diff --git a/devserver/ansible/deploy-svc-dozzle.yaml b/devserver/ansible/deploy-svc-dozzle.yaml
deleted file mode 100644
index 21cdd60..0000000
--- a/devserver/ansible/deploy-svc-dozzle.yaml
+++ /dev/null
@@ -1,53 +0,0 @@
----
-# Lightweight deploy: pull the latest dozzle image and restart the
-# svc-dozzle systemd service — without re-applying the whole playbook.
-#
-# Pull goes through run.sh so it runs in the same infisical context as
-# the service (run.sh renders users.yml from the infisical-injected
-# DOZZLE_PASSWORD_HASH before starting compose).
-#
-# Run from devserver/ansible/:
-#   ansible-playbook deploy-svc-dozzle.yaml
-
-- name: Pull latest dozzle image and restart service
-  hosts: devserver
-  become: true
-  vars_files:
-    - roles/svc-dozzle/defaults/main.yaml
-
-  tasks:
-    - name: Render compose.yaml
-      ansible.builtin.template:
-        src: roles/svc-dozzle/templates/compose.yaml.j2
-        dest: "{{ svc_dozzle_deploy_dir }}/compose.yaml"
-        owner: root
-        group: root
-        mode: "0644"
-
-    - name: Pull latest dozzle image
-      ansible.builtin.command:
-        cmd: "{{ svc_dozzle_deploy_dir }}/run.sh pull"
-        chdir: "{{ svc_dozzle_deploy_dir }}"
-      changed_when: true
-      register: _svc_dozzle_pull
-
-    - name: Show pull output
-      ansible.builtin.debug:
-        var: _svc_dozzle_pull.stdout_lines
-
-    - name: Restart svc-dozzle.service
-      ansible.builtin.systemd:
-        name: svc-dozzle.service
-        state: restarted
-        daemon_reload: true
-
-    - name: Show svc-dozzle service status
-      ansible.builtin.command:
-        cmd: systemctl --no-pager status svc-dozzle.service
-      changed_when: false
-      failed_when: false
-      register: _svc_dozzle_status
-
-    - name: Print service status
-      ansible.builtin.debug:
-        var: _svc_dozzle_status.stdout_lines
diff --git a/devserver/ansible/roles/docker-network/tasks/main.yaml b/devserver/ansible/roles/docker-network/tasks/main.yaml
index 207150d..7720676 100644
--- a/devserver/ansible/roles/docker-network/tasks/main.yaml
+++ b/devserver/ansible/roles/docker-network/tasks/main.yaml
@@ -1,6 +1,6 @@
 ---
 # docker-network — create the shared external Docker network that every
-# service (caddy, events, bot, dozzle) joins for internal routing.
+# service (caddy, events, bot) joins for internal routing.
 # Created here (not per-service) so role order doesn't matter among
 # services: only `docker` must run before this.
 
diff --git a/devserver/ansible/roles/svc-caddy/defaults/main.yaml b/devserver/ansible/roles/svc-caddy/defaults/main.yaml
index c2dcfb1..c9f9cda 100644
--- a/devserver/ansible/roles/svc-caddy/defaults/main.yaml
+++ b/devserver/ansible/roles/svc-caddy/defaults/main.yaml
@@ -1,8 +1,7 @@
 ---
 # svc-caddy — Caddy as a docker compose service (reverse proxy / TLS
-# terminator for *.devict.org). Replaces the prior native apt install so
-# its logs surface in Dozzle and it shares the devserver-ingress network
-# with the other services.
+# terminator for *.devict.org). Replaces the prior native apt install;
+# joins the devserver-ingress network with the other services.
 #
 # Existing Let's Encrypt certs + ACME account under
 # caddy_native_data_dir are migrated (one-time) into caddy_data_dir,
@@ -25,9 +24,7 @@ caddy_email: "{{ lookup('env', 'CADDY_EMAIL') }}"
 # Hostnames.
 caddy_events_hostname: events.devict.org
 caddy_bot_hostname: bot.devict.org
-caddy_logs_hostname: logs.devict.org
 
 # Upstreams are container names on the devserver-ingress network.
 caddy_events_upstream: "events:3000"
 caddy_bot_upstream: "bot:3000"
-caddy_logs_upstream: "dozzle:8080"
diff --git a/devserver/ansible/roles/svc-caddy/tasks/main.yaml b/devserver/ansible/roles/svc-caddy/tasks/main.yaml
index c8bcc69..6b91898 100644
--- a/devserver/ansible/roles/svc-caddy/tasks/main.yaml
+++ b/devserver/ansible/roles/svc-caddy/tasks/main.yaml
@@ -1,8 +1,8 @@
 ---
 # svc-caddy — run Caddy as a docker compose service, mirroring the
 # svc-events/svc-bot pattern (deploy dir + compose.yaml + run.sh +
-# systemd unit). Replaces the prior native apt install so Caddy's logs
-# show up in Dozzle and it shares the devserver-ingress network.
