diff --git a/containers/adguard/adguard.config b/containers/adguard/adguard.config
index 85c442c..938d987 100755
--- a/containers/adguard/adguard.config
+++ b/containers/adguard/adguard.config
@@ -18,7 +18,8 @@ CFG_ADGUARD_APP_NAME=adguard
 # (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
 # apps whose compose identity (container_name, Traefik routers, backup labels)
 # is instance-safe — see scripts/instance/instance_create.sh.
-CFG_ADGUARD_MULTI_INSTANCE=true
+# Not instanced by design. A DNS server is what clients point at; a second copy on a different port resolves for nobody. One-per-host in practice, like pihole and unbound.
+CFG_ADGUARD_MULTI_INSTANCE=false
 CFG_ADGUARD_BACKUP=true
 CFG_ADGUARD_BACKUP_STRATEGY=auto
 CFG_ADGUARD_UPDATE_TYPE=auto
diff --git a/containers/authelia/authelia.config b/containers/authelia/authelia.config
index cd09ba9..94f025c 100755
--- a/containers/authelia/authelia.config
+++ b/containers/authelia/authelia.config
@@ -20,7 +20,8 @@ CFG_AUTHELIA_APP_NAME=authelia
 # (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
 # apps whose compose identity (container_name, Traefik routers, backup labels)
 # is instance-safe — see scripts/instance/instance_create.sh.
-CFG_AUTHELIA_MULTI_INSTANCE=true
+# Not instanced by design. The forward-auth provider every other app's Traefik router points at. Two would mean two session realms with no clear owner.
+CFG_AUTHELIA_MULTI_INSTANCE=false
 CFG_AUTHELIA_REQUIRES="domain,traefik"
 CFG_AUTHELIA_BACKUP=true
 CFG_AUTHELIA_BACKUP_STRATEGY=auto
diff --git a/containers/crowdsec/crowdsec.config b/containers/crowdsec/crowdsec.config
index e8c643b..8e50df5 100644
--- a/containers/crowdsec/crowdsec.config
+++ b/containers/crowdsec/crowdsec.config
@@ -17,7 +17,11 @@ CFG_CROWDSEC_APP_NAME=crowdsec
 # (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
 # apps whose compose identity (container_name, Traefik routers, backup labels)
 # is instance-safe — see scripts/instance/instance_create.sh.
-CFG_CROWDSEC_MULTI_INSTANCE=true
+# Not instanced by design. CrowdSec ships no docker-compose.yml at all — it is a
+# host-level security agent plus Traefik bouncer, not a composed app, so there is
+# no service identity for `instance create` to clone. It is also a singleton by
+# nature: one decision engine watching the whole box is the point.
+CFG_CROWDSEC_MULTI_INSTANCE=false
 CFG_CROWDSEC_HOST_INSTALL=true
 CFG_CROWDSEC_HOST_PACKAGE=crowdsec
 CFG_CROWDSEC_HOST_SERVICES=crowdsec.service,crowdsec-firewall-bouncer.service
diff --git a/containers/gluetun/gluetun.config b/containers/gluetun/gluetun.config
index 64a2f35..bd53289 100644
--- a/containers/gluetun/gluetun.config
+++ b/containers/gluetun/gluetun.config
@@ -16,7 +16,8 @@ CFG_GLUETUN_APP_NAME=gluetun
 # (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
 # apps whose compose identity (container_name, Traefik routers, backup labels)
 # is instance-safe — see scripts/instance/instance_create.sh.
-CFG_GLUETUN_MULTI_INSTANCE=true
+# Not instanced by design. A network provider, not a destination: other apps join it with network_mode "container:gluetun-service". A second copy leaves that name ambiguous.
+CFG_GLUETUN_MULTI_INSTANCE=false
 CFG_GLUETUN_BACKUP=true
 CFG_GLUETUN_BACKUP_STRATEGY=auto
 CFG_GLUETUN_UPDATE_TYPE=auto
diff --git a/containers/headscale/headscale.config b/containers/headscale/headscale.config
index fcbcc5a..8b3133d 100755
--- a/containers/headscale/headscale.config
+++ b/containers/headscale/headscale.config
@@ -15,7 +15,8 @@ CFG_HEADSCALE_APP_NAME=headscale
 # (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
 # apps whose compose identity (container_name, Traefik routers, backup labels)
 # is instance-safe — see scripts/instance/instance_create.sh.
-CFG_HEADSCALE_MULTI_INSTANCE=true
+# Not instanced by design. The control server a tailnet is defined by — nodes register against exactly one.
+CFG_HEADSCALE_MULTI_INSTANCE=false
 CFG_HEADSCALE_BACKUP=true
 CFG_HEADSCALE_BACKUP_STRATEGY=auto
 CFG_HEADSCALE_UPDATE_TYPE=auto
diff --git a/containers/libreportal_catalog/libreportal_catalog.config b/containers/libreportal_catalog/libreportal_catalog.config
index 9ee03d9..a3a2d0a 100644
--- a/containers/libreportal_catalog/libreportal_catalog.config
+++ b/containers/libreportal_catalog/libreportal_catalog.config
@@ -16,7 +16,8 @@ CFG_LIBREPORTAL_CATALOG_APP_NAME=libreportal_catalog
 # (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
 # apps whose compose identity (container_name, Traefik routers, backup labels)
 # is instance-safe — see scripts/instance/instance_create.sh.
-CFG_LIBREPORTAL_CATALOG_MULTI_INSTANCE=true
+# Not instanced by design. LibrePortal's own catalog service. Internal plumbing, one per install.
+CFG_LIBREPORTAL_CATALOG_MULTI_INSTANCE=false
 CFG_LIBREPORTAL_CATALOG_BACKUP=true
 CFG_LIBREPORTAL_CATALOG_BACKUP_STRATEGY=auto
 CFG_LIBREPORTAL_CATALOG_UPDATE_TYPE=auto
diff --git a/containers/ollama/ollama.config b/containers/ollama/ollama.config
index d4d6888..744126d 100755
--- a/containers/ollama/ollama.config
+++ b/containers/ollama/ollama.config
@@ -16,7 +16,8 @@ CFG_OLLAMA_APP_NAME=ollama
 # (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
 # apps whose compose identity (container_name, Traefik routers, backup labels)
 # is instance-safe — see scripts/instance/instance_create.sh.
-CFG_OLLAMA_MULTI_INSTANCE=true
+# Not instanced by design. Clients are configured against one endpoint, and each copy duplicates multi-gigabyte model storage for no routing benefit.
+CFG_OLLAMA_MULTI_INSTANCE=false
 CFG_OLLAMA_BACKUP=true
 CFG_OLLAMA_BACKUP_STRATEGY=auto
 CFG_OLLAMA_UPDATE_TYPE=auto
diff --git a/containers/trivy/trivy.config b/containers/trivy/trivy.config
index 1b1bf85..274b790 100644
--- a/containers/trivy/trivy.config
+++ b/containers/trivy/trivy.config
@@ -15,7 +15,8 @@ CFG_TRIVY_APP_NAME=trivy
 # (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
 # apps whose compose identity (container_name, Traefik routers, backup labels)
 # is instance-safe — see scripts/instance/instance_create.sh.
-CFG_TRIVY_MULTI_INSTANCE=true
+# Not instanced by design. The updater resolves the scanner by the fixed container name trivy-service (see containers/trivy/scripts/trivy_scan.sh). A second copy would run but never be the one CVE scanning uses.
+CFG_TRIVY_MULTI_INSTANCE=false
 CFG_TRIVY_BACKUP=false
 CFG_TRIVY_BACKUP_STRATEGY=auto
 CFG_TRIVY_UPDATE_TYPE=auto
diff --git a/containers/wireguard/wireguard.config b/containers/wireguard/wireguard.config
index fcb7c45..8d95f11 100755
--- a/containers/wireguard/wireguard.config
+++ b/containers/wireguard/wireguard.config
@@ -16,7 +16,8 @@ CFG_WIREGUARD_APP_NAME=wireguard
 # (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
 # apps whose compose identity (container_name, Traefik routers, backup labels)
 # is instance-safe — see scripts/instance/instance_create.sh.
-CFG_WIREGUARD_MULTI_INSTANCE=true
+# Not instanced by design. A VPN server needs one stable published UDP endpoint; peer configs are tied to it.
+CFG_WIREGUARD_MULTI_INSTANCE=false
 CFG_WIREGUARD_SUBNET=
 CFG_WIREGUARD_BACKUP=true
 CFG_WIREGUARD_BACKUP_STRATEGY=auto