diff --git a/.superpowers/sdd/pgvector-final-fix-report.md b/.superpowers/sdd/pgvector-final-fix-report.md
index 03a65f2f..e33ee639 100644
--- a/.superpowers/sdd/pgvector-final-fix-report.md
+++ b/.superpowers/sdd/pgvector-final-fix-report.md
@@ -47,3 +47,13 @@ the in-process validated `DatabaseConfig` used to establish PostgreSQL connectio
 serialized by doctor/Compose/inspect paths. Docker Desktop file-backed secrets may appear as bind
 mounts; the safe runtime exception is therefore based on the read-only service mount location
 `/run/secrets`, while source files remain owner-only on the host.
+
+## External-profile regression follow-up
+
+Local pgvector is now an explicit `deploy/compose.local-vector.yaml` overlay. The base Compose and
+production external override contain no direct vector password declarations, mounts, or `_FILE`
+variables, so external deployments do not resolve or require local password files. A real lifecycle
+gate unsets all local secret-file variables, renders external config, builds and starts core, waits
+for health, and inspects the live container for absence of local direct-vector secret paths. The
+local overlay retains its live inspect assertion (paths present, values absent), rotation, restart
+persistence, and transactional backup/restore drill.
diff --git a/README.md b/README.md
index a506cb81..b79aefe6 100644
--- a/README.md
+++ b/README.md
@@ -47,8 +47,9 @@ later with `docker compose --project-name "$SMOKE_PROJECT" --profile external do
 
 ## Optional local pgvector and recovery
 
-Start the persistent local vector profile with `docker compose --profile local-vector up
---build --wait`. Its `vector_data` volume is independent of application state. Reader, writer,
+Start the persistent local vector profile with `docker compose -f compose.yaml -f
+deploy/compose.local-vector.yaml --profile local-vector up --build --wait`. Its `vector_data`
+volume is independent of application state. Reader, writer,
 migrator, and bootstrap credentials remain separate; password files must be mode `0600` and
 must not be passed as URL arguments.
 
diff --git a/compose.yaml b/compose.yaml
index 704b5138..2855be81 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -6,7 +6,7 @@ x-smoke-labels: &smoke-labels
 services:
   core:
     image: thothii-core:local
-    profiles: [external, local-vector]
+    profiles: [external]
     build:
       context: .
       dockerfile: docker/core.Dockerfile
@@ -16,22 +16,9 @@ services:
       THOTH_PUBLIC_EXPOSURE: "${THOTH_PUBLIC_EXPOSURE:-false}"
       THT_DATA_ROOT: /data
       SETTINGS_FILE: /data/settings/settings.json
-      THT_VECTOR_DATABASE: "${THT_VECTOR_DATABASE:-thoth}"
-      THT_VECTOR_BOOTSTRAP_USER: "${THT_VECTOR_BOOTSTRAP_USER:-postgres}"
-      THT_VECTOR_READER_USER: "${THT_VECTOR_READER_USER:-thoth_vector_reader}"
-      THT_VECTOR_WRITER_USER: "${THT_VECTOR_WRITER_USER:-thoth_vector_writer}"
-      THT_VECTOR_READER_PASSWORD_FILE: /run/secrets/vector_reader_password
-      THT_VECTOR_WRITER_PASSWORD_FILE: /run/secrets/vector_writer_password
-    secrets:
-      - vector_reader_password
-      - vector_writer_password
     volumes:
       - thoth_data:/data
       - ./deploy/workspaces:/app/harness/workspaces:ro
-    depends_on:
-      vector-migrate:
-        condition: service_completed_successfully
-        required: false
     healthcheck:
       test: [CMD, curl, --fail, --silent, http://127.0.0.1:8787/health]
       interval: 5s
@@ -41,7 +28,7 @@ services:
     restart: unless-stopped
 
   frontend:
-    profiles: [external, local-vector]
+    profiles: [external]
     build:
       context: .
       dockerfile: docker/frontend.Dockerfile
@@ -61,97 +48,10 @@ services:
       start_period: 5s
     restart: unless-stopped
 
