diff --git a/docs/superpowers/plans/2026-05-02-prod-hardening-c1-c5-c6.md b/docs/superpowers/plans/2026-05-02-prod-hardening-c1-c5-c6.md
index ac8baea..1ac6650 100644
--- a/docs/superpowers/plans/2026-05-02-prod-hardening-c1-c5-c6.md
+++ b/docs/superpowers/plans/2026-05-02-prod-hardening-c1-c5-c6.md
@@ -712,16 +712,24 @@ Expected: `* Running on http://0.0.0.0:8000`, plus `* Debug mode: on/off` based
 
 - [ ] **Step 3: Prod smoke — gunicorn actually runs**
 
-The fastest way to exercise the gunicorn `CMD` without unwinding the dev override is to bring up only the base file's services on a deploy host:
+Two-phase: build with the override (where the `build:` directives live), then bring up with the base only (no `command:` override → Dockerfile CMD wins).
 
 ```bash
 cd /home/yiekheng/projects/cm_bot_v2 && \
-sudo docker compose -f docker-compose.yml up -d --build api-server web-view
+sudo docker compose -f docker-compose.yml down
+
+# Rebuild --no-cache so the new Dockerfile CMD is in the image.
+sudo docker compose -f docker-compose.yml -f docker-compose.override.yml build --no-cache api-server web-view
+
+# Run prod-style: base file only, no command/ports overrides.
+sudo docker compose -f docker-compose.yml up -d api-server web-view
 sleep 8
 sudo docker logs $(sudo docker ps -q -f name=cm-web-view) 2>&1 | grep -E "Listening at|Starting gunicorn|WARNING"
 ```
 
-Expected: `[INFO] Starting gunicorn 23.0.0`, `[INFO] Listening at: http://0.0.0.0:8000`. **NOT** `WARNING: This is a development server`. Same shape for api-server. Tear down: `sudo docker compose down`.
+Expected: `[INFO] Starting gunicorn 23.0.0`, `[INFO] Listening at: http://0.0.0.0:8000`. **NOT** `WARNING: This is a development server`, **NOT** `Debugger PIN:`. Same shape for api-server. Tear down: `sudo docker compose -f docker-compose.yml down`.
+
+**Pitfall — why two phases:** `docker compose -f docker-compose.yml up --build` alone won't rebuild because the base file has no `build:` directives (services use registry images). The override is what ties the local Dockerfiles to the image tag, so the build step needs the override. Once built, the base file's `image:` reference resolves to the same local image tag, so `up -f docker-compose.yml` finds it.
 
 - [ ] **Step 4: api-server no longer has a host port in prod compose**