diff --git a/README.md b/README.md
index 939abdd..9f0288c 100644
--- a/README.md
+++ b/README.md
@@ -10,7 +10,7 @@ Flake-based NixOS configuration for a ThinkPad P14s Gen 6 (AMD), tracking `nixos
 - **Secrets**: [sops-nix](https://github.com/Mic92/sops-nix) with age — xray config, WireGuard, SSH keys, private routes/hosts; encrypted files stay out of the repo (only `.example` structure files are tracked), decrypted to `/run/secrets` at activation
 - **Desktop**: GNOME on Wayland, AMD GPU
 - **Local LLMs**: Ollama with ROCm (gfx1151) + Lemonade for XDNA2 NPU serving via [nix-amd-ai](https://github.com/noamsto/nix-amd-ai)
-- **Networking**: Xray VLESS+Reality with sing-box TUN, WireGuard, WWAN modem
+- **Networking**: dpi-tunnel (Xray VLESS+Reality+PQ, full tunnel on `tun1`), Xray+sing-box TUN (on demand), WireGuard, WWAN modem
 - **Gaming**: Steam with gamescope, declarative Flatpaks via [nix-flatpak](https://github.com/gmodena/nix-flatpak)
 - **Litecoin Core (MWEB)**: vendored package build, revived after removal from nixpkgs
 - **Power**: AMD P-State tuning, zram swap ahead of disk swap
diff --git a/modules/xray.nix b/modules/xray.nix
index 1712d75..69e57ec 100644
--- a/modules/xray.nix
+++ b/modules/xray.nix
@@ -128,6 +128,9 @@
     CapabilityBoundingSet = [ "CAP_NET_ADMIN" "CAP_NET_BIND_SERVICE" ];
   };
 
+  # Off by default: start on demand with `systemctl start sing-box`
+  systemd.services.sing-box.wantedBy = lib.mkForce [ ];
+
   # Firefox dev edition
   programs.firefox = {
     enable = true;