diff --git a/grok_register_ttk.py b/grok_register_ttk.py
index abc5d39..177b326 100644
--- a/grok_register_ttk.py
+++ b/grok_register_ttk.py
@@ -613,18 +613,28 @@ def add_token_to_grok2api_pools(raw_token, email="", log_callback=None):
     _add_token_to_grok2api_pools_sync(raw_token, email=email, log_callback=log_callback)
 
 
-CHROMIUM_SLIM_FLAGS = [
-    "--disable-gpu",
-    "--disable-software-rasterizer",
+# Base flags always safe. Keep close to Git-creat7/grokRegister-cpa which only
+# uses auto_port + extension (no slim flags) on real headed desktops.
+CHROMIUM_BASE_FLAGS = [
     "--no-sandbox",
     "--disable-dev-shm-usage",
     # Keep images ON: Turnstile/CF widgets often need them; was a common fail cause.
     "--mute-audio",
-    "--disable-background-networking",
     "--no-first-run",
     "--disable-blink-features=AutomationControlled",
 ]
 
+# Extra flags only for true headless (no DISPLAY). Under Xvfb/headed these can
+# blank CF widgets (iframe=0 / token=0) — especially --disable-software-rasterizer.
+CHROMIUM_HEADLESS_EXTRA_FLAGS = [
+    "--disable-gpu",
+    "--disable-software-rasterizer",
+    "--disable-background-networking",
+]
+
+# Back-compat alias used by older call sites / register_cli patches
+CHROMIUM_SLIM_FLAGS = CHROMIUM_BASE_FLAGS + CHROMIUM_HEADLESS_EXTRA_FLAGS
+
 # Headless / display helpers (Linux servers without desktop)
 _HEADLESS_HINT_SHOWN = False
 _HEADLESS_HINT_LOCK = threading.Lock()
@@ -1060,8 +1070,14 @@ def create_browser_options(headless=None):
     options = ChromiumOptions()
     options.auto_port()
     options.set_timeouts(base=1)
-    for flag in CHROMIUM_SLIM_FLAGS:
+
+    # Decide headless first so we can choose flag set (headed ≈ reference repo).
+    use_hl = should_use_headless(headless, log_hint=True)
+    for flag in CHROMIUM_BASE_FLAGS:
         options.set_argument(flag)
+    if use_hl:
+        for flag in CHROMIUM_HEADLESS_EXTRA_FLAGS:
+            options.set_argument(flag)
     # Do NOT pass --excludeSwitches as a CLI arg (invalid); only real prefs.
     try:
         options.set_pref("credentials_enable_service", False)
@@ -1115,13 +1131,13 @@ def create_browser_options(headless=None):
         except Exception as e:
             print(f"  [proxy] set browser proxy failed: {e}")
 
-    use_hl = should_use_headless(headless, log_hint=True)
     apply_headless_to_options(options, use_hl)
     if use_hl:
         print("  [browser] headless=True", flush=True)
     else:
         print(
-            f"  [browser] headed DISPLAY={os.environ.get('DISPLAY', '')!r}",
+            f"  [browser] headed DISPLAY={os.environ.get('DISPLAY', '')!r} "
+            f"(flags=base-only, no disable-software-rasterizer)",
             flush=True,
         )
     return options
diff --git a/start.sh b/start.sh
index 6a3d125..5784d34 100755
--- a/start.sh
+++ b/start.sh
@@ -733,20 +733,34 @@ main() {
         export CHROMIUM_PATH
     fi
 
+    # 组装 env：绝不把空 DISPLAY= 传给子进程。
+    # 否则会覆盖 xvfb-run 自动分配的 DISPLAY，Python 侧 has_display=False → 强制 headless，
+    # Turnstile 会卡在 token长度=0（参考 grokRegister-cpa 的成功路径是纯 headed + extension）。
+    local -a env_args=(
+        "BROWSER_PREFER=${BROWSER_PREFER:-}"
+        "BROWSER_PATH=${BROWSER_PATH:-}"
+        "CHROMIUM_PATH=${CHROMIUM_PATH:-}"
+    )
+    if [ -n "${DISPLAY:-}" ]; then
+        env_args+=("DISPLAY=${DISPLAY}")
+    fi
+    if [ -n "${XAUTHORITY:-}" ]; then
+        env_args+=("XAUTHORITY=${XAUTHORITY}")
+    fi
+    if [ -n "${WAYLAND_DISPLAY:-}" ]; then
+        env_args+=("WAYLAND_DISPLAY=${WAYLAND_DISPLAY}")
+    fi
+
     if [ ${#RUN_PREFIX[@]} -gt 0 ]; then
         echo -e "${CYAN}[*] 启动命令: ${RUN_PREFIX[*]} uv run --python 3.13 python -u register_cli.py ${args[*]}${NC}"
+        echo -e "${CYAN}[*] 注意: 不向 xvfb-run 子进程注入空 DISPLAY（保留虚拟显示）${NC}"
         echo ""
         exec "${RUN_PREFIX[@]}" env \
-            BROWSER_PREFER="${BROWSER_PREFER:-}" \
-            BROWSER_PATH="${BROWSER_PATH:-}" \
-            CHROMIUM_PATH="${CHROMIUM_PATH:-}" \
-            DISPLAY="${DISPLAY:-}" \
+            "${env_args[@]}" \
             uv run --python 3.13 python -u register_cli.py "${args[@]}"
     else
         exec env \
-            BROWSER_PREFER="${BROWSER_PREFER:-}" \
-            BROWSER_PATH="${BROWSER_PATH:-}" \
-            CHROMIUM_PATH="${CHROMIUM_PATH:-}" \
+            "${env_args[@]}" \
             uv run --python 3.13 python -u register_cli.py "${args[@]}"
     fi
 }