diff --git a/dankclaw/authentik/quadlet/authentik-server.container b/dankclaw/authentik/quadlet/authentik-server.container
index 60c945d..12692cb 100644
--- a/dankclaw/authentik/quadlet/authentik-server.container
+++ b/dankclaw/authentik/quadlet/authentik-server.container
@@ -30,7 +30,6 @@ Environment=AUTHENTIK_POSTGRESQL__PASSWORD=${AUTHENTIK_PG_PASS}
 Environment=AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY}
 PublishPort=127.0.0.1:9000:9000
 HealthCmd=python -c "import urllib.request;urllib.request.urlopen('http://localhost:9000/-/health/')"
---shm-size=512m
 HealthInterval=30s
 HealthTimeout=10s
 HealthRetries=5
diff --git a/scripts/deploy-remote.sh b/scripts/deploy-remote.sh
index 699df9d..95c3d2c 100755
--- a/scripts/deploy-remote.sh
+++ b/scripts/deploy-remote.sh
@@ -537,7 +537,12 @@ deploy_authentik() {
         podman stop authentik-postgres authentik-server authentik-worker 2>/dev/null || true
         podman rm authentik-postgres authentik-server authentik-worker 2>/dev/null || true
     fi
-    systemctl --user enable authentik-postgres.service authentik-server.service authentik-worker.service
+    # No `systemctl --user enable` here: this host's quadlet generator
+    # (podman 5.x v1) generates units into /run/user/1000/systemd/generator/,
+    # and generated units cannot be enabled — enable fails with "transient or
+    # generated". Boot persistence comes from [Install] WantedBy=default.target
+    # inside each .container file, which the generator honors at user-manager
+    # start (linger must stay on for the deploy user).
     systemctl --user start authentik-postgres.service
     wait_container_healthy authentik-postgres 120 || return 1
     systemctl --user start authentik-server.service