diff --git a/dankclaw/udev/99-comfyui-gpu-access.rules b/dankclaw/udev/99-comfyui-gpu-access.rules
new file mode 100644
index 0000000..b79c78d
--- /dev/null
+++ b/dankclaw/udev/99-comfyui-gpu-access.rules
@@ -0,0 +1,21 @@
+# /etc/udev/rules.d/99-comfyui-gpu-access.rules
+#
+# Why world-writable compute nodes: the comfyui container is spawned by a
+# systemd user unit (comfyui.service, Type=oneshot). User-unit processes are
+# spawned by the user manager with NO supplementary groups, so any spawn path
+# through systemd loses `render`/`video` membership regardless of how the
+# container is launched (keep-groups and named group_add both depend on the
+# spawning process already holding the group — verified 2026-08-31: keep-groups
+# preserved an empty group list under the user manager and /dev/kfd open still
+# failed with EACCES). A mode that grants access to "everyone in this uid
+# domain" is the only spawn-context-independent option short of running the
+# stack rootful.
+#
+# Blast radius: any local process (every container here runs as the same uid
+# domain) can already ptrace the GPU userspace through an existing holder's
+# fd inheritance; on a private single-administrator home server this trades a
+# capability gate that could never be held by the intended user anyway.
+# Render nodes and /dev/kfd are compute nodes only — display outputs (card0,
+# card1) keep their owner/group/mode.
+KERNEL=="kfd", SUBSYSTEM=="misc", MODE="0666"
+KERNEL=="renderD*", SUBSYSTEM=="drm", MODE="0666"
diff --git a/scripts/test-changed.sh b/scripts/test-changed.sh
index b263720..4cf3fa5 100755
--- a/scripts/test-changed.sh
+++ b/scripts/test-changed.sh
@@ -192,6 +192,10 @@ for path in "${CHANGED[@]}"; do
             add_test tests/docs_completeness.bats
             add_test tests/deployment_scoping.bats
             ;;
+        dankclaw/udev/*)
+            # Host-level udev rules are applied by manual sudo install + udevadm
+            # trigger, not dispatched as a service; nothing here is bats-testable.
+            ;;
         .AGENTTRASH/*)
             # Trash moves are not testable; skip.
             ;;