diff --git a/backend/src/websocket/rdp.ts b/backend/src/websocket/rdp.ts
index 02df589..614ac91 100644
--- a/backend/src/websocket/rdp.ts
+++ b/backend/src/websocket/rdp.ts
@@ -174,14 +174,14 @@ export async function rdpWebsocket(fastify: FastifyInstance) {
           dpi: '96',
           'color-depth': '32',
           'ignore-cert': 'true',
-          security: 'any',
+          security: 'nla',            // FreeRDP 3.x dropped 'any'; NLA is what Windows 11 uses by default
           'disable-auth': 'false',
           'enable-drive': 'false',
           'create-drive-path': 'false',
           'enable-printing': 'false',
-          'disable-glyph-caching': 'true',
-          'disable-gfx': 'true',      // disable GFX Pipeline Extension (known FreeRDP 2.x crash source)
-          'cert-tofu': 'true',        // trust certificate on first use
+          'disable-glyph-caching': 'false',
+          // disable-gfx removed: FreeRDP 3.x handles GFX pipeline correctly; disabling it caused crashes
+          'cert-tofu': 'true',
           'resize-method': 'display-update',
         };