diff --git a/add-app.sh b/add-app.sh
index d4f4440..28c7d9d 100755
--- a/add-app.sh
+++ b/add-app.sh
@@ -143,6 +143,16 @@ curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/
 echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu jammy stable" \
   > /etc/apt/sources.list.d/docker.list
 apt-get update -qq && apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-compose-plugin
+# Docker-in-LXC: neutralise AppArmor so Docker never tries to load a profile.
+# In a confined LXC that fails ("docker-default ... while confined") for BOTH
+# image builds and container runtime. Removing apparmor_parser makes Docker
+# run everything unconfined — the container itself is the isolation boundary.
+# (Same fix as install-stack.sh's install_docker() — see stack-init commit
+# 9a45e39. Do NOT set lxc.apparmor.profile: unconfined on the LXC instead —
+# that cancels the nesting=1 feature.)
+if [ -e /usr/sbin/apparmor_parser ]; then
+  mv -f /usr/sbin/apparmor_parser /usr/sbin/apparmor_parser.disabled
+fi
 systemctl enable --now docker ssh
 DOCKER
 msg_ok "Docker installed"
diff --git a/install-stack.sh b/install-stack.sh
index e950d2a..e6a8f31 100755
--- a/install-stack.sh
+++ b/install-stack.sh
@@ -1214,7 +1214,7 @@ ${build_out}"
   msg_info "Seeding maintenance into auth DB"
   pct exec 100 -- docker exec hotel-manage-postgres psql -U postgres -d auth_db -c "
     INSERT INTO apps (slug, name, description, base_path, icon, theme_color, category, internal_host, internal_port)
-    VALUES ('maintenance', 'Maintenance', 'Maintenance log book — faults, recurring tasks, assets and contractors', '/maintenance', 'Wrench', '#b45309', 'Operations', '10.10.10.121', 3080)
+    VALUES ('maintenance', 'Maintenance', 'Maintenance log book — faults, recurring tasks, assets and contractors', '/maintenance', 'Wrench', '#b45309', 'Open', '10.10.10.121', 3080)
     ON CONFLICT (slug) DO UPDATE SET
       name=EXCLUDED.name, description=EXCLUDED.description, base_path=EXCLUDED.base_path,
       icon=EXCLUDED.icon, theme_color=EXCLUDED.theme_color, category=EXCLUDED.category,