diff --git a/docker-compose.yml b/docker-compose.yml
index 24a383f..3f144ac 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -73,6 +73,14 @@ services:
       EXEC: 1
       VERSION: 1
       POST: 1
+      # Restart (stop/restart/kill on an *existing* container) only --
+      # create/prune stay denied by the haproxy template's own explicit
+      # deny-list regardless of POST, and start/stop stay off (ALLOW_START/
+      # ALLOW_STOP unset) since nothing needs them yet. This comment block's
+      # own claim of "restart" capability (above) was aspirational until
+      # this line existed -- appliance#43's Diagnostics recovery actions are
+      # the first real caller.
+      ALLOW_RESTARTS: 1
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - ./docker-socket-proxy/haproxy.cfg.template:/usr/local/etc/haproxy/haproxy.cfg.template:ro