-  vector-db:
-    image: pgvector/pgvector:0.8.5-pg16@sha256:1d533553fefe4f12e5d80c7b80622ba0c382abb5758856f52983d8789179f0fb
-    profiles: [local-vector]
-    labels: *smoke-labels
-    environment:
-      POSTGRES_DB: "${THT_VECTOR_DATABASE:-thoth}"
-      POSTGRES_USER: "${THT_VECTOR_BOOTSTRAP_USER:-postgres}"
-      POSTGRES_PASSWORD_FILE: /run/secrets/vector_bootstrap_password
-      THT_VECTOR_MIGRATOR_USER: "${THT_VECTOR_MIGRATOR_USER:-thoth_vector_migrator}"
-      THT_VECTOR_READER_USER: "${THT_VECTOR_READER_USER:-thoth_vector_reader}"
-      THT_VECTOR_WRITER_USER: "${THT_VECTOR_WRITER_USER:-thoth_vector_writer}"
-    secrets:
-      - vector_bootstrap_password
-      - vector_migrator_password
-      - vector_reader_password
-      - vector_writer_password
-    volumes:
-      - vector_data:/var/lib/postgresql/data
-    healthcheck:
-      test: [CMD-SHELL, "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
-      interval: 5s
-      timeout: 3s
-      retries: 20
-      start_period: 10s
-    restart: unless-stopped
-
-  vector-reconcile:
-    image: pgvector/pgvector:0.8.5-pg16@sha256:1d533553fefe4f12e5d80c7b80622ba0c382abb5758856f52983d8789179f0fb
-    profiles: [local-vector]
-    labels: *smoke-labels
-    environment:
-      PGHOST: vector-db
-      PGPORT: 5432
-      PGDATABASE: "${THT_VECTOR_DATABASE:-thoth}"
-      PGUSER: "${THT_VECTOR_BOOTSTRAP_USER:-postgres}"
-      THT_VECTOR_BOOTSTRAP_USER: "${THT_VECTOR_BOOTSTRAP_USER:-postgres}"
-      THT_VECTOR_MIGRATOR_USER: "${THT_VECTOR_MIGRATOR_USER:-thoth_vector_migrator}"
-      THT_VECTOR_READER_USER: "${THT_VECTOR_READER_USER:-thoth_vector_reader}"
-      THT_VECTOR_WRITER_USER: "${THT_VECTOR_WRITER_USER:-thoth_vector_writer}"
-    entrypoint: [/opt/thoth/reconcile-roles.sh]
-    secrets:
-      - vector_bootstrap_password
-      - vector_migrator_password
-      - vector_reader_password
-      - vector_writer_password
-    volumes:
-      - ./deploy/vector/reconcile-roles.sh:/opt/thoth/reconcile-roles.sh:ro
-      - ./deploy/vector/secret-policy.sh:/opt/thoth/secret-policy.sh:ro
-    depends_on:
-      vector-db:
-        condition: service_healthy
-    restart: "no"
-
-  vector-migrate:
-    image: thothii-core:local
-    profiles: [local-vector]
-    build:
-      context: .
-      dockerfile: docker/core.Dockerfile
-    labels: *smoke-labels
-    entrypoint: [sh, -ec]
-    command:
-      - |
-        password=$$(cat /run/secrets/vector_migrator_password)
-        encoded=$$(python -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.argv[1], safe=""))' "$$password")
-        exec /opt/venv/bin/tht vector migrate \
-          --database-url "postgresql+psycopg2://${THT_VECTOR_MIGRATOR_USER:-thoth_vector_migrator}:$$encoded@vector-db:5432/${THT_VECTOR_DATABASE:-thoth}" \
-          --json
-    secrets:
-      - vector_migrator_password
-    depends_on:
-      vector-reconcile:
-        condition: service_completed_successfully
-    restart: "no"
-
 volumes:
   thoth_data:
     labels: *smoke-labels
-  vector_data:
-    labels: *smoke-labels
 
