diff --git a/infra/k3s/10-config.yaml b/infra/k3s/10-config.yaml
index 395960c..f4f105e 100644
--- a/infra/k3s/10-config.yaml
+++ b/infra/k3s/10-config.yaml
@@ -46,8 +46,15 @@ data:
   # === STUN — default Jitsi-hosted STUN servers; ok for getting started ===
   JVB_STUN_SERVERS: "meet-jit-si-turnrelay.jitsi.net:443"
 
-  # === Minor UX tweaks ===
+  # === UX / lockdown ===
+  # Pre-join page on — gives joiners a chance to set audio/video before
+  # they hit the room.
   ENABLE_PREJOIN_PAGE: "1"
-  ENABLE_WELCOME_PAGE: "1"
+  # Welcome page off — visiting https://meet.it.financeflow.de/ bare
+  # shows a minimal shell instead of a "create new room" form. Combined
+  # with AUTH=jwt, the only way in is via a signed deep-link Embertime
+  # hands out.
+  ENABLE_WELCOME_PAGE: "0"
+  ENABLE_CLOSE_PAGE: "0"
   ENABLE_TRANSCRIPTIONS: "0"
   ENABLE_RECORDING: "0"