+# systemd unit). Replaces the prior native apt install; joins the
+# devserver-ingress network.
 #
 # Existing Let's Encrypt certs + ACME account are copied from the native
 # data dir into the container's /data volume so Caddy reuses them.
diff --git a/devserver/ansible/roles/svc-caddy/templates/Caddyfile.j2 b/devserver/ansible/roles/svc-caddy/templates/Caddyfile.j2
index 699edfa..1668137 100644
--- a/devserver/ansible/roles/svc-caddy/templates/Caddyfile.j2
+++ b/devserver/ansible/roles/svc-caddy/templates/Caddyfile.j2
@@ -9,7 +9,3 @@
 {{ caddy_bot_hostname }} {
   reverse_proxy {{ caddy_bot_upstream }}
 }
-
-{{ caddy_logs_hostname }} {
-  reverse_proxy {{ caddy_logs_upstream }}
-}
diff --git a/devserver/ansible/roles/svc-dozzle/defaults/main.yaml b/devserver/ansible/roles/svc-dozzle/defaults/main.yaml
deleted file mode 100644
index 6c12b03..0000000
--- a/devserver/ansible/roles/svc-dozzle/defaults/main.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
----
-# svc-dozzle: Dozzle web log viewer. Reads the Docker socket to tail
-# container logs. Auth via Dozzle's native `simple` provider — the
-# bcrypt password hash is injected from infisical (DOZZLE_PASSWORD_HASH).
-#
-# No host port published; Caddy proxies logs.devict.org -> dozzle:8080.
-
-svc_dozzle_deploy_dir: /opt/devict/dozzle
-svc_dozzle_image: amir20/dozzle:latest
-svc_dozzle_username: admin
diff --git a/devserver/ansible/roles/svc-dozzle/handlers/main.yaml b/devserver/ansible/roles/svc-dozzle/handlers/main.yaml
deleted file mode 100644
index a63749c..0000000
--- a/devserver/ansible/roles/svc-dozzle/handlers/main.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
----
-- name: restart svc-dozzle
-  become: true
-  ansible.builtin.systemd:
-    name: svc-dozzle.service
-    state: restarted
-    daemon_reload: true
diff --git a/devserver/ansible/roles/svc-dozzle/tasks/main.yaml b/devserver/ansible/roles/svc-dozzle/tasks/main.yaml
deleted file mode 100644
index 2bc5074..0000000
--- a/devserver/ansible/roles/svc-dozzle/tasks/main.yaml
+++ /dev/null
@@ -1,55 +0,0 @@
----
-# svc-dozzle — deploy Dozzle log viewer, native simple auth, password
-# hash from infisical.
-#
-# Prerequisites (satisfied by playbook role order):
-#   - docker role:          docker + compose plugin installed
-#   - docker-network role:  devserver-ingress network exists
-#   - infisical role:       CLI installed + shared machine-identity env
-#                           file written (sourced by run.sh)
-
-- name: Ensure deploy directory exists
-  become: true
-  ansible.builtin.file:
-    path: "{{ svc_dozzle_deploy_dir }}"
-    state: directory
-    owner: root
-    group: root
-    mode: "0755"
-
-- name: Render compose.yaml
-  become: true
-  ansible.builtin.template:
-    src: compose.yaml.j2
-    dest: "{{ svc_dozzle_deploy_dir }}/compose.yaml"
-    owner: root
-    group: root
-    mode: "0644"
-  notify: restart svc-dozzle
-
-- name: Render run.sh
-  become: true
-  ansible.builtin.template:
-    src: run.sh.j2
-    dest: "{{ svc_dozzle_deploy_dir }}/run.sh"
-    owner: root
-    group: root
-    mode: "0755"
-  notify: restart svc-dozzle
-
-- name: Install systemd unit
-  become: true
-  ansible.builtin.template:
-    src: svc-dozzle.service.j2
-    dest: /etc/systemd/system/svc-dozzle.service
-    owner: root
-    group: root
-    mode: "0644"
-  notify: restart svc-dozzle
-
-- name: Enable svc-dozzle.service
-  become: true
-  ansible.builtin.systemd:
-    name: svc-dozzle.service
-    enabled: true
-    daemon_reload: true
