diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 295ee3f..695ed0b 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -23,10 +23,7 @@ jobs:
       - name: Pull and apply compose
         run: |
           $COMPOSE pull
-          # Exclude github-runner from up -d — recreating the container that
-          # is running this job would kill the workflow mid-step.
-          SERVICES=$($COMPOSE config --services | grep -v '^github-runner$' | tr '\n' ' ')
-          $COMPOSE up -d $SERVICES
+          $COMPOSE up -d
 
       - name: Reload Caddyfile
         run: |
diff --git a/docker-compose.yml b/docker-compose.yml
index dac3ddc..fae3e08 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -595,22 +595,6 @@ services:
       - /config/homarr/icons:/app/public/icons
       - /config/homarr/data:/data
 
-  github-runner:
-    container_name: github_runner
-    image: myoung34/github-runner:latest
-    restart: unless-stopped
-    environment:
-      - ACCESS_TOKEN=${GITHUB_RUNNER_ACCESS_TOKEN}
-      - REPO_URL=https://github.com/ginnoir/homelabstack
-      - RUNNER_NAME=valhalla
-      - RUNNER_LABELS=self-hosted,Linux,x64
-      - RUNNER_SCOPE=repo
-      - DOCKER_GROUP_GID=1001
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - /home/ginnoir/valhalla-lab:/valhalla-lab
-      - /config/caddy:/config/caddy
-
   # ============================================================
   # UTILITIES
   # ============================================================
diff --git a/portainer-compose.yml b/portainer-compose.yml
index 5e836e2..1d31f5b 100644
--- a/portainer-compose.yml
+++ b/portainer-compose.yml
@@ -1,14 +1,12 @@
-# Portainer is managed by this separate compose file so it owns the
-# portainer_proxy network. The main docker-compose.yml references it
-# as external: true. Bring this up BEFORE the main stack on fresh installs.
+# Management-plane services: portainer, github-runner, watchtower.
+# These manage the application stack rather than being part of it.
 #
-# On the server: ~/valhalla-lab/portainer-compose.yml
+# This file also owns the portainer_proxy network that the main
+# docker-compose.yml references as external: true.
 #
-# Migration from standalone container:
-#   docker stop portainer && docker rm portainer
-#   docker network rm portainer_proxy      # remove orphaned standalone network
-#   docker compose -f portainer-compose.yml up -d
-#   dc up -d                               # reconnects caddy to new network
+# Fresh-install order:
+#   docker compose -f portainer-compose.yml up -d   # network + mgmt plane first
+#   dc up -d                                         # application stack second
 
 services:
   portainer:
@@ -22,6 +20,39 @@ services:
       - /config/portainer:/data
     ports:
       - "9100:9000"
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
+
+  github-runner:
+    container_name: github_runner
+    image: myoung34/github-runner:latest
+    restart: unless-stopped
+    environment:
+      - ACCESS_TOKEN=${GITHUB_RUNNER_ACCESS_TOKEN}
+      - REPO_URL=https://github.com/ginnoir/homelabstack
+      - RUNNER_NAME=valhalla
+      - RUNNER_LABELS=self-hosted,Linux,x64
+      - RUNNER_SCOPE=repo
+      - DOCKER_GROUP_GID=1001
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /home/ginnoir/valhalla-lab:/valhalla-lab
+      - /config/caddy:/config/caddy
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
+
+  watchtower:
+    container_name: watchtower
+    image: containrrr/watchtower:latest
+    restart: unless-stopped
+    environment:
+      - DOCKER_API_VERSION=1.40
+      - WATCHTOWER_NOTIFICATION_SKIP_TITLE=true
+      - WATCHTOWER_NOTIFICATION_URL=ntfy://ntfy.ginnoir.com/watchtower?title=WatchtowerUpdates
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
 
 networks:
   portainer_proxy: