diff --git a/iso/overlay/etc/systemd/system.conf.d/watchdog.conf b/iso/overlay/etc/systemd/system.conf.d/watchdog.conf
new file mode 100644
index 0000000..b83ea66
--- /dev/null
+++ b/iso/overlay/etc/systemd/system.conf.d/watchdog.conf
@@ -0,0 +1,4 @@
+[Manager]
+# Pet the hardware watchdog every 30s so the host doesn't reboot mid-audit.
+# Kernel watchdog timeout is typically 60s; 30s gives a safe 2× margin.
+RuntimeWatchdogSec=30s