diff --git a/lib/provision.sh b/lib/provision.sh
index 27061c6..71aad38 100644
--- a/lib/provision.sh
+++ b/lib/provision.sh
@@ -198,7 +198,12 @@ provision_configure_display() {
     # a fresh kiosk ships with; menus/advanced_virtual_consoles.sh can
     # flip this later, and does below if declined at the end of setup.
     provision_install_file "etc/X11/xorg.conf.d/99-finger-libinput.conf" /etc/X11/xorg.conf.d/99-finger-libinput.conf
-    provision_install_file "etc/X11/xorg.conf.d/10-serverflags.conf" /etc/X11/xorg.conf.d/10-serverflags.conf
+    # Only on first install: this file is also where Advanced -> Virtual
+    # Consoles records the admin's choice, and Upgrade re-runs this step -
+    # overwriting it would silently turn consoles back off (or on).
+    if [[ ! -f /etc/X11/xorg.conf.d/10-serverflags.conf ]]; then
+        provision_install_file "etc/X11/xorg.conf.d/10-serverflags.conf" /etc/X11/xorg.conf.d/10-serverflags.conf
+    fi
 
     provision_install_file "usr/local/bin/kiosk-mirror-display.sh" /usr/local/bin/kiosk-mirror-display.sh 755
     provision_install_file "usr/local/bin/kiosk-audio-route.sh" /usr/local/bin/kiosk-audio-route.sh 755
diff --git a/provision/files/etc/X11/xorg.conf.d/10-serverflags.conf b/provision/files/etc/X11/xorg.conf.d/10-serverflags.conf
index 87447bb..9a3c909 100644
--- a/provision/files/etc/X11/xorg.conf.d/10-serverflags.conf
+++ b/provision/files/etc/X11/xorg.conf.d/10-serverflags.conf
@@ -2,8 +2,10 @@ Section "ServerFlags"
     # Disable Ctrl+Alt+Backspace (X server kill)
     Option "DontZap" "true"
 
-    # Disable VT switching (Ctrl+Alt+F1-F12)
-    Option "DontVTSwitch" "true"
+    # Allow VT switching (Ctrl+Alt+F1-F8): virtual consoles are ENABLED by
+    # default, as the installer says. Advanced -> Virtual Consoles (or the
+    # install prompt) turns this to "true" to disable them.
+    Option "DontVTSwitch" "false"
 
     # Don't allow clients to disconnect on exit
     Option "AllowClosedownGrabs" "false"