diff --git a/README.md b/README.md
index 62f3935..20446e9 100644
--- a/README.md
+++ b/README.md
@@ -71,6 +71,8 @@ The included [docker-compose.yaml](docker-compose.yaml) enables kubeconfig boots
 
 That bootstrap is explicitly opt-in and defaults to off in the container itself, so it does not run in Kubernetes unless you deliberately enable it.
 
+When both are available, the bootstrap kubeconfig is applied after the service-account kubeconfig and therefore takes precedence.
+
 Start it with:
 
 ```bash
diff --git a/entrypoint.sh b/entrypoint.sh
index eb5a055..0a2d319 100644
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -291,8 +291,13 @@ EOF
 prepare_runtime() {
   mkdir -p /var/run/sshd
   ensure_host_keys
-  install_serviceaccount_kubeconfig
-  install_bootstrap_kubeconfig
+  if [[ "${ENABLE_BOOTSTRAP_KUBECONFIG}" == "true" ]]; then
+    log "Kubeconfig mode: bootstrap-only (serviceaccount kubeconfig generation disabled)."
+    install_bootstrap_kubeconfig
+  else
+    log "Kubeconfig mode: in-cluster serviceaccount."
+    install_serviceaccount_kubeconfig
+  fi
   persist_kubernetes_login_env
   configure_user_auth admin ADMIN_SSH_PUBKEY ADMIN_PASSWORD
   configure_user_auth user USER_SSH_PUBKEY USER_PASSWORD