diff --git a/debian-live-config/check-iso.sh b/debian-live-config/check-iso.sh
index 4f6de54d..d42bf880 100755
--- a/debian-live-config/check-iso.sh
+++ b/debian-live-config/check-iso.sh
@@ -69,6 +69,27 @@ if awk -F: '$3 >= 1000 && $3 < 60000 {found=1} END {exit !found}' "${TMP}/passwd
   FAILED=1
 fi
 
+# A Live USB must come back on its own after a reboot or power loss: the boot
+# menus must boot their default entry after a timeout (0 waits forever).
+if ! extract boot/grub/config.cfg || ! grep -qE '^set timeout=[1-9]' "${TMP}/config.cfg"; then
+  echo "ERROR: the GRUB (UEFI) boot menu has no timeout; a Live USB would wait at it forever." >&2
+  FAILED=1
+fi
+if extract isolinux/isolinux.cfg && ! grep -qE '^timeout [1-9]' "${TMP}/isolinux.cfg"; then
+  echo "ERROR: the ISOLINUX (BIOS) boot menu has no timeout; a Live USB would wait at it forever." >&2
+  FAILED=1
+fi
+
+# The installer should default the hostname to wrolpi (wrolpi.local), via the
+# preseed live-build copies into each installer initrd.
+for initrd in install/initrd.gz install/gtk/initrd.gz; do
+  if ! bsdtar -xOf "${ISO}" "${initrd}" 2>/dev/null | bsdtar -xOf - preseed.cfg 2>/dev/null \
+      | grep -q '^d-i netcfg/get_hostname string wrolpi$'; then
+    echo "ERROR: ${initrd} does not preseed the hostname wrolpi." >&2
+    FAILED=1
+  fi
+done
+
 if [ "${FAILED}" -ne 0 ]; then
   exit 1
 fi
diff --git a/debian-live-config/config/hooks/normal/9999-rebrand-bootmenu.binary b/debian-live-config/config/hooks/normal/9999-rebrand-bootmenu.binary
index e3a257cd..4372b12e 100755
--- a/debian-live-config/config/hooks/normal/9999-rebrand-bootmenu.binary
+++ b/debian-live-config/config/hooks/normal/9999-rebrand-bootmenu.binary
@@ -1,5 +1,7 @@
 #!/bin/sh
-# Rebrand the live-build generated boot menus.
+# Rebrand the live-build generated boot menus, and boot the default entry
+# ("Run WROLPi (live)") after a timeout so a Live USB comes back on its own
+# after a reboot or power loss.
 #
 # live-build invokes binary hooks with cwd = the build's binary/ directory
 # (it does `cd binary && ../hook`), so paths here are relative to binary/.
@@ -45,3 +47,15 @@ for f in isolinux/live.cfg \
       "$f"
   fi
 done
+
+# Boot the default entry after 10 seconds (live-build sets no timeout, so the
+# menu waited forever).  Any key stops the countdown.
+BOOT_MENU_TIMEOUT=10
+# GRUB (UEFI): grub.cfg sources config.cfg, which sets default=0.
+if [ -f boot/grub/config.cfg ]; then
+  echo "set timeout=${BOOT_MENU_TIMEOUT}" >> boot/grub/config.cfg
+fi
+# ISOLINUX (BIOS): timeout is in tenths of a second; 0 waits forever.
+if [ -f isolinux/isolinux.cfg ]; then
+  sed -i "s|^timeout 0$|timeout $((BOOT_MENU_TIMEOUT * 10))|" isolinux/isolinux.cfg
+fi
diff --git a/debian-live-config/config/includes.installer/preseed.cfg b/debian-live-config/config/includes.installer/preseed.cfg
new file mode 100644
index 00000000..5ba66eb9
--- /dev/null
+++ b/debian-live-config/config/includes.installer/preseed.cfg
@@ -0,0 +1,9 @@
+# Debian installer defaults.  live-build copies this into the installer's
+# initrd, where d-i loads /preseed.cfg automatically.
+#
+# Default the hostname to wrolpi (Debian's default is "debian"), as on the live
+# session and the Pi: it names the TLS certificate, the SMB/NetBIOS share, and
+# the DHCP hostname a router may publish.  "seen false" keeps the question on
+# screen, so it can still be changed; a hostname from DHCP takes precedence.
+d-i netcfg/get_hostname string wrolpi
+d-i netcfg/get_hostname seen false