diff --git a/shell-mcp/docker-compose.yml b/shell-mcp/docker-compose.yml
index 138df4b..d82adeb 100644
--- a/shell-mcp/docker-compose.yml
+++ b/shell-mcp/docker-compose.yml
@@ -5,6 +5,11 @@ services:
     image: shell-mcp:mediabox
     container_name: shell-mcp
     restart: unless-stopped
+    labels:
+      # Local build — there is no registry copy. Without this label watchtower's
+      # 05:00 run tries to pull shell-mcp from Docker Hub, gets 401'd, and
+      # ntfys the failure every day (first seen 2026-08-02).
+      - com.centurylinklabs.watchtower.enable=false
     ports:
       # Published on the LAN so NPM on arrsstack can reach 10.0.1.20:8103.
       # No arrstack_arr_net here — that network lives on the Pi and does not