diff --git a/.github/workflows/release-selfhost.yml b/.github/workflows/release-selfhost.yml
index 781622c735..64e888e656 100644
--- a/.github/workflows/release-selfhost.yml
+++ b/.github/workflows/release-selfhost.yml
@@ -213,8 +213,14 @@ jobs:
           target: runtime-prebuilt
           platforms: linux/amd64,linux/arm64
           push: true
+          # Visual-capture convergence (#3607/#4111): every official image ships puppeteer-core so a
+          # self-hoster can turn on before/after screenshot capture with just BROWSER_WS_ENDPOINT +
+          # GITTENSORY_REVIEW_SCREENSHOTS=true at runtime -- no custom image build required. Inert either
+          # way until those runtime flags are set (Dockerfile's INSTALL_VISUAL_REVIEW only controls
+          # whether the dependency is installed, never whether the feature runs).
           build-args: |
             GITTENSORY_VERSION=${{ steps.version.outputs.release }}
+            INSTALL_VISUAL_REVIEW=true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           provenance: true
diff --git a/Dockerfile b/Dockerfile
index 0e0c1d2140..5d73b086ff 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -60,7 +60,11 @@ RUN if [ "$INSTALL_AI_CLIS" = "true" ]; then npm install -g --foreground-scripts
 USER root
 # Optional: enable visual review via an external Chrome sidecar (docker-compose --profile visual-review
 # bundles `ghcr.io/browserless/chromium:latest`, or point at your own browserless-compatible instance).
-# Build with `--build-arg INSTALL_VISUAL_REVIEW=true` then set BROWSER_WS_ENDPOINT=<ws-url> at runtime.
+# Every official release image ships with this dependency installed (release-selfhost.yml passes
+# --build-arg INSTALL_VISUAL_REVIEW=true) -- just set BROWSER_WS_ENDPOINT=<ws-url> at runtime to use it.
+# The default here stays `false` for a LOCAL/custom build (`docker build .` with no build-arg) so building
+# straight from this Dockerfile without the release workflow doesn't silently install an unrequested
+# dependency.
 ARG INSTALL_VISUAL_REVIEW=false
 COPY package*.json ./
 RUN if [ "$INSTALL_VISUAL_REVIEW" = "true" ]; then npm install puppeteer-core@22.13.1 --ignore-scripts; fi
diff --git a/docker-compose.yml b/docker-compose.yml
index 48ce389266..ae7b0d7413 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -361,9 +361,10 @@ services:
   # it in two places — the server reads TOKEN below, the app embeds the same value in the client URL):
   #   BROWSERLESS_TOKEN=<a-strong-random-value>
   #   BROWSER_WS_ENDPOINT=ws://browserless:3000?token=<the-same-value>
-  # Then rebuild the app image with --build-arg INSTALL_VISUAL_REVIEW=true (installs puppeteer-core;
-  # see Dockerfile) and set GITTENSORY_REVIEW_SCREENSHOTS=true. Unset/default = fully inert, no
-  # container, no screenshots, no error — this whole feature is opt-in end to end.
+  # Then set GITTENSORY_REVIEW_SCREENSHOTS=true. Official release images already have puppeteer-core
+  # installed (release-selfhost.yml builds with --build-arg INSTALL_VISUAL_REVIEW=true) — a rebuild is
+  # only needed for a LOCAL/custom image build from this Dockerfile directly (see Dockerfile). Unset/
+  # default = fully inert, no container, no screenshots, no error — this whole feature is opt-in end to end.
   browserless:
     image: ghcr.io/browserless/chromium:latest
     restart: unless-stopped