diff --git a/.claude/settings.local.json b/.claude/settings.local.json
index caedbad..abf33f5 100644
--- a/.claude/settings.local.json
+++ b/.claude/settings.local.json
@@ -3,7 +3,10 @@
     "allow": [
       "Bash(git init:*)",
       "Bash(git add:*)",
-      "Bash(git commit -m ':*)"
+      "Bash(git commit -m ':*)",
+      "Bash(git push:*)",
+      "Bash(docker compose:*)",
+      "Bash(docker run:*)"
     ]
   }
 }
diff --git a/CLAUDE.md b/CLAUDE.md
index 6edb4ba..0d7c444 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -106,6 +106,12 @@ After **any** change to Dockerfiles, `docker-compose*.yml`, `nginx.conf`, setup
    docker compose up --build -d
    ```
 4. Confirm each container is running as a non-root user (`docker inspect <container> --format '{{.Config.User}}'`).
+5. **Tear down after testing** — stop and remove all containers, networks, and volumes:
+   ```bash
+   docker compose down --volumes --remove-orphans
+   # or for dev stack:
+   docker compose -f docker-compose.yml -f docker-compose.dev.yml down --volumes --remove-orphans
+   ```
 
 ## Security hook