diff --git a/README.md b/README.md
index 3d24fa3..07a3498 100644
--- a/README.md
+++ b/README.md
@@ -253,7 +253,6 @@ JSON to YAML with a tool such as `yj`.
 
 ## TODO / Later Goals
 
-- Spotify Openbox autostart.
 - Spotify network lockdown via nftables, proxy or DNS allowlist.
 - Stable custom Hyper-V NAT switch.
 - PipeWire + EasyEffects experiment once xrdp audio is understood.
diff --git a/flake.nix b/flake.nix
index 926875b..a5629be 100644
--- a/flake.nix
+++ b/flake.nix
@@ -89,6 +89,29 @@
       qubix-manifest-json = pkgs.writeText "qubix-manifest.json"
         (builtins.toJSON qubixManifest);
 
+      # Inspection helper: prints the spotibox system closure size and the top
+      # 30 contributors, sorted by recursive closure size descending. Intended
+      # for sizing decisions — building it forces the spotibox toplevel, since
+      # there is nothing to measure otherwise.
+      qubix-closure-info = pkgs.writeShellApplication {
+        name = "qubix-closure-info";
+        runtimeInputs = with pkgs; [ nix coreutils ];
+        text = ''
+          toplevel="${spotiboxCfg.system.build.toplevel}"
+
+          echo "Spotibox system toplevel:"
+          echo "  $toplevel"
+          echo
+
+          echo "Total closure size:"
+          nix path-info -Sh "$toplevel"
+          echo
+
+          echo "Top 30 closure contributors (closure size, descending):"
+          nix path-info -rSh "$toplevel" | sort -hrk2 | head -n 30
+        '';
+      };
+
       default = self.packages.${system}.spotibox-vhdx;
     };
 
diff --git a/profiles/apps/spotify.nix b/profiles/apps/spotify.nix
index 6e91cbe..2f70211 100644
--- a/profiles/apps/spotify.nix
+++ b/profiles/apps/spotify.nix
@@ -5,7 +5,13 @@ lib.mkIf (config.qubix.app == "spotify") {
     spotify
   ];
 
-  # TODO: Add Spotify Openbox autostart after the final login/session model is
-  # fixed. The likely location is /etc/xdg/openbox/autostart or a user-level
-  # ~/.config/openbox/autostart file.
+  # The appliance exists to run one app, so Spotify launches with the Openbox
+  # session for both the console `user` and the xrdp `rdp` user. openbox-session
+  # sources /etc/xdg/openbox/autostart before any per-user autostart, which
+  # keeps the behaviour declarative and identical for both accounts.
+  environment.etc."xdg/openbox/autostart" = lib.mkIf (config.qubix.gui == "openbox") {
+    text = ''
+      ${pkgs.spotify}/bin/spotify &
+    '';
+  };
 }
diff --git a/tests/spotibox-basic.nix b/tests/spotibox-basic.nix
index e1c21d1..00c92e8 100644
--- a/tests/spotibox-basic.nix
+++ b/tests/spotibox-basic.nix
@@ -21,5 +21,7 @@ pkgs.testers.nixosTest {
     machine.succeed("command -v pavucontrol")
     machine.succeed("systemctl is-enabled xrdp")
     machine.succeed("systemctl is-enabled avahi-daemon")
+    machine.succeed("test -f /etc/xdg/openbox/autostart")
+    machine.succeed("grep -q spotify /etc/xdg/openbox/autostart")
   '';
 }