diff --git a/DEPLOY.md b/DEPLOY.md
index b37bdc3..abf10bb 100644
--- a/DEPLOY.md
+++ b/DEPLOY.md
@@ -222,10 +222,12 @@ ufw allow 7881/tcp          # WebRTC-over-TCP fallback for restrictive networks
 If the VPS is behind NAT and LiveKit can't auto-detect its public IP, set `rtc.node_ip` in
 `livekit.yaml` to `118.95.33.89` and redeploy.
 
-**5. Deploy** (starts the livekit container alongside the app):
+**5. Deploy** (the livekit service is behind a `sfu` compose profile, so it stays dormant on a
+normal deploy — start it explicitly):
 ```bash
-cd /opt/bizgaze-support && ./deploy.sh
-docker compose ps            # expect both bizgaze-support AND bizgaze-livekit "Up"
+cd /opt/bizgaze-support && ./deploy.sh                 # rebuilds/starts the app as usual
+docker compose --profile sfu up -d                     # additionally starts the livekit container
+docker compose ps                                      # expect both bizgaze-support AND bizgaze-livekit "Up"
 ```
 
 **6. Verify**:
diff --git a/docker-compose.yml b/docker-compose.yml
index 633a385..92a70a2 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -33,6 +33,9 @@ services:
     image: livekit/livekit-server:v1.7
     container_name: bizgaze-livekit
     restart: unless-stopped
+    # Dormant by default: a normal `docker compose up -d` / deploy.sh does NOT start it. Enable SFU
+    # explicitly with `docker compose --profile sfu up -d` after setting the LIVEKIT_* vars (see DEPLOY.md).
+    profiles: ["sfu"]
     command: --config /etc/livekit.yaml
     environment:
       # key: secret, sourced from the same .env as the app so both sign/verify with the same secret.