diff --git a/services/zpush/Dockerfile b/services/zpush/Dockerfile
index b53accd..8fd1820 100644
--- a/services/zpush/Dockerfile
+++ b/services/zpush/Dockerfile
@@ -43,12 +43,20 @@ COPY --from=source /awl/inc/ /usr/share/awl/inc/
 # The greps make the build fail loudly if an upstream config rename ever
 # makes a sed miss instead of shipping a silently unconfigured gateway.
 # (USE_FULLEMAIL_FOR_LOGIN is already true in the EGroupware fork.)
+#
+# PROVISIONING off: dezky doesn't manage device policies (no remote wipe
+# promise), and Z-Push's policy checks are PHP 8-broken anyway — the shipped
+# policies.ini has maxattsize='' and PHP 8 string/int comparison makes the
+# ">-1" SyncProvisioning check fail, 500ing every Provision command and
+# blocking ALL folder/calendar sync behind "retry after provisioning".
 RUN sed -i \
       -e "s|define('TIMEZONE', '');|define('TIMEZONE', 'Europe/Copenhagen');|" \
       -e "s|define('BACKEND_PROVIDER', '');|define('BACKEND_PROVIDER', 'BackendCombined');|" \
+      -e "s|define('PROVISIONING', true);|define('PROVISIONING', false);|" \
       /usr/share/z-push/config.php \
     && grep -q "define('BACKEND_PROVIDER', 'BackendCombined')" /usr/share/z-push/config.php \
-    && grep -q "define('USE_FULLEMAIL_FOR_LOGIN', true)" /usr/share/z-push/config.php
+    && grep -q "define('USE_FULLEMAIL_FOR_LOGIN', true)" /usr/share/z-push/config.php \
+    && grep -q "define('PROVISIONING', false)" /usr/share/z-push/config.php
 
 # PHP 8 fix (upstream Z-Push 2.6.4 bug): sem_get()/shm_attach() return
 # objects instead of resources since PHP 8.0 and this debug log line