diff --git a/bundles/llamacpp-vulkan-qwen36-35b-a3b/docker-compose.yml b/bundles/llamacpp-vulkan-qwen36-35b-a3b/docker-compose.yml
index 3284d7a46..c42605e2f 100644
--- a/bundles/llamacpp-vulkan-qwen36-35b-a3b/docker-compose.yml
+++ b/bundles/llamacpp-vulkan-qwen36-35b-a3b/docker-compose.yml
@@ -65,5 +65,8 @@ services:
     # that was running at shutdown. The two policies differ only for containers
     # that were deliberately stopped, which is exactly the window's case.
     restart: unless-stopped
-    ipc: host
+    # No ipc: host. llama-server is one process: weights load with --no-mmap into GPU
+    # memory through Vulkan, and nothing shares POSIX shared memory with another process,
+    # so the host IPC namespace buys nothing (the install security check refuses it
+    # without privileged consent). A private /dev/shm of shm_size is kept as headroom.
     shm_size: 16g
diff --git a/bundles/llamacpp-vulkan-qwen36-35b-a3b/manifest.json b/bundles/llamacpp-vulkan-qwen36-35b-a3b/manifest.json
index dd610aa6c..72f59b527 100644
--- a/bundles/llamacpp-vulkan-qwen36-35b-a3b/manifest.json
+++ b/bundles/llamacpp-vulkan-qwen36-35b-a3b/manifest.json
@@ -1,5 +1,6 @@
 {
   "id": "llamacpp-vulkan-qwen36-35b-a3b",
+  "version": "1.0.1",
   "type": "bundle",
   "name": "llama.cpp Qwen3.6-35B-A3B UD-Q6_K + Vision (Vulkan AMDVLK)",
   "category": "ai",
diff --git a/registry/add-ons.json b/registry/add-ons.json
index 064cf1f42..cd2679084 100644
--- a/registry/add-ons.json
+++ b/registry/add-ons.json
@@ -2701,6 +2701,7 @@
     },
     {
       "id": "llamacpp-vulkan-qwen36-35b-a3b",
+      "version": "1.0.1",
       "type": "bundle",
       "name": "llama.cpp Qwen3.6-35B-A3B UD-Q6_K + Vision (Vulkan AMDVLK)",
       "category": "ai",
diff --git a/tests/compose-guard.test.js b/tests/compose-guard.test.js
index c442340ea..fa2dcc483 100644
--- a/tests/compose-guard.test.js
+++ b/tests/compose-guard.test.js
@@ -684,3 +684,9 @@ test("no tracked bundle id ends in an owned-place suffix (so the suffix rule can
   const bad = [...trackedBundleSet()].filter((id) => G.OWN_SUFFIXES.some((x) => id.endsWith(x)));
   assert.deepEqual(bad, []);
 });
+
+test("the 35B model bundle no longer asks for the host IPC namespace", () => {
+  const compose = readFileSync(join(REPO, "bundles", "llamacpp-vulkan-qwen36-35b-a3b", "docker-compose.yml"), "utf8");
+  assert.doesNotMatch(compose.split("\n").filter((l) => !/^\s*#/.test(l)).join("\n"), /^\s*ipc:\s*host/m);
+  assert.match(compose, /^\s*shm_size:\s*16g/m);
+});