diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 42203588..fa9c0829 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -86,6 +86,10 @@ services:
     # runner container's CWD. See #506 + infra/minio/Dockerfile.
     build:
       context: ./infra/minio
+    # Declare one-shot intent so `docker compose up -d --wait` treats
+    # exited(0) as success rather than "not running, fail". Pair with
+    # backend's `service_completed_successfully` dependency below. See #510.
+    restart: "no"
     depends_on:
       minio:
         condition: service_healthy
@@ -160,6 +164,12 @@ services:
         condition: service_healthy
       ocr-service:
         condition: service_healthy
+      # Gate startup on the bucket bootstrap. Without this, backend
+      # starts in parallel with create-buckets and may race the policy
+      # bind. Also tells compose's `up -d --wait` that create-buckets
+      # is a one-shot that must complete successfully. See #510.
+      create-buckets:
+        condition: service_completed_successfully
     # Bound to localhost only — Caddy fronts external traffic.
     ports:
       - "127.0.0.1:${PORT_BACKEND}:8080"