diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 79316e2..bb098be 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -47,11 +47,10 @@ services:
     # Listens on :3000 directly on the host (Caddy proxies it). Loopback to vision:
     environment:
       VISION_URL: http://127.0.0.1:8089
-    # Reader liveness ping (Dingtian/GEE QR push-only readers): on host net the server uses the
-    # HOST's net.ipv4.ping_group_range — ensure the host sets it (see appliance-provisioning).
-    # The container-level sysctl below is a no-op under host net but kept as documentation.
-    sysctls:
-      - net.ipv4.ping_group_range=0 2147483647
+    # NB: NO `sysctls:` here. net.ipv4.ping_group_range is a per-netns sysctl; under host net
+    # there is no separate namespace, and runc REFUSES it ("not allowed in host network
+    # namespace"). Reader liveness ping uses the HOST's setting instead — the booth host must
+    # set net.ipv4.ping_group_range (see appliance-provisioning §7 / disk-os-hardening).
     logging:
       driver: json-file
       options: