diff --git a/dankclaw/observability/quadlet/alertmanager.container b/dankclaw/observability/quadlet/alertmanager.container
index 098e37c..264221d 100644
--- a/dankclaw/observability/quadlet/alertmanager.container
+++ b/dankclaw/observability/quadlet/alertmanager.container
@@ -13,9 +13,10 @@
 # existing Signal account.
 #
 # PUBLISHING. 127.0.0.1 only, like every other observability unit: the
-# unauthenticated Alertmanager API (with the lifecycle endpoint) has no
-# business on a host interface, and no off-host consumer needs it. Caddy
-# gains no vhost for it; the homepage timer probes loopback.
+# unauthenticated Alertmanager API (lifecycle endpoints are always on in
+# this binary — there is no flag to gate them) has no business on a host
+# interface, and no off-host consumer needs it. Caddy gains no vhost for
+# it; the homepage timer probes loopback.
 #
 # CONFIG. /opt/alertmanager/config/alertmanager.yml is installed from
 # shared/prometheus/alertmanager.yml by deploy-remote.sh on every deploy, so
@@ -35,7 +36,7 @@ ContainerName=alertmanager
 Image=docker.io/prom/alertmanager:latest
 Network=dankclaw_default
 User=0:0
-Exec=--config.file=/etc/alertmanager/alertmanager.yml --storage.path=/alertmanager --web.enable-lifecycle
+Exec=--config.file=/etc/alertmanager/alertmanager.yml --storage.path=/alertmanager
 PublishPort=127.0.0.1:9093:9093
 Volume=/opt/alertmanager/config:/etc/alertmanager
 Volume=/opt/alertmanager/data:/alertmanager