 networks:
   default:
     labels: *smoke-labels
-
-secrets:
-  vector_bootstrap_password:
-    file: ${THT_VECTOR_BOOTSTRAP_PASSWORD_SECRET_FILE:-deploy/secrets/vector_bootstrap_password}
-  vector_migrator_password:
-    file: ${THT_VECTOR_MIGRATOR_PASSWORD_SECRET_FILE:-deploy/secrets/vector_migrator_password}
-  vector_reader_password:
-    file: ${THT_VECTOR_READER_PASSWORD_SECRET_FILE:-deploy/secrets/vector_reader_password}
-  vector_writer_password:
-    file: ${THT_VECTOR_WRITER_PASSWORD_SECRET_FILE:-deploy/secrets/vector_writer_password}
diff --git a/deploy/compose.local-vector.yaml b/deploy/compose.local-vector.yaml
new file mode 100644
index 00000000..53b01364
--- /dev/null
+++ b/deploy/compose.local-vector.yaml
@@ -0,0 +1,92 @@
+services:
+  core:
+    profiles: [local-vector]
+    environment:
+      THT_VECTOR_DATABASE: "${THT_VECTOR_DATABASE:-thoth}"
+      THT_VECTOR_BOOTSTRAP_USER: "${THT_VECTOR_BOOTSTRAP_USER:-postgres}"
+      THT_VECTOR_READER_USER: "${THT_VECTOR_READER_USER:-thoth_vector_reader}"
+      THT_VECTOR_WRITER_USER: "${THT_VECTOR_WRITER_USER:-thoth_vector_writer}"
+      THT_VECTOR_READER_PASSWORD_FILE: /run/secrets/vector_reader_password
+      THT_VECTOR_WRITER_PASSWORD_FILE: /run/secrets/vector_writer_password
+    secrets: [vector_reader_password, vector_writer_password]
+    depends_on:
+      vector-migrate:
+        condition: service_completed_successfully
+
+  frontend:
+    profiles: [local-vector]
+
+  vector-db:
+    image: pgvector/pgvector:0.8.5-pg16@sha256:1d533553fefe4f12e5d80c7b80622ba0c382abb5758856f52983d8789179f0fb
+    profiles: [local-vector]
+    labels: {io.thothii.smoke-owner: "${THOTH_SMOKE_OWNER:-operator}"}
+    environment:
+      POSTGRES_DB: "${THT_VECTOR_DATABASE:-thoth}"
+      POSTGRES_USER: "${THT_VECTOR_BOOTSTRAP_USER:-postgres}"
+      POSTGRES_PASSWORD_FILE: /run/secrets/vector_bootstrap_password
+      THT_VECTOR_MIGRATOR_USER: "${THT_VECTOR_MIGRATOR_USER:-thoth_vector_migrator}"
+      THT_VECTOR_READER_USER: "${THT_VECTOR_READER_USER:-thoth_vector_reader}"
+      THT_VECTOR_WRITER_USER: "${THT_VECTOR_WRITER_USER:-thoth_vector_writer}"
+    secrets: [vector_bootstrap_password, vector_migrator_password, vector_reader_password, vector_writer_password]
+    volumes: [vector_data:/var/lib/postgresql/data]
+    healthcheck:
+      test: [CMD-SHELL, "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
+      interval: 5s
+      timeout: 3s
+      retries: 20
+      start_period: 10s
+    restart: unless-stopped
+
+  vector-reconcile:
+    image: pgvector/pgvector:0.8.5-pg16@sha256:1d533553fefe4f12e5d80c7b80622ba0c382abb5758856f52983d8789179f0fb
+    profiles: [local-vector]
+    labels: {io.thothii.smoke-owner: "${THOTH_SMOKE_OWNER:-operator}"}
+    environment:
+      PGHOST: vector-db
+      PGPORT: 5432
+      PGDATABASE: "${THT_VECTOR_DATABASE:-thoth}"
+      PGUSER: "${THT_VECTOR_BOOTSTRAP_USER:-postgres}"
+      THT_VECTOR_BOOTSTRAP_USER: "${THT_VECTOR_BOOTSTRAP_USER:-postgres}"
+      THT_VECTOR_MIGRATOR_USER: "${THT_VECTOR_MIGRATOR_USER:-thoth_vector_migrator}"
+      THT_VECTOR_READER_USER: "${THT_VECTOR_READER_USER:-thoth_vector_reader}"
+      THT_VECTOR_WRITER_USER: "${THT_VECTOR_WRITER_USER:-thoth_vector_writer}"
+    entrypoint: [/opt/thoth/reconcile-roles.sh]
+    secrets: [vector_bootstrap_password, vector_migrator_password, vector_reader_password, vector_writer_password]
+    volumes:
+      - ./deploy/vector/reconcile-roles.sh:/opt/thoth/reconcile-roles.sh:ro
+      - ./deploy/vector/secret-policy.sh:/opt/thoth/secret-policy.sh:ro
+    depends_on:
+      vector-db: {condition: service_healthy}
+    restart: "no"
+
+  vector-migrate:
+    image: thothii-core:local
+    profiles: [local-vector]
+    labels: {io.thothii.smoke-owner: "${THOTH_SMOKE_OWNER:-operator}"}
+    build:
+      context: .
+      dockerfile: docker/core.Dockerfile
+    entrypoint: [sh, -ec]
+    command:
+      - |
+        password=$$(cat /run/secrets/vector_migrator_password)
+        encoded=$$(python -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.argv[1], safe=""))' "$$password")
+        exec /opt/venv/bin/tht vector migrate --database-url "postgresql+psycopg2://${THT_VECTOR_MIGRATOR_USER:-thoth_vector_migrator}:$$encoded@vector-db:5432/${THT_VECTOR_DATABASE:-thoth}" --json
+    secrets: [vector_migrator_password]
+    depends_on:
+      vector-reconcile: {condition: service_completed_successfully}
+    restart: "no"
+
+volumes:
+  vector_data:
+    labels: {io.thothii.smoke-owner: "${THOTH_SMOKE_OWNER:-operator}"}
+
+secrets:
+  vector_bootstrap_password:
+    file: ${THT_VECTOR_BOOTSTRAP_PASSWORD_SECRET_FILE:-deploy/secrets/vector_bootstrap_password}
+  vector_migrator_password:
+    file: ${THT_VECTOR_MIGRATOR_PASSWORD_SECRET_FILE:-deploy/secrets/vector_migrator_password}
+  vector_reader_password:
+    file: ${THT_VECTOR_READER_PASSWORD_SECRET_FILE:-deploy/secrets/vector_reader_password}
+  vector_writer_password:
+    file: ${THT_VECTOR_WRITER_PASSWORD_SECRET_FILE:-deploy/secrets/vector_writer_password}
diff --git a/scripts/local-vector-smoke.sh b/scripts/local-vector-smoke.sh
index 70892b0b..b9169a4c 100755
--- a/scripts/local-vector-smoke.sh
+++ b/scripts/local-vector-smoke.sh
@@ -36,7 +36,8 @@ export THT_VECTOR_BOOTSTRAP_USER=thoth_bootstrap_smoke
 export THOTH_SMOKE_OWNER="$smoke_owner"
 
