diff --git a/run.sh b/run.sh
index 3a16ed8..8de0776 100755
--- a/run.sh
+++ b/run.sh
@@ -201,10 +201,10 @@ vm_create() {
 
     # Detect KVM acceleration; fall back to QEMU software emulation
     local domain_type="qemu"
-    local cpu_mode="qemu64"
+    local cpu_element="<cpu mode='custom' match='exact' check='none'><model>qemu64</model></cpu>"
     if [[ -e /dev/kvm ]]; then
         domain_type="kvm"
-        cpu_mode="host-passthrough"
+        cpu_element="<cpu mode='host-passthrough' check='none'/>"
         log_info "KVM acceleration enabled"
     else
         log_warn "KVM not available (/dev/kvm missing) - using QEMU software emulation"
@@ -218,7 +218,7 @@ vm_create() {
         -e "s|@VM_RAM@|${VM_RAM}|g" \
         -e "s|@VM_CPUS@|${VM_CPUS}|g" \
         -e "s|@DOMAIN_TYPE@|${domain_type}|g" \
-        -e "s|@CPU_MODE@|${cpu_mode}|g" \
+        -e "s|@CPU_ELEMENT@|${cpu_element}|g" \
         -e "s|@SECURE_BOOT@|${secure_boot}|g" \
         -e "s|@UEFI_CODE@|${uefi_code}|g" \
         -e "s|@UEFI_VARS_TEMPLATE@|${uefi_vars}|g" \
@@ -239,23 +239,41 @@ vm_create() {
     # Start the VM
     log_info "Starting VM..."
     if ! virsh -c "$LIBVIRT_URI" start "$VM_NAME"; then
-        # Check if failure was due to swtpm permissions
-        if [[ -n "$tpm_section" && "$LIBVIRT_URI" == *"system"* ]]; then
-            local vm_uuid
-            vm_uuid=$(virsh -c "$LIBVIRT_URI" dominfo "$VM_NAME" 2>/dev/null | grep "UUID:" | awk '{print $2}')
-            local swtpm_vm_dir="/var/lib/libvirt/swtpm/${vm_uuid}"
-            if [[ -d "$swtpm_vm_dir" ]]; then
-                log_error "TPM initialization failed - swtpm permission issue"
-                log_error "Libvirt creates per-VM swtpm state dirs as root:root."
-                log_error "Permanent fix (run once with sudo):"
-                log_error "  sudo bash ${SCRIPT_DIR}/scripts/fix-swtpm-permissions.sh"
-                log_error "Then retry: ./run.sh test:iso destroy && ./run.sh test:iso create"
-                # Undefine so user can retry after fixing
-                virsh -c "$LIBVIRT_URI" undefine "$VM_NAME" --nvram 2>/dev/null || true
+        # If TPM was enabled, retry without it (swtpm may be broken)
+        if [[ -n "$tpm_section" ]]; then
+            log_warn "VM start failed with TPM - retrying without TPM..."
+            log_warn "Live ISO boot testing does not require TPM."
+            virsh -c "$LIBVIRT_URI" undefine "$VM_NAME" --nvram 2>/dev/null || true
+
+            # Regenerate XML without TPM section
+            sed -e "s|@VM_NAME@|${VM_NAME}|g" \
+                -e "s|@VM_UUID@|${vm_uuid}|g" \
+                -e "s|@VM_RAM@|${VM_RAM}|g" \
+                -e "s|@VM_CPUS@|${VM_CPUS}|g" \
+                -e "s|@DOMAIN_TYPE@|${domain_type}|g" \
+                -e "s|@CPU_ELEMENT@|${cpu_element}|g" \
+                -e "s|@SECURE_BOOT@|${secure_boot}|g" \
+                -e "s|@UEFI_CODE@|${uefi_code}|g" \
+                -e "s|@UEFI_VARS_TEMPLATE@|${uefi_vars}|g" \
+                -e "s|@VM_DISK@|${vm_disk_path}|g" \
+                -e "s|@ISO_PATH@|${vm_iso_path}|g" \
+                -e "s|@TPM_SECTION@||g" \
+                "$template" > "$vm_xml"
+
+            if ! virsh -c "$LIBVIRT_URI" define "$vm_xml"; then
+                log_error "Failed to redefine VM without TPM"
+                cat "$vm_xml"
+                return 1
             fi
+
+            if ! virsh -c "$LIBVIRT_URI" start "$VM_NAME"; then
+                log_error "Failed to start VM (with and without TPM)"
+                return 1
+            fi
+        else
+            log_error "Failed to start VM"
+            return 1
         fi
-        log_error "Failed to start VM"
-        return 1
     fi
 
     # Verify VM is running