diff --git a/deploy/systemd/windygit-sync.service.d/compute-guard-block.conf b/deploy/systemd/windygit-sync.service.d/compute-guard-block.conf
new file mode 100644
index 0000000..665b2d1
--- /dev/null
+++ b/deploy/systemd/windygit-sync.service.d/compute-guard-block.conf
@@ -0,0 +1,3 @@
+[Service]
+# Orchestrator 09-23: compute-guard BLOCKS lane-owned findings; Grant-owned (ci/grant-owned.yml) stay WARN.
+Environment=COMPUTE_GUARD_MODE=block