diff --git a/apps/zigbee2mqtt/docker-compose.yaml b/apps/zigbee2mqtt/docker-compose.yaml
index 5bf2e6f..04ea784 100644
--- a/apps/zigbee2mqtt/docker-compose.yaml
+++ b/apps/zigbee2mqtt/docker-compose.yaml
@@ -16,9 +16,18 @@
 # the validator rejects non-directories and the /dev deny-list). The `devices`
 # entry maps that host device into the container. The `:-/dev/null` fallback is
 # ONLY so `docker compose config` (catalog validation, run with no .env) parses
-# cleanly; a real install always has the device set. On a box with no stick
-# attached the container won't fully come up — it still connects to MQTT first,
-# which is enough to confirm the dependency/credential handshake.
+# cleanly; a real install always has the device set. zigbee-herdsman opens the
+# serial adapter BEFORE connecting to MQTT, so on a box with no stick attached
+# the container exits early and never reaches the broker — the dependency
+# handshake is verified provider-side instead (the account + creds land in this
+# app's .env at install time).
+#
+# Frontend: z2m 1.42's default config is `frontend: true` (boolean shorthand,
+# enabled on port 8080). We deliberately set NO ZIGBEE2MQTT_CONFIG_FRONTEND_*
+# env here: a nested override like FRONTEND_PORT/FRONTEND_ENABLED makes z2m try
+# to write a property onto that boolean and crash on boot with
+# "Cannot create property 'port' on boolean 'true'". The default 8080 is what we
+# publish to the host as 8084 below, so no override is needed.
 #
 # Port 8084 on the host -> 8080 in the container (8080 is taken by it-tools).
 #
@@ -36,8 +45,6 @@ services:
       - ZIGBEE2MQTT_CONFIG_MQTT_USER=${MQTT_USER}
       - ZIGBEE2MQTT_CONFIG_MQTT_PASSWORD=${MQTT_PASS}
       - ZIGBEE2MQTT_CONFIG_SERIAL_PORT=${ZIGBEE_SERIAL_PORT}
-      - ZIGBEE2MQTT_CONFIG_FRONTEND_ENABLED=true
-      - ZIGBEE2MQTT_CONFIG_FRONTEND_PORT=8080
     devices:
       - ${ZIGBEE_SERIAL_PORT:-/dev/null}:${ZIGBEE_SERIAL_PORT:-/dev/null}
     extra_hosts: