diff --git a/docs/vm.md b/docs/vm.md
index 407fbff..beda7f6 100644
--- a/docs/vm.md
+++ b/docs/vm.md
@@ -54,7 +54,7 @@ same functions on either host. Nothing in it calls `qm` or `incus`.
 | `vm_customize <label> <image> <virt-customize args>...` | A script's own image step. Warns with libguestfs' reason like the shared preparation steps, and returns non-zero so a required step can stop the run. |
 | `vm_release_asset <github\|gitlab\|codeberg> <owner/repo> <asset regex> [tag]` | Resolves a release through [`lib/forge.func`](../lib/forge.func) — tokens, rate limits and the API-less GitHub fallback included. Sets `VM_RELEASE_TAG`, `VM_RELEASE_VERSION`, `VM_RELEASE_ASSET`, `VM_RELEASE_URL` and, from GitHub's asset digest, `VM_RELEASE_SHA256`. |
 | `vm_latest_from_index <url> <pcre> [--sort-by <pcre>] [--probe <url with {}>]...` | Newest match on an HTML download index (`grep -oP`, so `\K` works). `--sort-by` orders by part of the match; each `--probe` template is tried newest first and the first answering URL wins. Sets `VM_INDEX_LATEST` and `VM_INDEX_URL`. Never falls back to a hardcoded release. |
-| `vm_firstboot_unit <image> <name> <script> [--description …] [--after <unit>]... [--requires-path <path>] [--cloud-init yes\|no]` | Stages `<script>` as `/usr/local/sbin/<name>` plus a run-once `<name>.service`. The marker `/var/lib/community-scripts/<name>.done` (`VM_FIRSTBOOT_MARKER`) is written only after success, so a failure is retried on the next boot. With Cloud-Init the unit is wanted by `cloud-init.target` and ordered after `cloud-final.service`; wanting `multi-user.target` there would create an ordering cycle. |
+| `vm_firstboot_unit <image> <name> <script> [--description …] [--after <unit>]... [--requires-path <path>] [--cloud-init yes\|no]` | Stages `<script>` as `/usr/local/sbin/<name>` plus a run-once `<name>.service`. The marker `/var/lib/community-scripts/<name>.done` (`VM_FIRSTBOOT_MARKER`) is written only after success, so a failure is retried on the next boot. With Cloud-Init the unit is wanted by `cloud-init.target` and ordered after `cloud-final.service`; wanting `multi-user.target` there would create an ordering cycle. The unit runs with `DEBIAN_FRONTEND=noninteractive` and needrestart in automatic mode, so apt in the script cannot draw a dialog on the console. |
 | `vm_wait_http <url> [timeout] [--insecure]` | Succeeds on any 2xx/3xx, or 401/403 from a login page. |
 | `vm_print_summary ["Label=value"]...`, `vm_next_steps <step>...`, `vm_finish [message]` | The standard closing block: VM ID, hostname, resources, state and `VM_IP`, extra rows, numbered next steps, then the `done` telemetry and the completion message. |
 
diff --git a/tests/vm-helpers.sh b/tests/vm-helpers.sh
index 7c23f0f..23d5238 100644
--- a/tests/vm-helpers.sh
+++ b/tests/vm-helpers.sh
@@ -489,6 +489,7 @@ assert_contains "$UNIT" "ConditionPathExists=/opt/app.bin"
 assert_contains "$UNIT" "ExecStart=/usr/local/sbin/app-setup"
 assert_contains "$UNIT" "touch /var/lib/community-scripts/app-setup.done"
 assert_contains "$UNIT" "Type=oneshot"
+assert_contains "$UNIT" "Environment=DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a NEEDRESTART_SUSPEND=1"
 assert_contains "$UNIT" "Description=App setup"
 assert_contains "$LOG" "--chmod 0755:/usr/local/sbin/app-setup"
 assert_contains "$LOG" "--run-command systemctl enable app-setup.service"
diff --git a/vm/common.func b/vm/common.func
index 8cc43ab..e41ea63 100644
--- a/vm/common.func
+++ b/vm/common.func
@@ -300,6 +300,7 @@ vm_firstboot_unit() {
     [[ -n "$requires_path" ]] && printf 'ConditionPathExists=%s\n' "$requires_path"
     printf '\n[Service]\n'
     printf 'Type=oneshot\n'
+    printf 'Environment=DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a NEEDRESTART_SUSPEND=1\n'
     printf 'ExecStart=/usr/local/sbin/%s\n' "$name"
     printf "ExecStartPost=/bin/sh -c 'mkdir -p /var/lib/community-scripts && touch %s'\n" "$marker"
     printf 'RemainAfterExit=yes\n'