diff --git a/blueprints/posthog/docker-compose.yml b/blueprints/posthog/docker-compose.yml
index b5addc40..eb8f660c 100644
--- a/blueprints/posthog/docker-compose.yml
+++ b/blueprints/posthog/docker-compose.yml
@@ -334,6 +334,11 @@ services:
       init-assets:
         condition: service_completed_successfully
     environment:
+      # Run only the pipelines this template ships (CDP destinations/workflows,
+      # realtime cohorts, feature-flag evaluation). The default mode would also
+      # start the logs/error-tracking ingestion consumers, which this template
+      # intentionally omits.
+      NODEJS_CAPABILITY_GROUPS: cdp_workflows,realtime_cohorts,feature_flags
       SITE_URL: ${POSTHOG_SITE_URL}
       SECRET_KEY: ${POSTHOG_SECRET_KEY}
       ENCRYPTION_SALT_KEYS: ${POSTHOG_ENCRYPTION_SALT_KEYS}
@@ -345,8 +350,13 @@ services:
       REDIS_URL: redis://redis7:6379/
       CDP_REDIS_HOST: redis7
       CDP_REDIS_PORT: 6379
+      # TLS for these defaults to "true" in production images; this stack's
+      # Redis is plaintext (a TLS handshake against it hangs until timeout and
+      # crash-loops the process if these consumers ever run).
       LOGS_REDIS_HOST: redis7
+      LOGS_REDIS_TLS: "false"
       TRACES_REDIS_HOST: redis7
+      TRACES_REDIS_TLS: "false"
       COOKIELESS_REDIS_HOST: redis7
       COOKIELESS_REDIS_PORT: 6379
       CLICKHOUSE_HOST: clickhouse
@@ -392,7 +402,9 @@ services:
       COOKIELESS_REDIS_PORT: 6379
       CDP_REDIS_HOST: redis7
       LOGS_REDIS_HOST: redis7
+      LOGS_REDIS_TLS: "false"
       TRACES_REDIS_HOST: redis7
+      TRACES_REDIS_TLS: "false"
       CLICKHOUSE_HOST: clickhouse
       CLICKHOUSE_DATABASE: posthog
       CLICKHOUSE_SECURE: "false"