diff --git a/install.sh b/install.sh
index e39735f..67cab63 100755
--- a/install.sh
+++ b/install.sh
@@ -186,6 +186,20 @@ deploy_current() {
   install_units
   sudo systemctl enable mediapi-mpv mediapi-app >/dev/null 2>&1 || true
 
+  # Migration cleanup: earlier versions ran Kodi as the player. A still-running
+  # Kodi keeps the GPU's DRM master and the tty1 seat, which stops mpv from ever
+  # acquiring the display -- and removing a unit file does NOT stop an already
+  # running process. So explicitly tear any Kodi down before starting mpv.
+  if [[ -e /etc/systemd/system/mediapi-kodi.service ]] || pgrep -x kodi.bin >/dev/null 2>&1; then
+    echo "==> Removing leftover Kodi player ..."
+    sudo systemctl unmask mediapi-kodi.service 2>/dev/null || true
+    sudo systemctl disable --now mediapi-kodi.service 2>/dev/null || true
+    sudo rm -f /etc/systemd/system/mediapi-kodi.service
+    sudo pkill -9 -x kodi.bin 2>/dev/null || true
+    sudo pkill -9 -f kodi-standalone 2>/dev/null || true
+    sudo systemctl daemon-reload
+  fi
+
   echo "==> Starting services ..."
   sudo systemctl restart mediapi-mpv
   sudo systemctl restart mediapi-app
diff --git a/systemd/mediapi-mpv.service.template b/systemd/mediapi-mpv.service.template
index 8b1cdc5..9f06244 100644
--- a/systemd/mediapi-mpv.service.template
+++ b/systemd/mediapi-mpv.service.template
@@ -1,26 +1,27 @@
 [Unit]
 Description=mpv video player (KMS/DRM -- the actual player)
-# Needs the DRM/HDMI + sound devices present; takes over the console VT.
+# Needs the DRM/HDMI + sound devices present.
 After=local-fs.target systemd-udev-settle.service sound.target
 Wants=systemd-udev-settle.service
+# Keep a login getty off the primary display so nothing else claims tty1.
 Conflicts=getty@tty1.service
 
 [Service]
 User=${MEDIAPI_USER}
-# mpv on DRM/KMS needs: video+render (GPU/DRM), input (remotes/keyboard), audio
-# (HDMI/ALSA), tty (own the VT). PAMName=login gives it a real logind session so
-# it can take the seat's DRM/input devices.
-SupplementaryGroups=video render input audio tty
-PAMName=login
-TTYPath=/dev/tty1
-StandardInput=tty
-StandardOutput=journal
-StandardError=journal
+# mpv on KMS/DRM needs: video+render (GPU/DRM), input (remotes/keyboard), audio
+# (HDMI/ALSA). It becomes DRM master simply as the first/only DRM client on the
+# seat -- no PAM login session and no elevated capabilities required, provided
+# nothing else is already holding the GPU. (An older Kodi-based deploy DID hold
+# it; install.sh tears any leftover Kodi down before starting this.)
+SupplementaryGroups=video render input audio
 # Create /run/mediapi (owned by this user) for the IPC socket the app connects to.
 RuntimeDirectory=mediapi
-# --idle keeps mpv running with no file loaded (holds the playlist between
-# clips and after the last one), so the service stays up and the app can always
-# reach the socket. Playback is hardware-decoded straight on KMS.
+StandardInput=null
+StandardOutput=journal
+StandardError=journal
+# --idle keeps mpv running with no file loaded (holds the playlist between clips
+# and after the last one), so the service stays up and the app can always reach
+# the socket. Playback renders straight on KMS.
 ExecStart=/usr/bin/mpv \
   --idle=yes \
   --input-ipc-server=/run/mediapi/mpv.sock \