 compose() {
-  docker compose --project-name "$smoke_project" --profile local-vector "$@"
+  docker compose -f compose.yaml -f deploy/compose.local-vector.yaml \
+    --project-name "$smoke_project" --profile local-vector "$@"
 }
 
 resource_ids() {
diff --git a/scripts/test-container-deployment.sh b/scripts/test-container-deployment.sh
index 87ea28ea..cb28a745 100755
--- a/scripts/test-container-deployment.sh
+++ b/scripts/test-container-deployment.sh
@@ -23,7 +23,8 @@ THT_VECTOR_BOOTSTRAP_PASSWORD_SECRET_FILE="$tmp/bootstrap" \
 THT_VECTOR_MIGRATOR_PASSWORD_SECRET_FILE="$tmp/migrator" \
 THT_VECTOR_READER_PASSWORD_SECRET_FILE="$tmp/local_reader" \
 THT_VECTOR_WRITER_PASSWORD_SECRET_FILE="$tmp/local_writer" \
-  docker compose --profile local-vector config >"$tmp/local-vector.yaml"
+  docker compose -f compose.yaml -f deploy/compose.local-vector.yaml \
+    --profile local-vector config >"$tmp/local-vector.yaml"
 grep -q 'THT_VECTOR_READER_PASSWORD_FILE: /run/secrets/vector_reader_password' "$tmp/local-vector.yaml"
 grep -q 'THT_VECTOR_WRITER_PASSWORD_FILE: /run/secrets/vector_writer_password' "$tmp/local-vector.yaml"
 if grep -q 'contract-local_' "$tmp/local-vector.yaml"; then
@@ -48,6 +49,10 @@ grep -q 'AUTH_MODE: upstream' "$tmp/production.yaml"
 grep -q 'THOTH_PUBLIC_EXPOSURE: "true"' "$tmp/production.yaml"
 grep -q 'target: thoth_ca.pem' "$tmp/production.yaml"
 grep -q 'THT_DWH_API_KEY_FILE: /run/secrets/dwh_api_key' "$tmp/production.yaml"
+if grep -q 'THT_VECTOR_READER_PASSWORD_FILE\|THT_VECTOR_WRITER_PASSWORD_FILE\|target: vector_reader_password\|target: vector_writer_password' "$tmp/production.yaml"; then
+  echo "production external config contains local direct vector secrets" >&2
+  exit 1
+fi
 
