diff --git a/infra/tofu/main.tf b/infra/tofu/main.tf
index db7d4a4..cf61a8d 100644
--- a/infra/tofu/main.tf
+++ b/infra/tofu/main.tf
@@ -89,6 +89,13 @@ resource "proxmox_virtual_environment_vm" "node" {
     type = "l26"
   }
 
+  # Serial console (socket): Debian cloud images boot with console=ttyS0 and can panic
+  # on import+resize when no serial device is present (bpg #1639). Standard + harmless
+  # for cloud images; the default VGA display is kept so the Proxmox UI console works too.
+  serial_device {
+    device = "socket"
+  }
+
   # OS disk (virtio0 -> /dev/vda, boot): a copy of the imported cloud image, grown
   # to os_disk_gib. Longhorn data disk (virtio1 -> /dev/vdb): blank, data_disk_gib.
   # virtio* keeps the guest device names (/dev/vda, /dev/vdb) the cloud-init
diff --git a/infra/tofu/variables.tf b/infra/tofu/variables.tf
index 81c6b79..128aff4 100644
--- a/infra/tofu/variables.tf
+++ b/infra/tofu/variables.tf
@@ -159,20 +159,24 @@ variable "image_source" {
   description = <<-EOT
     Source URL for the base OS cloud image (qcow2), downloaded to image_datastore
     by proxmox_virtual_environment_download_file. Default is Debian 12 (bookworm)
-    genericcloud amd64 — same image as the pre-migration libvirt module.
+    generic amd64 (full firmware/driver, hybrid BIOS/UEFI). Use `generic`, NOT
+    `genericcloud`: the genericcloud image panics with "Attempted to kill init" on
+    import + disk-resize under bpg (bpg issue #1639).
   EOT
   type        = string
-  default     = "https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-genericcloud-amd64.qcow2"
+  default     = "https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-generic-amd64.qcow2"
 }
 
 variable "image_file_name" {
   description = <<-EOT
     File name the cloud image is stored as on image_datastore. With `import`-content
     storage (PVE 8.2+) the native .qcow2 name is used directly — the old .img rename
-    was an `iso`-content workaround and is no longer needed.
+    was an `iso`-content workaround and is no longer needed. Uses the `generic`
+    (full firmware/driver, hybrid BIOS/UEFI) image, NOT `genericcloud`: genericcloud
+    panics with "Attempted to kill init" on import + disk-resize (bpg issue #1639).
   EOT
   type        = string
-  default     = "debian-12-genericcloud-amd64.qcow2"
+  default     = "debian-12-generic-amd64.qcow2"
 }
 
 # --- cloud-init identity ----------------------------------------------------