diff --git a/README.md b/README.md
index 6510aa3..b52b47e 100644
--- a/README.md
+++ b/README.md
@@ -173,5 +173,5 @@ Pulled from Infisical at deploy time (`infisical.vault.read_secrets` in `site.ym
 - Watchtower exposes its HTTP API on port 8088 inside the LXC (matches the
   fleet pattern; 8080 collides with potential second app on this CT).
 - An `autoheal` sidecar restarts unhealthy containers
-  (`AUTOHEAL_CONTAINER_LABEL=all`) — fleet ops-sidecar standard, so the compose
+  (`AUTOHEAL_CONTAINER_LABEL=autoheal`) — fleet ops-sidecar standard, so the compose
   is 6 containers total (app/db/redis/sidekiq + autoheal + watchtower).
diff --git a/roles/dawarich/templates/docker-compose.yml.j2 b/roles/dawarich/templates/docker-compose.yml.j2
index 052b722..7cf57b2 100644
--- a/roles/dawarich/templates/docker-compose.yml.j2
+++ b/roles/dawarich/templates/docker-compose.yml.j2
@@ -166,7 +166,7 @@ services:
     container_name: autoheal
     restart: unless-stopped
     environment:
-      - AUTOHEAL_CONTAINER_LABEL=all
+      - AUTOHEAL_CONTAINER_LABEL=autoheal
       - AUTOHEAL_INTERVAL=15
       - AUTOHEAL_START_PERIOD=60
       - AUTOHEAL_DEFAULT_STOP_TIMEOUT=30