 if awk '/^FROM / && $2 !~ /@sha256:/ { found=1 } END { exit !found }' \
     docker/core.Dockerfile docker/frontend.Dockerfile; then
diff --git a/scripts/test-external-compose-lifecycle.sh b/scripts/test-external-compose-lifecycle.sh
new file mode 100755
index 00000000..5fca2274
--- /dev/null
+++ b/scripts/test-external-compose-lifecycle.sh
@@ -0,0 +1,23 @@
+#!/bin/sh
+set -eu
+
+cd "$(dirname "$0")/.."
+project="thothii-external-lifecycle-$$"
+cleanup() { docker compose --project-name "$project" --profile external down --volumes >/dev/null 2>&1 || true; }
+trap cleanup EXIT HUP INT TERM
+
+unset THT_VECTOR_BOOTSTRAP_PASSWORD_SECRET_FILE THT_VECTOR_MIGRATOR_PASSWORD_SECRET_FILE
+unset THT_VECTOR_READER_PASSWORD_SECRET_FILE THT_VECTOR_WRITER_PASSWORD_SECRET_FILE
+rendered=$(docker compose --project-name "$project" --profile external config)
+if printf '%s' "$rendered" | grep -q 'THT_VECTOR_.*PASSWORD_FILE\|vector_.*password'; then
+  echo "external config contains local vector secret references" >&2
+  exit 1
+fi
+docker compose --project-name "$project" --profile external up --build --wait core
+core=$(docker compose --project-name "$project" --profile external ps -q core)
+inspect=$(docker inspect "$core")
+if printf '%s' "$inspect" | grep -q 'THT_VECTOR_.*PASSWORD_FILE\|/run/secrets/vector_.*password'; then
+  echo "external core inspect contains local vector secret references" >&2
+  exit 1
+fi
+echo "external core lifecycle without local vector secrets passed."
diff --git a/scripts/vector-rotate-bootstrap-password.sh b/scripts/vector-rotate-bootstrap-password.sh
index 0cddc2e4..ae2836d5 100755
--- a/scripts/vector-rotate-bootstrap-password.sh
+++ b/scripts/vector-rotate-bootstrap-password.sh
@@ -29,7 +29,8 @@ trap 'rm -f "$replacement"' EXIT HUP INT TERM
 cp "$new_secret" "$replacement"
 chmod 0600 "$replacement"
 
-docker compose --project-name "$project" --profile local-vector run --rm --no-deps \
+docker compose -f compose.yaml -f deploy/compose.local-vector.yaml \
+  --project-name "$project" --profile local-vector run --rm --no-deps \
   --user 0:0 \
   --entrypoint /opt/venv/bin/python \
   --volume "$old_secret:/run/secrets/bootstrap-old:ro" \
@@ -42,4 +43,4 @@ mv -f "$replacement" "$old_secret"
 trap - EXIT HUP INT TERM
 
 echo "Deployment bootstrap secret atomically replaced only after verified database login."
-echo "Re-run: docker compose --project-name $project --profile local-vector up --wait vector-reconcile vector-migrate core"
+echo "Re-run: docker compose -f compose.yaml -f deploy/compose.local-vector.yaml --project-name $project --profile local-vector up --wait vector-reconcile vector-migrate core"