diff --git a/Cargo.lock b/Cargo.lock
index 833e955..cb6ac0d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -264,7 +264,7 @@ dependencies = [
 
 [[package]]
 name = "devbox"
-version = "0.1.3"
+version = "0.1.4"
 dependencies = [
  "anyhow",
  "async-trait",
diff --git a/Cargo.toml b/Cargo.toml
index c422775..ba51ed5 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "devbox"
-version = "0.1.3"
+version = "0.1.4"
 edition = "2024"
 description = "Isolated developer VMs for AI coding agents and humans. Safe by default."
 license = "Apache-2.0"
diff --git a/src/runtime/incus.rs b/src/runtime/incus.rs
index d6627d8..3c74a44 100644
--- a/src/runtime/incus.rs
+++ b/src/runtime/incus.rs
@@ -25,7 +25,7 @@ impl IncusRuntime {
     fn remote_image(image_type: &str) -> &'static str {
         match image_type {
             "ubuntu" => "images:ubuntu/24.04",
-            _ => "images:nixos/24.11",
+            _ => "images:nixos/25.11",
         }
     }
 
@@ -106,7 +106,7 @@ impl Runtime for IncusRuntime {
         // Launch the VM
         println!("Creating Incus VM '{vm}'...");
         let image = Self::image_alias(&opts.image);
-        let mut launch_args = vec!["launch", image, &vm, "--vm"];
+        let mut launch_args = vec!["launch", image, &vm, "--vm", "-c", "security.secureboot=false"];
 
         let cpu_str;
         if opts.cpu > 0 {