diff --git a/src/main/java/net/siegeln/cameleer/saas/provisioning/DockerTenantProvisioner.java b/src/main/java/net/siegeln/cameleer/saas/provisioning/DockerTenantProvisioner.java
index 96f246d..0f50bf2 100644
--- a/src/main/java/net/siegeln/cameleer/saas/provisioning/DockerTenantProvisioner.java
+++ b/src/main/java/net/siegeln/cameleer/saas/provisioning/DockerTenantProvisioner.java
@@ -211,7 +211,8 @@ public class DockerTenantProvisioner implements TenantProvisioner {
             "CAMELEER_SERVER_RUNTIME_JARSTORAGEPATH=/data/jars",
             // Apps deployed by this server join the tenant network (isolated)
             "CAMELEER_SERVER_RUNTIME_DOCKERNETWORK=" + tenantNetwork,
-            "CAMELEER_SERVER_RUNTIME_JARDOCKERVOLUME=cameleer-jars-" + slug
+            "CAMELEER_SERVER_RUNTIME_JARDOCKERVOLUME=cameleer-jars-" + slug,
+            "CAMELEER_SERVER_SECURITY_INFRASTRUCTUREENDPOINTS=false"
         ));
         // If no CA bundle exists, fall back to TLS skip for OIDC (self-signed dev)
         if (!java.nio.file.Files.exists(java.nio.file.Path.of("/certs/ca.pem"))) {