diff --git a/install/management_compose.yaml b/install/management_compose.yaml
index b1b17d1..efa9725 100644
--- a/install/management_compose.yaml
+++ b/install/management_compose.yaml
@@ -52,7 +52,7 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock # Allows Dozzle to read logs from the Host's Docker daemon
     environment:
       - DOZZLE_ENABLE_ACTIONS=true # Enables the action buttons (restart, stop, etc.)
-      - DOZZLE_ENABLE_SHELL=true  # Enables web-based shell access
+      - DOZZLE_ENABLE_SHELL=false  # Disabled — shell access + Docker socket = privilege escalation
   mysql:
     image: mysql:8.0
     container_name: nomad_mysql