diff --git a/dankclaw/compose.yaml b/dankclaw/compose.yaml
index 11d2892..ef1c924 100644
--- a/dankclaw/compose.yaml
+++ b/dankclaw/compose.yaml
@@ -13,7 +13,9 @@ services:
 
   # --- AI image generation (ROCm GPU backend, gfx1151) ---------------------
   # Built from Containerfile.comfyui on AMD's gfx1151 torch base. The GPU is
-  # passed through (/dev/kfd, /dev/dri) with the video+render groups; no --cpu.
+  # reached via the /dev/kfd + /dev/dri passthrough (checked host-side; the run
+  # user is already in the render group). Only the 'video' group is added:
+  # rootless podman cannot map the render gid into the container namespace.
   # Models + data persist under /opt/comfyui. See ../docs/Dankclaw/ComfyUI.md.
   comfyui:
     build:
@@ -30,7 +32,6 @@ services:
       - /dev/dri:/dev/dri
     group_add:
       - video
-      - render
     volumes:
       - /opt/comfyui/models:/opt/ComfyUI/models
       - /opt/comfyui/input:/opt/ComfyUI/input
diff --git a/tests/comfyui_rocm.bats b/tests/comfyui_rocm.bats
index 62c3f7b..349537c 100644
--- a/tests/comfyui_rocm.bats
+++ b/tests/comfyui_rocm.bats
@@ -9,7 +9,8 @@
 #
 # STATUS (2026-08-19): the GPU migration is applied. The compose builds
 # comfyui-rocm:gfx1151 from Containerfile.comfyui (AMD's gfx1151 torch base),
-# passes /dev/kfd + /dev/dri, adds the video+render groups, and drops --cpu.
+# passes /dev/kfd + /dev/dri, adds the video group (render is unmappable in
+# rootless), and drops --cpu.
 # The four compose-wiring tests below are active (un-skipped). See
 # docs/Research/ComfyUI ROCm and Vulkan.md.
 
@@ -63,14 +64,19 @@ print("command OK:", cmd)
 PYEOF
 }
 
-@test "comfyui adds the video and render groups" {
+@test "comfyui adds the video group (render is unmappable in rootless)" {
     python3 - "$REPO_ROOT/dankclaw/compose.yaml" <<'PYEOF'
 import sys, yaml
 with open(sys.argv[1]) as fh:
     data = yaml.safe_load(fh)
 groups = data["services"]["comfyui"].get("group_add", [])
-for g in ("video", "render"):
-    assert g in groups, f"comfyui group_add must include {g}; got: {groups}"
+# 'video' is added (it resolves in the rootless namespace). 'render' (gid 990)
+# is intentionally ABSENT: rootless podman cannot map it into the container
+# namespace (the subgid range is 100000+), so --group-add render fails to start.
+# GPU access comes from the /dev/kfd + /dev/dri passthrough, checked host-side
+# (the run user is already a member of 'render' on the host).
+assert "video" in groups, f"comfyui group_add must include video; got: {groups}"
+assert "render" not in groups, f"comfyui group_add must NOT include render (unmappable in rootless); got: {groups}"
 print("groups OK:", groups)
 PYEOF
 }