diff --git a/Makefile b/Makefile
index 7b62b9c..1f17e46 100644
--- a/Makefile
+++ b/Makefile
@@ -51,14 +51,14 @@ ci-desktop: ## CI: cargo-check for @openconcho/desktop
 smoke-docker: ## Local: build the image + smoke-test the /api proxy (Docker required)
 	bash docker/smoke-test.sh
 
-up: ## Run the web container from source (dev-forward, builds) at :8080
-	docker compose up -d --build
+up: ## Run the web container from source (dev profile, builds) at :8080
+	docker compose --profile dev up -d --build
 
-prod: ## Run the web container from the published image (pulls ghcr latest)
-	docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
+prod: ## Run the web container from the published image (prod profile, pulls latest)
+	docker compose --profile prod up -d
 
-down: ## Stop + remove the web container (works for dev or prod)
-	docker compose down --remove-orphans
+down: ## Stop + remove the web container (either profile)
+	docker compose --profile dev --profile prod down --remove-orphans
 
 clean: down ## down + remove the locally built image
 	-docker image rm openconcho-web:local
diff --git a/README.md b/README.md
index c06d81a..3b14bac 100644
--- a/README.md
+++ b/README.md
@@ -107,9 +107,9 @@ make clean   # down + drop the locally built image
 # → http://localhost:8080
 ```
 
-`make up` uses [`docker-compose.yml`](docker-compose.yml) (`build: .`);
-`make prod` layers [`docker-compose.prod.yml`](docker-compose.prod.yml)
-to pull `ghcr…:latest`. `OPENCONCHO_DEFAULT_HONCHO_URL` seeds the first instance
+Both modes live in one [`docker-compose.yml`](docker-compose.yml) as Compose
+profiles: `make up` runs the `dev` profile (`build: .`), `make prod` runs the
+`prod` profile (pulls `ghcr…:latest`). `OPENCONCHO_DEFAULT_HONCHO_URL` seeds the first instance
 (absolute URL); `OPENCONCHO_UPSTREAM_ALLOWLIST` is an optional SSRF guard
 (comma-separated host globs) for when you expose the proxy. Full details and env
 vars are in [`docs/docker.md`](docs/docker.md).
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
deleted file mode 100644
index 4ddd153..0000000
--- a/docker-compose.prod.yml
+++ /dev/null
@@ -1,11 +0,0 @@
-# Production override — pull the published image instead of building from source.
-# Layer it on top of docker-compose.yml; it reuses every setting there (env, ports,
-# extra_hosts) and only swaps the local build for the latest published image.
-#
-#   make prod
-#   docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
-services:
-  openconcho:
-    build: !reset null
-    image: ghcr.io/offendingcommit/openconcho-web:latest
-    pull_policy: always
diff --git a/docker-compose.yml b/docker-compose.yml
index 786c38e..34b0e40 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,8 +1,8 @@
-# OpenConcho web UI — DEV-FORWARD compose (builds from THIS repo).
+# OpenConcho web UI — one file, two Compose profiles (dev builds, prod pulls).
 #
-#   make up      # build from source + run               → http://localhost:8080
-#   make prod    # pull the published image instead (see docker-compose.prod.yml)
-#   make down    # stop + remove (dev or prod)
+#   make up      # profile dev:  build from THIS repo + run     → http://localhost:8080
+#   make prod    # profile prod: pull ghcr…:latest instead of building
+#   make down    # stop + remove (either profile)
 #   make clean   # down + drop the locally built image
 #
 # The SPA issues all Honcho calls same-origin to /api; nginx forwards each to the
@@ -11,25 +11,38 @@
 #
 #   OPENCONCHO_DEFAULT_HONCHO_URL=https://honcho.example.net make up
 #
-# To fold into an existing Honcho Compose stack, set OPENCONCHO_DEFAULT_HONCHO_URL
-# to the api service (e.g. http://api:8000 — nginx resolves it on the compose
-# network) and add `depends_on: { api: { condition: service_healthy } }`.
+# To fold into an existing Honcho Compose stack, point the seed at the api service
+# (e.g. http://api:8000 — nginx resolves it on the compose network).
+
+# Shared config (defined once); both profiles reference it via a YAML merge.