diff --git a/devserver/ansible/roles/svc-dozzle/templates/compose.yaml.j2 b/devserver/ansible/roles/svc-dozzle/templates/compose.yaml.j2
deleted file mode 100644
index 0cf229b..0000000
--- a/devserver/ansible/roles/svc-dozzle/templates/compose.yaml.j2
+++ /dev/null
@@ -1,15 +0,0 @@
-services:
-  dozzle:
-    image: {{ svc_dozzle_image }}
-    restart: unless-stopped
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-      - ./users.yml:/data/users.yml:ro
-    environment:
-      DOZZLE_AUTH_PROVIDER: simple
-    networks:
-      - devserver-ingress
-
-networks:
-  devserver-ingress:
-    external: true
diff --git a/devserver/ansible/roles/svc-dozzle/templates/run.sh.j2 b/devserver/ansible/roles/svc-dozzle/templates/run.sh.j2
deleted file mode 100644
index e989c2c..0000000
--- a/devserver/ansible/roles/svc-dozzle/templates/run.sh.j2
+++ /dev/null
@@ -1,35 +0,0 @@
-#!/usr/bin/env bash
-# Runs the dozzle compose stack with secrets injected at runtime by the
-# infisical CLI. Invoked by svc-dozzle.service.
-#
-#   run.sh           -> docker compose up
-#   run.sh pull      -> docker compose pull
-#   run.sh <args...> -> docker compose <args...>
-set -euo pipefail
-cd "$(dirname "$0")"
-
-# Shared devserver infisical machine identity — written by the infisical
-# role. Holds the client id + secret used by every service on this host.
-# shellcheck source=/dev/null
-source {{ infisical_env_file }}
-
-# Exchange the machine-identity credentials for a short-lived access
-# token. Exported (not passed via --token=) so it never appears on a
-# command line (visible via ps).
-export INFISICAL_TOKEN="$(infisical login \
-  --silent --plain \
-  --method=universal-auth \
-  --client-id="$INFISICAL_CLIENT_ID" \
-  --client-secret="$INFISICAL_CLIENT_SECRET")"
-
-# Dozzle reads users from /data/users.yml (a mounted file, so compose
-# ${...} interpolation does NOT apply) and expects a literal bcrypt hash.
-# Render users.yml at runtime from the infisical-injected hash, then run
-# compose — both inside `infisical run` so DOZZLE_PASSWORD_HASH is set.
-exec infisical run \
-  --env=prod \
-  --projectId={{ infisical_project_id }} \
-  -- bash -euo pipefail -c '
-    printf "users:\n  {{ svc_dozzle_username }}:\n    password: %s\n" "$DOZZLE_PASSWORD_HASH" > users.yml
-    exec docker compose "${@:-up}"
-  ' _ "$@"
diff --git a/devserver/ansible/roles/svc-dozzle/templates/svc-dozzle.service.j2 b/devserver/ansible/roles/svc-dozzle/templates/svc-dozzle.service.j2
deleted file mode 100644
index f314330..0000000
--- a/devserver/ansible/roles/svc-dozzle/templates/svc-dozzle.service.j2
+++ /dev/null
@@ -1,15 +0,0 @@
-[Unit]
-Description=devICT dozzle log viewer (docker compose via infisical)
-Requires=docker.service
-After=docker.service network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-WorkingDirectory={{ svc_dozzle_deploy_dir }}
-ExecStart={{ svc_dozzle_deploy_dir }}/run.sh
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
diff --git a/devserver/ansible/site.yaml b/devserver/ansible/site.yaml
index 6d25355..e9ba48e 100644
--- a/devserver/ansible/site.yaml
+++ b/devserver/ansible/site.yaml
@@ -12,4 +12,3 @@
     - svc-caddy
     - svc-events
     - svc-bot
-    - svc-dozzle
diff --git a/devserver/justfile b/devserver/justfile
index d6c6927..838e0c8 100644
--- a/devserver/justfile
+++ b/devserver/justfile
@@ -39,7 +39,3 @@ deploy-bot:
 # pull latest caddy image + restart the service
 deploy-caddy:
     cd ansible && ansible-playbook deploy-svc-caddy.yaml
-
-# pull latest dozzle image + restart the service
-deploy-dozzle:
-    cd ansible && ansible-playbook deploy-svc-dozzle.yaml