diff --git a/image-recipe/build-auto-installer-iso.sh b/image-recipe/build-auto-installer-iso.sh
index 95e97451..250c2099 100755
--- a/image-recipe/build-auto-installer-iso.sh
+++ b/image-recipe/build-auto-installer-iso.sh
@@ -2007,6 +2007,30 @@ ExecStart=-/sbin/agetty --autologin archipelago --noclear %I $TERM
 AUTOLOGIN
 chroot /mnt/target systemctl enable archipelago-diagnostics.service 2>/dev/null || true
 
+# Post-install test runner — runs once on first boot after all services are up
+cat > /mnt/target/etc/systemd/system/archipelago-post-install-tests.service <<'PITSERVICE'
+[Unit]
+Description=Archipelago Post-Install Test Suite (first boot)
+After=archipelago.service archipelago-first-boot-containers.service nginx.service
+Wants=archipelago.service nginx.service
+ConditionPathExists=/opt/archipelago/scripts/run-post-install-tests.sh
+ConditionPathExists=!/var/lib/archipelago/.post-install-tests-done
+
+[Service]
+Type=oneshot
+# Wait for backend to fully initialize
+ExecStartPre=/bin/bash -c 'for i in $(seq 1 30); do curl -sf http://127.0.0.1:5678/health >/dev/null 2>&1 && exit 0; sleep 2; done; exit 0'
+ExecStart=/bin/bash -c '/opt/archipelago/scripts/run-post-install-tests.sh "password123" 2>&1 | tee /var/log/archipelago-post-install-tests.log; touch /var/lib/archipelago/.post-install-tests-done'
+RemainAfterExit=yes
+StandardOutput=journal+console
+StandardError=journal+console
+TimeoutStartSec=300
+
+[Install]
+WantedBy=multi-user.target
+PITSERVICE
+chroot /mnt/target systemctl enable archipelago-post-install-tests.service 2>/dev/null || true
+
 # Install first-boot diagnostic script — runs once after first boot and logs system state
 cat > /mnt/target/opt/archipelago/scripts/first-boot-diag.sh <<'DIAGSCRIPT'
 #!/bin/bash