diff --git a/apps/hq/.env.example b/apps/hq/.env.example
index 6636ba9..125070a 100644
--- a/apps/hq/.env.example
+++ b/apps/hq/.env.example
@@ -8,6 +8,10 @@
 HQ_DATA_DIR=/var/lib/sims-hq/data
 # Port the console listens on (default 5182).
 HQ_PORT=5182
+# First-boot owner login (created once, on an empty DB). Set this to the REAL owner's
+# email so the first employee is them; leave unset and it falls back to owner@sims.local.
+# All other staff are created afterwards in the owner-only Employees page.
+HQ_OWNER_EMAIL=
 
 # --- Security (set BEFORE first real login) ---
 # Server-held pepper mixed into every password/PIN hash. Without it, a stolen DB
@@ -30,5 +34,7 @@ GOOGLE_CLIENT_SECRET=
 AWS_ACCESS_KEY_ID=
 AWS_SECRET_ACCESS_KEY=
 
-# --- Postgres (go-live; not yet wired — see docs/DEPLOY-HQ.md) ---
-# HQ_PG_URL=postgres://hq:PASSWORD@your-rds-endpoint:5432/hq
+# --- Postgres (go-live; D19 delivered — see docs/DEPLOY-HQ.md §7) ---
+# When set, the app runs on Postgres; unset → SQLite at HQ_DATA_DIR. Read by server.ts.
+# The var name is DATABASE_URL (NOT HQ_PG_URL — the app ignores that).
+# DATABASE_URL=postgres://hq:PASSWORD@your-rds-endpoint:5432/hq
diff --git a/apps/hq/src/pdf.ts b/apps/hq/src/pdf.ts
index 0692227..5f210a6 100644
--- a/apps/hq/src/pdf.ts
+++ b/apps/hq/src/pdf.ts
@@ -9,7 +9,11 @@ import puppeteer, { type Browser } from 'puppeteer'
 let browserPromise: Promise<Browser> | null = null
 
 function getBrowser(): Promise<Browser> {
-  browserPromise ??= puppeteer.launch()
+  // --no-sandbox + --disable-dev-shm-usage let Chromium launch inside a container
+  // (root user, small /dev/shm); both are inert on a normal dev machine. We only ever
+  // render our own self-contained letterhead HTML (no external fetches), so dropping
+  // the sandbox here is not exposing us to third-party page content.
+  browserPromise ??= puppeteer.launch({ args: ['--no-sandbox', '--disable-dev-shm-usage'] })
   return browserPromise
 }