+x-openconcho: &openconcho
+  environment:
+    # Absolute URL seeding the first instance; the browser sends it as the
+    # X-Honcho-Upstream header and nginx forwards there (no browser CORS).
+    OPENCONCHO_DEFAULT_HONCHO_URL: ${OPENCONCHO_DEFAULT_HONCHO_URL:-http://host.docker.internal:8000}
+    # Optional SSRF guard. Unset = forward anywhere (safe for the localhost-only
+    # binding below). Set comma-separated host globs before exposing the proxy:
+    #   OPENCONCHO_UPSTREAM_ALLOWLIST: honcho.example.net,*.honcho.dev
+    OPENCONCHO_UPSTREAM_ALLOWLIST: ${OPENCONCHO_UPSTREAM_ALLOWLIST:-}
+  ports:
+    - "127.0.0.1:8080:8080"
+  # Lets the default host.docker.internal upstream resolve on Linux too
+  # (Docker Desktop / Colima provide it automatically).
+  extra_hosts:
+    - "host.docker.internal:host-gateway"
+  restart: unless-stopped
+
 services:
+  # Dev-forward — builds from source so you run your local changes (`make up`).
   openconcho:
+    <<: *openconcho
+    profiles: ["dev"]
     build: .
     image: openconcho-web:local
-    environment:
-      # Absolute URL seeding the first instance; the browser sends it as the
-      # X-Honcho-Upstream header and nginx forwards there (no browser CORS).
-      OPENCONCHO_DEFAULT_HONCHO_URL: ${OPENCONCHO_DEFAULT_HONCHO_URL:-http://host.docker.internal:8000}
-      # Optional SSRF guard. Unset = forward anywhere (safe for the localhost-only
-      # binding below). Set comma-separated host globs before exposing the proxy:
-      #   OPENCONCHO_UPSTREAM_ALLOWLIST: honcho.example.net,*.honcho.dev
-      OPENCONCHO_UPSTREAM_ALLOWLIST: ${OPENCONCHO_UPSTREAM_ALLOWLIST:-}
-    ports:
-      - "127.0.0.1:8080:8080"
-    # Lets the default host.docker.internal upstream resolve on Linux too
-    # (Docker Desktop / Colima provide it automatically).
-    extra_hosts:
-      - "host.docker.internal:host-gateway"
-    restart: unless-stopped
+
+  # Production — pulls the published image instead of building (`make prod`).
+  openconcho-prod:
+    <<: *openconcho
+    profiles: ["prod"]
+    image: ghcr.io/offendingcommit/openconcho-web:latest
+    pull_policy: always
diff --git a/docs/docker.md b/docs/docker.md
index 9f8f245..be31dd3 100644
--- a/docs/docker.md
+++ b/docs/docker.md
@@ -15,24 +15,26 @@ applies**; the nginx→Honcho hop is server-side, where CORS is irrelevant. The
 frontend stays the source of truth for which instance to talk to, so the
 multi-instance switcher and the Fleet view keep working.
 
-## Compose: dev-forward vs prod
+## Compose: dev vs prod profiles
 
-Two Compose files, env/ports defined once in the base:
+One [`docker-compose.yml`](../docker-compose.yml) with two profiles; the shared
+config (env, ports, extra_hosts) is defined once via a YAML anchor:
 
-- **`docker-compose.yml`** — dev-forward: `build: .`, so it runs **your local source**.
-- **`docker-compose.prod.yml`** — override that swaps the build for the **published
-  image** (`ghcr.io/offendingcommit/openconcho-web:latest`, `pull_policy: always`).
+- **`dev` profile** — `build: .`, runs **your local source** (`make up`).
+- **`prod` profile** — pulls the **published image**
+  (`ghcr.io/offendingcommit/openconcho-web:latest`, `pull_policy: always`) (`make prod`).
 
 ```bash
 make up      # build from source + run                → http://localhost:8080
 make prod    # pull ghcr…:latest instead of building
-make down    # stop + remove (dev or prod)
+make down    # stop + remove (either profile)
 make clean   # down + drop the locally built image
 ```
 
-`make prod` expands to
-`docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d`. Set env
-inline or via a `.env` file:
+`make up` expands to `docker compose --profile dev up -d --build` and `make prod`
+to `docker compose --profile prod up -d`. A bare `docker compose up` (no profile)
+starts nothing — use the make targets or pass `--profile`. Set env inline or via a
+`.env` file:
 
 ```bash
 OPENCONCHO_DEFAULT_HONCHO_URL=https://honcho.example.net make prod