diff --git a/files/console/etc/dconf/db/gdm.d/50-bc250-nosuspend b/files/console/etc/dconf/db/gdm.d/50-bc250-nosuspend
new file mode 100644
index 0000000..f6df57d
--- /dev/null
+++ b/files/console/etc/dconf/db/gdm.d/50-bc250-nosuspend
@@ -0,0 +1,6 @@
+# Keep the login screen from trying to suspend the console while nobody
+# is logged in (suspend is also hard-blocked by masking sleep.target).
+
+[org/gnome/settings-daemon/plugins/power]
+sleep-inactive-ac-type='nothing'
+sleep-inactive-battery-type='nothing'
diff --git a/files/console/etc/dconf/db/local.d/50-bc250-console b/files/console/etc/dconf/db/local.d/50-bc250-console
new file mode 100644
index 0000000..d0d4211
--- /dev/null
+++ b/files/console/etc/dconf/db/local.d/50-bc250-console
@@ -0,0 +1,16 @@
+# BC-250 console: always-on appliance behavior.
+# Never auto-suspend (also enforced by masking sleep.target) and never
+# lock the screen — a locked/suspended console is unreachable over RDP
+# and confusing on a TV.
+
+[org/gnome/settings-daemon/plugins/power]
+sleep-inactive-ac-type='nothing'
+sleep-inactive-battery-type='nothing'
+idle-dim=false
+
+[org/gnome/desktop/session]
+idle-delay=uint32 0
+
+[org/gnome/desktop/screensaver]
+lock-enabled=false
+idle-activation-enabled=false
diff --git a/files/console/etc/xdg/autostart/bc250-steam-bpm.desktop b/files/console/etc/xdg/autostart/bc250-steam-bpm.desktop
new file mode 100644
index 0000000..8e68311
--- /dev/null
+++ b/files/console/etc/xdg/autostart/bc250-steam-bpm.desktop
@@ -0,0 +1,7 @@
+[Desktop Entry]
+Type=Application
+Name=Steam Big Picture (console autostart)
+Comment=Launches Steam in Big Picture Mode when the kid logs in
+Exec=/usr/bin/bc250-steam-bpm-autostart
+X-GNOME-Autostart-enabled=true
+NoDisplay=true
diff --git a/files/console/usr/bin/bc250-steam-bpm-autostart b/files/console/usr/bin/bc250-steam-bpm-autostart
new file mode 100644
index 0000000..3ccf42b
--- /dev/null
+++ b/files/console/usr/bin/bc250-steam-bpm-autostart
@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# Autostart Steam Big Picture Mode for the kid's account only.
+# Other accounts (parent, RDP admin sessions) get a normal desktop.
+[ "$(id -un)" = "kid" ] || exit 0
+exec /usr/bin/bazzite-steam-bpm
diff --git a/recipes/bc250-console-gnome.yml b/recipes/bc250-console-gnome.yml
index 5b35f77..663ff48 100644
--- a/recipes/bc250-console-gnome.yml
+++ b/recipes/bc250-console-gnome.yml
@@ -24,15 +24,31 @@ modules:
 
   - type: script
     snippets:
-      - chmod 0755 /usr/bin/bc250-remote-setup
+      - chmod 0755 /usr/bin/bc250-remote-setup /usr/bin/bc250-steam-bpm-autostart
+      - dconf update # compile the local.d/gdm.d console defaults into the dconf dbs
+
+  - type: default-flatpaks
+    notify: true
+    system:
+      install:
+        - net.davidotek.pupgui2 # ProtonUp-Qt: Proton-GE manager
+        - com.heroicgameslauncher.hgl # Heroic: Epic + GOG
+        - net.retrodeck.retrodeck # RetroDECK: retro emulation
 
   - type: systemd
     system:
       enabled:
         - cyan-skillfish-governor-smu.service
         - sshd.service
+        - tailscaled.service # idle until 'sudo tailscale up'
       masked:
         - hhd.service # Handheld Daemon crash-loops on BC-250
+        # Always-on console: hard-block every suspend path (the box must
+        # stay reachable over SSH/RDP even from the login screen)
+        - sleep.target
+        - suspend.target
+        - hibernate.target
+        - hybrid-sleep.target
 
   # No signing module: this image is built locally and installed via ISO.
   # If you ever push to a registry for OTA `bootc upgrade`, generate your own