips auth setup
-          # entirely — neatvnc advertises only security type 1 (None).
-          # No weston.ini or --disable-transport-layer-security needed.
+          # Write a weston.ini that disables VNC authentication.
+          # Without this, neatvnc offers VNC password auth (type 2) by default
+          # which causes the in-browser RFB client to fail with "auth failed".
+          # auth-method=none makes neatvnc offer security type 1 (None).
+          # --disable-transport-layer-security additionally disables the
+          # VeNCrypt TLS wrapper — VNC is loopback-only via the harness
+          # WebSocket relay so neither TLS nor a password is needed.
+          WESTON_INI=$(${pkgs.coreutils}/bin/mktemp /tmp/weston-XXXXXX.ini)
+          ${pkgs.coreutils}/bin/printf '[core]\nbackend=vnc\n\n[vnc]\nauth-method=none\n' \
+            > "$WESTON_INI"
+
           exec ${pkgs.weston}/bin/weston \
+            --config="$WESTON_INI" \
             --backend=vnc-backend.so \
             --renderer=pixman \
-            --port="$VNC_PORT"
+            --port="$VNC_PORT" \
+            --disable-transport-layer-security
         '';
         Restart = "on-failure";
         RestartSec = "5s";