diff --git a/.env.example b/.env.example
index 9e46d17..2d322df 100644
--- a/.env.example
+++ b/.env.example
@@ -101,12 +101,6 @@ OMNIROUTE_WS_BRIDGE_SECRET=
 # as you onboard one. See docs/proxy-key-onboarding.md.
 
 # --- ComfyUI (local image generation, see issue #38 wayfinder map) ---
-# yurisasc/comfyui-rocm7.1 manages GPU-group access via these GID/UID env
-# vars rather than relying solely on docker-compose.yml's group_add.
-# Resolved automatically from the host by ./scripts/update.sh — leave blank.
-COMFYUI_PUID=
-COMFYUI_PGID=
-
 # Shared by every GPU-touching service (llama-server, llama-server-fast,
 # comfyui) for group_add: — resolved to real host GIDs by ./scripts/update.sh
 # rather than left as plain group names in docker-compose.yml, because Docker
diff --git a/docker-compose.yml b/docker-compose.yml
index 90a60c4..42b09f6 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -233,21 +233,23 @@ services:
     environment:
       - HSA_OVERRIDE_GFX_VERSION=12.0.1
       - PYTORCH_ROCM_ARCH=gfx1201
-      # This image also wants GID env vars directly (its own README asks
-      # for both these and group_add above) — same HOST_VIDEO_GID/
-      # HOST_RENDER_GID resolved by scripts/update.sh, shared with
-      # llama-server now instead of comfyui-only vars.
-      - PUID=${COMFYUI_PUID}
-      - PGID=${COMFYUI_PGID}
-      - VIDEO_GID=${HOST_VIDEO_GID}
-      - RENDER_GID=${HOST_RENDER_GID}
-      - BASE_STORAGE_PATH=/storage
     volumes:
       - comfyui-data:/storage
-    # ponytail: exact internal storage path taken from the image's own
-    # BASE_STORAGE_PATH env var, not independently confirmed against its
-    # Dockerfile — if models/workflows don't persist across a recreate,
-    # check this against the image's actual entrypoint first.
+    # yurisasc/comfyui-rocm7.1 has no entrypoint/CMD of its own (just drops
+    # into bash) and doesn't read PUID/PGID/VIDEO_GID/RENDER_GID or
+    # BASE_STORAGE_PATH — confirmed by inspecting the image directly, so
+    # this command is required, not optional, or the container exits 0
+    # immediately and restart-loops. Runs as root (image's only user);
+    # group_add above is what actually grants /dev/kfd + /dev/dri access.
+    command:
+      - python
+      - main.py
+      - --listen
+      - "0.0.0.0"
+      - --port
+      - "8188"
+      - --base-directory
+      - /storage
     #
     # Published host port (unlike llama-server's ai-stack-only pattern):
     # ComfyUI's own UI is meant to be reachable directly too, for a planned
diff --git a/scripts/update.sh b/scripts/update.sh
index 91b0b4d..328b54c 100755
--- a/scripts/update.sh
+++ b/scripts/update.sh
@@ -13,7 +13,7 @@
 # CI, piped), any conflict is a hard error unless --force is passed, which
 # accepts every new value automatically. Secrets and host-resolved values
 # (blank in .env.example — OMNIROUTE_*_SECRET/_KEY/_SALT/_PASSWORD,
-# SEARXNG_LAN_IP, COMFYUI_PUID/PGID, HOST_VIDEO_GID/RENDER_GID) are never
+# SEARXNG_LAN_IP, HOST_VIDEO_GID/RENDER_GID) are never
 # touched by this — they keep going through set_if_blank as before.
 #
 # omniroute's own routing/provider config (llama-server, search) lives in
@@ -196,12 +196,6 @@ else
   echo "SEARXNG_LAN_IP: couldn't resolve search.home from this host, set it manually if still blank."
 fi
 
-echo "==> resolving ComfyUI host UID"
-# yurisasc/comfyui-rocm7.1 wants these as env vars, not just group_add in
-# compose — resolve from this host, same pattern as SEARXNG_LAN_IP.
-set_if_blank COMFYUI_PUID "$(id -u)"
-set_if_blank COMFYUI_PGID "$(id -g)"
-
 echo "==> resolving host video/render GIDs (shared by every GPU service)"
 # Numeric GIDs, not names, in docker-compose.yml's group_add: — Docker
 # resolves a *named* group_add entry against the container's own /etc/group,