diff --git a/MEMORY-GUIDE.md b/MEMORY-GUIDE.md
index 04b76d9..690e810 100644
--- a/MEMORY-GUIDE.md
+++ b/MEMORY-GUIDE.md
@@ -18,7 +18,7 @@
 | **Base AlmaLinux 10** | ~80-120MB | Minimal base system |
 | **Node.js Runtime** | ~30-50MB | V8 JavaScript engine |
 | **PM2 Process Manager** | ~15-25MB | Process monitoring and management |
-| **Nginx (Optimized)** | ~8-15MB | Single worker, limited buffers |
+| **Nginx (Optimized)** | ~8-15MB | Single worker; header buffers allocated on demand |
 | **User Application** | ~50-200MB | Depends on application complexity |
 | **Memcached (DEV mode)** | ~10-15MB | 32MB memory limit, actual usage varies |
 | **System Overhead** | ~30-50MB | Logging, cron, system processes |
@@ -33,7 +33,11 @@
 2. **PM2 Memory Restart**: Applications restart at 256MB usage
 3. **Memcached Limit**: 32MB maximum cache size
 4. **Nginx Workers**: Single worker process for memory efficiency
-5. **Buffer Limits**: Reduced client buffer sizes
+5. **Buffer Limits**: Reduced client body buffer (16k) and 8MB max body size.
+   Header buffers use the nginx default (`large_client_header_buffers 4 8k`)
+   rather than a reduced value -- a smaller limit rejects ordinary session
+   cookies with a 400. These are allocated per request only when a request
+   actually needs them, not preallocated per connection.
 6. **Log Buffering**: 2-minute flush intervals to reduce I/O
 
 ### Application-Level Recommendations
diff --git a/scripts/entrypoint.sh b/scripts/entrypoint.sh
index 37de07a..109fbc7 100755
--- a/scripts/entrypoint.sh
+++ b/scripts/entrypoint.sh
@@ -102,6 +102,12 @@ tail -F /home/$user/logs/nginx/access.log \
 # When pm2 exits (e.g. max_restarts exhausted), dumb-init exits and Docker's
 # restart policy brings the container back.
 # (dumb-init replaces tini, which is not packaged in EPEL 10.)
+#
+# --single-child is required for parity with tini. dumb-init defaults to
+# setsid() plus forwarding signals to the whole process group, whereas tini
+# without -g forwards only to its direct child. Without this flag a
+# `docker stop` would signal the tenant's node process directly and at the
+# same moment as pm2, bypassing pm2's kill_timeout shutdown sequencing.
 echo "Starting PM2 as user $user (under dumb-init as PID 1)..."
 cd /home/$user/app
-exec dumb-init -- su - $user -c "cd /home/$user/app && NODE_ENV=production pm2 start ecosystem.config.js --no-daemon"
\ No newline at end of file
+exec dumb-init --single-child -- su - $user -c "cd /home/$user/app && NODE_ENV=production pm2 start ecosystem.config.js --no-daemon"
\ No newline at end of file