diff --git a/.env.example b/.env.example
index 71a2be8..51cd867 100644
--- a/.env.example
+++ b/.env.example
@@ -87,3 +87,12 @@ OMNIROUTE_WS_BRIDGE_SECRET=
 # needs a dashboard login session, not a static bearer key (see issue #37).
 # Mint them by hand in the dashboard, add a KEY=value line here per workload
 # as you onboard one. See docs/proxy-key-onboarding.md.
+
+# --- ComfyUI (local image generation, see issue #38 wayfinder map) ---
+# yurisasc/comfyui-rocm7.1 manages GPU-group access via these GID/UID env
+# vars rather than relying solely on docker-compose.yml's group_add.
+# Resolved automatically from the host by ./scripts/update.sh — leave blank.
+COMFYUI_PUID=
+COMFYUI_PGID=
+COMFYUI_VIDEO_GID=
+COMFYUI_RENDER_GID=
diff --git a/docker-compose.yml b/docker-compose.yml
index 6650c9d..b84bbc3 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -60,6 +60,53 @@ services:
         curl -L --fail --create-dirs -o /models/${LLAMA_MODEL_FILE:-Qwen3.8-27B-UD-Q4_K_XL.gguf}
         https://huggingface.co/unsloth/Qwen3.8-27B-GGUF/resolve/main/${LLAMA_MODEL_FILE:-Qwen3.8-27B-UD-Q4_K_XL.gguf}
 
+  # Local image generation — see issue #38 (wayfinder map). yurisasc's image
+  # is gfx1201-tuned specifically (R9700's arch), unlike the official/AMD
+  # ComfyUI image which doesn't pin RDNA4 support — see
+  # docs/research/image-generation-options.md.
+  comfyui:
+    image: yurisasc/comfyui-rocm7.1:latest
+    container_name: comfyui
+    devices:
+      - /dev/kfd
+      - /dev/dri
+    group_add:
+      - video
+      - render
+    security_opt:
+      - seccomp=unconfined
+    ipc: host
+    environment:
+      - HSA_OVERRIDE_GFX_VERSION=12.0.1
+      - PYTORCH_ROCM_ARCH=gfx1201
+      # This image manages GPU-group access via GID env vars rather than
+      # relying solely on group_add above (its own README asks for both) —
+      # scripts/update.sh resolves these from the host, same pattern as
+      # SEARXNG_LAN_IP.
+      - PUID=${COMFYUI_PUID}
+      - PGID=${COMFYUI_PGID}
+      - VIDEO_GID=${COMFYUI_VIDEO_GID}
+      - RENDER_GID=${COMFYUI_RENDER_GID}
+      - BASE_STORAGE_PATH=/storage
+    volumes:
+      - comfyui-data:/storage
+    # ponytail: exact internal storage path taken from the image's own
+    # BASE_STORAGE_PATH env var, not independently confirmed against its
+    # Dockerfile — if models/workflows don't persist across a recreate,
+    # check this against the image's actual entrypoint first.
+    #
+    # Published host port (unlike llama-server's ai-stack-only pattern):
+    # ComfyUI's own UI is meant to be reachable directly too, for a planned
+    # external nginx reverse-proxy route to comfy.home — not just through
+    # OmniRoute. Still also reachable at http://comfyui:8188 internally on
+    # ai-stack, which is the URL to register as OmniRoute's comfyui
+    # provider (dashboard or POST /api/providers, per docs/proxy-key-onboarding.md
+    # — same undocumented-in-repo manual flow already used for llama-server).
+    ports:
+      - "8138:8188"
+    restart: unless-stopped
+    networks: [ai-stack]
+
   # Replaces litellm — see issue #31 (wayfinder map) for the full migration
   # rationale/findings. No static config.yaml equivalent: provider routing
   # (llama-server, searxng-search) is registered once through the dashboard
@@ -158,3 +205,4 @@ networks:
 volumes:
   models:
   omniroute-data:
+  comfyui-data:
diff --git a/scripts/update.sh b/scripts/update.sh
index 37d76f4..d1b051b 100755
--- a/scripts/update.sh
+++ b/scripts/update.sh
@@ -56,6 +56,24 @@ else
   echo "SEARXNG_LAN_IP: couldn't resolve search.home from this host, set it manually if still blank."
 fi
 
+echo "==> resolving ComfyUI host GID/UID"
+# yurisasc/comfyui-rocm7.1 wants these as env vars, not just group_add in
+# compose — resolve from this host, same pattern as SEARXNG_LAN_IP.
+set_if_blank COMFYUI_PUID "$(id -u)"
+set_if_blank COMFYUI_PGID "$(id -g)"
+video_gid="$(getent group video 2>/dev/null | cut -d: -f3)"
+render_gid="$(getent group render 2>/dev/null | cut -d: -f3)"
+if [ -n "$video_gid" ]; then
+  set_if_blank COMFYUI_VIDEO_GID "$video_gid"
+else
+  echo "COMFYUI_VIDEO_GID: no 'video' group on this host, set it manually if still blank."
+fi
+if [ -n "$render_gid" ]; then
+  set_if_blank COMFYUI_RENDER_GID "$render_gid"
+else
+  echo "COMFYUI_RENDER_GID: no 'render' group on this host, set it manually if still blank."
+fi
+
 echo "==> git pull"
 git pull --ff-only