diff --git a/apps/kustomization.yaml b/apps/kustomization.yaml
index c4c126e..042a80b 100644
--- a/apps/kustomization.yaml
+++ b/apps/kustomization.yaml
@@ -21,10 +21,15 @@ resources:
   - nextcloud-db.yaml                      # CNPG PostgreSQL Cluster (ns nextcloud-db) — first CNPG-DB app
   - nextcloud-db-app.sops.yaml             # SOPS: CNPG owner credentials (basic-auth) for initdb
   - nextcloud-bootstrap-secret.sops.yaml   # SOPS: break-glass admin + mirrored db-password (ns nextcloud)
-  - semaphore.yaml
-  - semaphore-db.yaml                      # CNPG PostgreSQL Cluster (ns semaphore-db) — second CNPG-DB app
-  - semaphore-db-app.sops.yaml             # SOPS: CNPG owner credentials (basic-auth) for initdb
-  - semaphore-bootstrap-secret.sops.yaml   # SOPS: break-glass admin + mirrored db-password + access-key-encryption (ns semaphore)
+  # TEMP-DISABLED (WS-APPS follow-up): semaphore crashloops because the semaphoreui/semaphore image
+  # falls through to its INTERACTIVE setup wizard (env vars didn't yield a non-interactive config)
+  # and panics on `open /etc/semaphore/config.json: permission denied`. It needs a proper config
+  # model (a mounted config.json / the right entrypoint + non-root writable config dir), not the
+  # env-only pattern. Re-enable once fixed. Files retained: catalog/semaphore.yaml, apps/semaphore*.
+  # - semaphore.yaml
+  # - semaphore-db.yaml
+  # - semaphore-db-app.sops.yaml
+  # - semaphore-bootstrap-secret.sops.yaml
 # Gitea's headless-install env + break-glass admin postStart hook are now first-class in the
 # ServiceDefinition (catalog/gitea.yaml env/lifecycle, schema >=1.2.0) and rendered inline into
 # apps/gitea.yaml, so the former gitea-bootstrap-patch.yaml strategic-merge patch is retired.