diff --git a/config/base.toml b/config/base.toml
index beba4180db..9a9ee55eb2 100644
--- a/config/base.toml
+++ b/config/base.toml
@@ -296,12 +296,12 @@ symlink = true
 password = "password"
 uid = 0
 gid = 0
-shell = "/usr/bin/zsh"
+shell = "/usr/bin/brush"
 
 [users.user]
 # Password is unset
 password = ""
-shell = "/usr/bin/zsh"
+shell = "/usr/bin/brush"
 
 # Group settings
 [groups.sudo]
diff --git a/config/redbear-bare.toml b/config/redbear-bare.toml
index 94d73e92bb..2ca7e15dbd 100644
--- a/config/redbear-bare.toml
+++ b/config/redbear-bare.toml
@@ -31,6 +31,7 @@ filesystem_size = 192
 ca-certificates = {}  # explicitly empty (overrides minimal)
 pkgutils = {}         # explicitly empty (overrides minimal)
 kibi = {}             # explicitly empty (overrides minimal)
+brush = {}            # login shell (bare matches mini up to login)
 
 # Override base.toml's network config — no DNS, no IP, no router
 [[files]]
@@ -147,11 +148,11 @@ No networking, no display, no audio, no driver-manager.
 password = "password"
 uid = 0
 gid = 0
-shell = "/usr/bin/zsh"
+shell = "/usr/bin/brush"
 
 [users.user]
 password = ""
-shell = "/usr/bin/zsh"
+shell = "/usr/bin/brush"
 
 [groups.sudo]
 gid = 1