diff --git a/deploy/systemd/windygit-sync.service.d/secret-guard-block.conf b/deploy/systemd/windygit-sync.service.d/secret-guard-block.conf
new file mode 100644
index 0000000..e39fd43
--- /dev/null
+++ b/deploy/systemd/windygit-sync.service.d/secret-guard-block.conf
@@ -0,0 +1,3 @@
+[Service]
+# Orchestrator 09-24: secret-guard BLOCKS lane-owned findings; Grant-owned stay WARN.
+Environment=SECRET_GUARD_MODE=block