diff --git a/image-recipe/configs/asound.conf b/image-recipe/configs/asound.conf
new file mode 100644
index 00000000..8a1f1f07
--- /dev/null
+++ b/image-recipe/configs/asound.conf
@@ -0,0 +1,7 @@
+pcm.!default {
+    type pulse
+    hint.description "Default ALSA Device (via PulseAudio)"
+}
+ctl.!default {
+    type pulse
+}
diff --git a/scripts/deploy-tailscale.sh b/scripts/deploy-tailscale.sh
index cc85eb77..bfb88346 100755
--- a/scripts/deploy-tailscale.sh
+++ b/scripts/deploy-tailscale.sh
@@ -425,6 +425,22 @@ deploy_node() {
         ' 2>/dev/null || true
     fi
 
+    # ── Deploy ALSA default-device config ────────────────────────────
+    ASOUND_CONF="$PROJECT_DIR/image-recipe/configs/asound.conf"
+    if [ -f "$ASOUND_CONF" ]; then
+        step "Deploying ALSA default-device config"
+        scp $SSH_OPTS "$ASOUND_CONF" "$TARGET:/tmp/asound.conf" 2>/dev/null || true
+        ssh $SSH_OPTS "$TARGET" '
+            if ! diff -q /tmp/asound.conf /etc/asound.conf >/dev/null 2>&1; then
+                sudo cp /tmp/asound.conf /etc/asound.conf
+                echo "   Installed"
+            else
+                echo "   Unchanged"
+            fi
+            rm -f /tmp/asound.conf
+        ' 2>/dev/null || true
+    fi
+
     # ── Step 18: NTP + swap ──────────────────────────────────────────
     step "Ensuring NTP + swap"
     ssh $SSH_OPTS "$TARGET" '
diff --git a/scripts/deploy-to-target.sh b/scripts/deploy-to-target.sh
index c7533c89..7b133fda 100755
--- a/scripts/deploy-to-target.sh
+++ b/scripts/deploy-to-target.sh
@@ -456,6 +456,22 @@ deploy_secondary() {
         ' 2>/dev/null || true
     fi
 
+    # Deploy ALSA default-device config (routes ALSA "default" through PulseAudio/PipeWire)
+    ASOUND_CONF="$PROJECT_DIR/image-recipe/configs/asound.conf"
+    if [ -f "$ASOUND_CONF" ]; then
+        echo "   Syncing ALSA default-device config to .$SEC_LABEL..."
+        scp $SSH_OPTS "$ASOUND_CONF" "$SEC_TARGET:/tmp/asound.conf" 2>/dev/null || true
+        ssh $SSH_OPTS "$SEC_TARGET" '
+            if ! diff -q /tmp/asound.conf /etc/asound.conf >/dev/null 2>&1; then
+              sudo cp /tmp/asound.conf /etc/asound.conf
+              echo "   ALSA default-device config installed"
+            else
+              echo "   ALSA default-device config unchanged"
+            fi
+            rm -f /tmp/asound.conf
+        ' 2>/dev/null || true
+    fi
+
     # Dev mode + FileBrowser
     ssh $SSH_OPTS "$SEC_TARGET" '
         # Dev mode
@@ -762,6 +778,23 @@ if [ "$LIVE" = true ]; then
       ' 2>/dev/null || true
     fi
 
+    # Deploy ALSA default-device config (routes ALSA "default" through
+    # PulseAudio/PipeWire — without it Chromium's raw ALSA fallback can't
+    # reach the HDMI sink and kiosk HDMI audio is silent).
+    ASOUND_CONF="$PROJECT_DIR/image-recipe/configs/asound.conf"
+    if [ -f "$ASOUND_CONF" ]; then
+      scp $SSH_OPTS "$ASOUND_CONF" "$TARGET_HOST:/tmp/asound.conf" 2>/dev/null || true
+      ssh $SSH_OPTS "$TARGET_HOST" '
+        if ! diff -q /tmp/asound.conf /etc/asound.conf >/dev/null 2>&1; then
+          sudo cp /tmp/asound.conf /etc/asound.conf
+          echo "   ALSA default-device config installed"
+        else
+          echo "   ALSA default-device config unchanged"
+        fi
+        rm -f /tmp/asound.conf
+      ' 2>/dev/null || true
+    fi
+
     # Deploy Claude API proxy (auto-install if missing)
     progress "Setting up Claude API proxy"
     ssh $SSH_OPTS "$TARGET_HOST" '