diff --git a/apps/server/.env.example b/apps/server/.env.example
index edf31d1..ee1212a 100644
--- a/apps/server/.env.example
+++ b/apps/server/.env.example
@@ -82,6 +82,8 @@ WS_ALLOWED_ORIGINS=http://localhost:5173,tauri://localhost,http://tauri.localhos
 # Comma-separated ids of the modules this site is ENTITLED to (a vendor/deployment
 # decision — set in the Komodo stack env, never by a site role). The site admin then
 # ACTIVATES within this set in Setup → Site; effective = entitled ∩ activated. Unset or
-# blank = every registered module (parking,validation). Required modules (parking) are
-# always on. See wiki/decisions/venue-modules.md.
+# blank = every registered module (parking,validation,carwash) — a DEV convenience. In
+# Docker, docker-compose.yml forwards it with a default of parking,validation, so a booth
+# is never entitled to a module its Komodo stack env does not name. Required modules
+# (parking) are always on. See wiki/decisions/venue-modules.md.
 #MODULES_ENTITLED=parking,validation
diff --git a/docker-compose.yml b/docker-compose.yml
index a6d35ee..780a92e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -35,6 +35,12 @@ services:
       # The booth WS live feed checks the browser Origin — must list the address operators
       # actually hit (e.g. http://<booth-ip>:3000), or the live feed is rejected.
       WS_ALLOWED_ORIGINS: ${WS_ALLOWED_ORIGINS:-}
+      # Venue modules this site is ENTITLED to (vendor decision, per stack in Komodo; the site
+      # admin activates within this set in Setup → Site). Only variables listed HERE reach the
+      # container — a value in the Komodo stack env alone does nothing (found 2026-09-06: every
+      # booth had Car Wash on). Default = what booths had before modules existed; the server
+      # treats a BLANK value as "every module", so never set it to "" on a booth.
+      MODULES_ENTITLED: ${MODULES_ENTITLED:-parking,validation}
     volumes:
       - parking-data:/data
     depends_on:
diff --git a/wiki/decisions/venue-modules.md b/wiki/decisions/venue-modules.md
index da5ba04..eda53b1 100644
--- a/wiki/decisions/venue-modules.md
+++ b/wiki/decisions/venue-modules.md
@@ -348,6 +348,13 @@ at the two seams the design names, and the registry earned its keep: **one manif
 - **Modules reach the core only via `ServerModuleDeps`** (db, eventLog, payStation,
   shiftService) — no module imports another; `dependsOn: ["parking", "validation"]` is enforced
   by the activation rules (verified: carwash cannot be on with validation off).
+- **Deploy gotcha (2026-09-06):** `MODULES_ENTITLED` reaches the container ONLY through
+  `docker-compose.yml`'s `environment:` block — a value in the Komodo stack env alone is just
+  compose interpolation input. It was missing there, so every booth on `55d6242` had Car Wash
+  on (unset = everything). Fixed: compose forwards it with a default of `parking,validation`;
+  a booth is never entitled to a module its stack env does not name. Check on the box:
+  `docker exec <stack>-server-1 env | grep MODULES_ENTITLED` and the boot log line
+  `venue modules (entitled = …; effective = …)`.
 - **Web:** `/wash` (the desk: ticket lookup → category/service/price → order, the site's
   booth|bay policy shown read-only;
   the queue oldest-first with Done / Paid cash / Paid card / Void) and `/setup/carwash`
diff --git a/wiki/log.md b/wiki/log.md
index dae5a6e..b004e80 100644
--- a/wiki/log.md
+++ b/wiki/log.md
@@ -3029,3 +3029,13 @@ every `jwtVerify` resolves the user's CURRENT role from the DB (cached per user,
 `bumpPermsCache()`, which the user update/delete routes now call); a deleted user's session
 ends with 401 on its next request; the WS cookie path uses the same. Test: moved user creates
 an order on the next request with the same cookie. Recorded on [[local-jwt-auth]].
+
+## [2026-09-06] ingest | MODULES_ENTITLED never reached the container
+
+User set park-2 to `MODULES_ENTITLED=parking`, re-synced, destroyed + redeployed the stack —
+Lavazh still there. Cause: the variable was in the Komodo stack env and `.env.example` but not
+in `docker-compose.yml`'s server `environment:` block, so the container never saw it; unset =
+every module → every booth on 55d6242 had Car Wash entitled. Fix: compose forwards it with
+default `parking,validation`. Troubleshoot on a booth with `docker exec … env | grep MODULES`
+and the boot log line `venue modules (entitled = …; effective = …)`. Recorded on
+[[venue-modules]] §As-built (deploy gotcha).