diff --git a/apodex/tests/test_deployment_config.py b/apodex/tests/test_deployment_config.py
index b412924..20aee3a 100644
--- a/apodex/tests/test_deployment_config.py
+++ b/apodex/tests/test_deployment_config.py
@@ -39,6 +39,7 @@ def test_default_compose_pulls_release_image_and_preserves_cli_state() -> None:
     assert agent["pull_policy"] == "always"
     assert agent["environment"]["APODEX_IN_CONTAINER"] == "1"
     assert agent["environment"]["SANDBOX_BACKEND"] == "container"
+    assert agent["environment"]["FRONTIER_AGENT_REQUIRE_TOOL_USER"] == "1"
     assert "security_opt" not in agent
     assert ".:/project" in agent["volumes"]
     assert agent["working_dir"] == "/project"
@@ -58,6 +59,10 @@ def test_default_compose_pulls_release_image_and_preserves_cli_state() -> None:
     )
     assert agent["environment"]["APODEX_WORKSPACE_LINK"] == "/workspace"
 
+    evaluator = compose["services"]["eval"]
+    assert evaluator["environment"]["SANDBOX_BACKEND"] == "bwrap"
+    assert evaluator["environment"]["SANDBOX_PROFILE"] == "service"
+
 
 def test_development_compose_is_the_only_compose_file_that_builds() -> None:
     compose = _yaml("compose.yaml")
diff --git a/compose.yaml b/compose.yaml
index d8b0644..b735eb8 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -9,6 +9,10 @@ services:
       APODEX_IN_CONTAINER: "1"
       HOME: /root
       SANDBOX_BACKEND: container
+      # A missing agent-tool account would expose the harness environment to
+      # model-authored commands through /proc.  Service deployments must stop
+      # instead of accepting the documented env-only degradation.
+      FRONTIER_AGENT_REQUIRE_TOOL_USER: "1"
       APODEX_LOCAL_UTC_OFFSET: ${APODEX_LOCAL_UTC_OFFSET:-+0000}
       FRONTIER_AGENT_WORKSPACE_DIR: /workspace
       APODEX_SESSION_WORKSPACES_ROOT: /apodex-runs
@@ -51,6 +55,9 @@ services:
       # The eval runner can execute multiple isolated benchmark tasks in one
       # harness container, so it retains the nested bubblewrap backend.
       SANDBOX_BACKEND: bwrap
+      # Multi-task workers need a private PID namespace and fresh procfs.  The
+      # service profile fails closed when the runtime cannot provide them.
+      SANDBOX_PROFILE: service
       APODEX_HOST_UID: ${APODEX_HOST_UID:-}
       APODEX_HOST_GID: ${APODEX_HOST_GID:-}
     volumes: