diff --git a/dankserver/plex/quadlet/plex.container b/dankserver/plex/quadlet/plex.container
index e1e243d..6f61e82 100644
--- a/dankserver/plex/quadlet/plex.container
+++ b/dankserver/plex/quadlet/plex.container
@@ -6,8 +6,7 @@ Wants=network-online.target
 [Container]
 Image=lscr.io/linuxserver/plex:1.43.3.10896-cb3ebc72d-ls322
 ContainerName=plex
-Network=dankserver_appnet:alias=plex
-UsernsMode=host
+UserNS=host
 Environment=PUID=997
 Environment=PGID=984
 Environment=TZ=America/Los_Angeles
diff --git a/dankserver/tautulli/quadlet/tautulli.container b/dankserver/tautulli/quadlet/tautulli.container
index 10c8ed2..653cf13 100644
--- a/dankserver/tautulli/quadlet/tautulli.container
+++ b/dankserver/tautulli/quadlet/tautulli.container
@@ -5,9 +5,8 @@ Wants=network-online.target
 
 [Container]
 Image=lscr.io/linuxserver/tautulli:v2.18.1-ls242
-ContainerName=tautulli
+UserNS=host
 Network=dankserver_appnet:alias=tautulli
-UsernsMode=host
 Environment=PUID=1000
 Environment=PGID=1000
 Environment=TZ=America/Los_Angeles
diff --git a/serverAppConfigs-docs/Dankserver/Plex.md b/serverAppConfigs-docs/Dankserver/Plex.md
index 3988067..a4c1bd9 100644
--- a/serverAppConfigs-docs/Dankserver/Plex.md
+++ b/serverAppConfigs-docs/Dankserver/Plex.md
@@ -18,7 +18,7 @@ public traffic can be fronted by Caddy like every other vhost.
 | Image | `lscr.io/linuxserver/plex:1.43.3.10896-cb3ebc72d-ls322` (pinned; verified == the ghcr `latest` manifest digest at pin time) |
 | Data root | `/var/lib/plexmediaserver` bind-mounted **in place** as `/config` (RW) — the migration moved zero bytes |
 | Media | `/mnt/entropy` mounted at the same absolute path **read-only** — every library path in the PMS database stayed valid, zero re-scan |
-| Identity | `UsernsMode=host` + `PUID=997 PGID=984` — container writes land owned 997:984, byte-compatible with the former native unit |
+| Identity | `UserNS=host` (quadlet key for `--userns=host`) + `PUID=997 PGID=984` — container writes land owned 997:984, byte-compatible with the former native unit |
 | Port | `32400/tcp` published on `0.0.0.0` — zero client reconfiguration |
 | Network | `dankserver_appnet`, alias `plex`; Tautulli reaches it at `http://plex:32400` |
 | GPU | none by decision — CPU decode only; the RTX 3090 stays dedicated to `frank-default-small` |
diff --git a/serverAppConfigs-docs/Dankserver/Tautulli.md b/serverAppConfigs-docs/Dankserver/Tautulli.md
index c10604e..390d8cf 100644
--- a/serverAppConfigs-docs/Dankserver/Tautulli.md
+++ b/serverAppConfigs-docs/Dankserver/Tautulli.md
@@ -16,7 +16,7 @@ it; it talks to PMS over the appnet at `http://plex:32400`).
 | Runtime | podman quadlet, `tautulli.service` (user manager) — migrated from snap `snap.tautulli.tautulli.service` |
 | Image | `lscr.io/linuxserver/tautulli:v2.18.1-ls242` (pinned; verified == the ghcr `latest` manifest digest at pin time) |
 | Data root | `/home/dank/Containers/tautulli` bind-mounted as `/config` (fresh at cutover — the snap's `/var/snap/tautulli/common` was empty) |
-| Identity | `UsernsMode=host` + `PUID=1000 PGID=1000` |
+| Identity | `UserNS=host` (quadlet key for `--userns=host`) + `PUID=1000 PGID=1000` |
 | Port | `8181/tcp` published on `0.0.0.0` |
 | Network | `dankserver_appnet`, alias `tautulli` |
 | PMS URL | `http://plex:32400` — seeded into `config.ini` by the deployer on first start |
diff --git a/tests/dankserver_quadlet.bats b/tests/dankserver_quadlet.bats
index e4dc226..93e5a5e 100755
--- a/tests/dankserver_quadlet.bats
+++ b/tests/dankserver_quadlet.bats
@@ -67,14 +67,14 @@ load helpers
     grep -q '^PublishPort=8181:8181$' "$REPO_ROOT/dankserver/tautulli/quadlet/tautulli.container" || return 1
 }
 
-@test "plex keeps the native unit's identity (userns=host, PUID=997, PGID=984)" {
+@test "plex keeps the native unit's identity (UserNS=host, PUID=997, PGID=984)" {
     # Zero-chown ownership contract: /var/lib/plexmediaserver is bind-mounted
     # in place, so every file the container writes must land owned 997:984 —
-    # byte-identical to the former plexmediaserver.service identity. If the
-    # v1 generator ever drops UsernsMode=, files appear as the rootless
-    # subuid and the migration invariant is broken; pin both keys.
+    # byte-identical to the former plexmediaserver.service identity. UserNS=
+    # is the quadlet v1 key (UsernsMode= is compose syntax and the generator
+    # hard-fails the whole unit on it); pin the exact keys.
     unit="$REPO_ROOT/dankserver/plex/quadlet/plex.container"
-    grep -q '^UsernsMode=host$' "$unit" || return 1
+    grep -q '^UserNS=host$' "$unit" || return 1
     grep -q '^Environment=PUID=997$' "$unit" || return 1
     grep -q '^Environment=PGID=984$' "$unit" || return 1
 }