diff --git a/packages/secubox-profiles/debian/changelog b/packages/secubox-profiles/debian/changelog
index 229ab034..4f7f618d 100644
--- a/packages/secubox-profiles/debian/changelog
+++ b/packages/secubox-profiles/debian/changelog
@@ -1,3 +1,14 @@
+secubox-profiles (0.10.1-1~bookworm1) bookworm; urgency=medium
+
+  * secubox-sleeper ships DISABLED by default (--no-enable + postinst no longer
+    enables it). It STOPS idle sleepable modules; until a deployment's lifecycle
+    assignments are audited (a security service like crowdsec must be always-on,
+    never on-demand) auto-enabling it fleet-wide could sleep something that must
+    stay up. The operator enables it deliberately once verified. secubox-waker
+    stays enabled (it only serves the splash + fires wakes, never stops anything).
+
+ -- Gerald KERMA <devel@cybermind.fr>  Tue, 21 Jul 2026 09:15:00 +0200
+
 secubox-profiles (0.10.0-1~bookworm1) bookworm; urgency=medium
 
   * Terminal wake splash + two-phase UX (ref #896): pseudo-terminal "virtual
diff --git a/packages/secubox-profiles/debian/postinst b/packages/secubox-profiles/debian/postinst
index c3d625db..4e3f7cf2 100755
--- a/packages/secubox-profiles/debian/postinst
+++ b/packages/secubox-profiles/debian/postinst
@@ -45,14 +45,23 @@ case "$1" in
         systemctl enable secubox-profiles.service 2>/dev/null || true
         systemctl restart secubox-profiles.service 2>/dev/null || true
 
-        # secubox-waker + secubox-sleeper (ref #896, scale-to-zero): `enable
-        # --now` is safe/idempotent (no-op if already enabled+running — the
-        # first-install case starts them), `try-restart` afterwards is a
-        # no-op if inactive and gracefully restarts (not a hard kill) an
-        # ALREADY-running instance so an upgrade picks up new code without
-        # forcibly disrupting an in-flight wake/sleep decision.
-        systemctl enable --now secubox-waker.service secubox-sleeper.service 2>/dev/null || true
-        systemctl try-restart secubox-waker.service secubox-sleeper.service 2>/dev/null || true
+        # secubox-waker (ref #896, scale-to-zero): safe to enable+run — it only
+        # serves the wake splash and fires a single wake per vhost; it never
+        # stops anything. `enable --now` is idempotent; `try-restart` is a no-op
+        # if inactive and gracefully restarts (not a hard kill) a running
+        # instance so an upgrade picks up new code.
+        systemctl enable --now secubox-waker.service 2>/dev/null || true
+        systemctl try-restart secubox-waker.service 2>/dev/null || true
+
+        # secubox-sleeper ships DISABLED (pilot): it STOPS idle sleepable
+        # modules, and until each deployment's lifecycle assignments are audited
+        # (a security service like crowdsec must be always-on, NEVER on-demand),
+        # auto-enabling it fleet-wide could sleep something that must stay up.
+        # The operator enables it deliberately, once the sleepable set is
+        # verified: `systemctl enable --now secubox-sleeper.service`. We only
+        # try-restart it here so an UPGRADE refreshes an operator who ALREADY
+        # opted in (no-op when it is inactive/disabled — never starts it).
+        systemctl try-restart secubox-sleeper.service 2>/dev/null || true
 
         # Config sync for the sbxwaf-side wake trigger + the health monitor
         # (ref #896 — supersedes the nginx-sync path of Task 7, PIVOT
diff --git a/packages/secubox-profiles/debian/rules b/packages/secubox-profiles/debian/rules
index b5d1a900..a35c9fd0 100755
--- a/packages/secubox-profiles/debian/rules
+++ b/packages/secubox-profiles/debian/rules
@@ -19,4 +19,8 @@ override_dh_auto_install:
 override_dh_installsystemd:
 	dh_installsystemd --name=secubox-profiles
 	dh_installsystemd --name=secubox-waker
-	dh_installsystemd --name=secubox-sleeper
+	# secubox-sleeper ships DISABLED (--no-enable --no-start): it stops idle
+	# sleepable modules, so it must be enabled deliberately by the operator only
+	# after the deployment's lifecycle assignments are audited (a security
+	# service like crowdsec must never be on-demand). See debian/postinst.
+	dh_installsystemd --no-enable --no-start --name=secubox-sleeper