diff --git a/.github/workflows/cd-apps.yml b/.github/workflows/cd-apps.yml
index c5cc328..47d285d 100644
--- a/.github/workflows/cd-apps.yml
+++ b/.github/workflows/cd-apps.yml
@@ -83,6 +83,13 @@ jobs:
           echo "DOMAIN=trails.cool" >> infrastructure/app.env
           # Flagship marker — see cd-infra.yml for what this gates.
           echo "IS_FLAGSHIP=true" >> infrastructure/app.env
+          # Federation on (social-federation rollout 12.5, flipped
+          # 2026-06-07 after the staging + Mastodon soak). The
+          # FEDERATION_KEY_ENCRYPTION_KEY comes from the SOPS env
+          # decrypted above. Rollback: delete these two lines, merge,
+          # rerun cd-apps — instant off, federation surfaces 404.
+          echo "FEDERATION_ENABLED=true" >> infrastructure/app.env
+          echo "FEDERATION_LOG_LEVEL=info" >> infrastructure/app.env
           # Sentry DSNs (public — see workflow top-level env for context).
           echo "SENTRY_DSN_JOURNAL=$SENTRY_DSN_JOURNAL" >> infrastructure/app.env
           echo "SENTRY_DSN_PLANNER=$SENTRY_DSN_PLANNER" >> infrastructure/app.env
diff --git a/infrastructure/docker-compose.yml b/infrastructure/docker-compose.yml
index ac25be8..dd2403b 100644
--- a/infrastructure/docker-compose.yml
+++ b/infrastructure/docker-compose.yml
@@ -53,6 +53,15 @@ services:
       WAHOO_CLIENT_ID: ${WAHOO_CLIENT_ID:-}
       WAHOO_CLIENT_SECRET: ${WAHOO_CLIENT_SECRET:-}
       WAHOO_WEBHOOK_TOKEN: ${WAHOO_WEBHOOK_TOKEN:-}
+      # Federation (ActivityPub, social-federation rollout 12.5). Empty
+      # = off: every federation surface 404s — the safe self-host
+      # default. The flagship turns it on via cd-apps.yml (same pattern
+      # as IS_FLAGSHIP); the encryption key comes from SOPS. Rollback is
+      # dropping the flag and redeploying — instant, follow rows
+      # persist. See docs/deployment.md "Federation runbook".
+      FEDERATION_ENABLED: ${FEDERATION_ENABLED:-}
+      FEDERATION_KEY_ENCRYPTION_KEY: ${FEDERATION_KEY_ENCRYPTION_KEY:-}
+      FEDERATION_LOG_LEVEL: ${FEDERATION_LOG_LEVEL:-}
       INTEGRATION_SECRET: ${INTEGRATION_SECRET:?INTEGRATION_SECRET must be set in SOPS secrets.app.env}
       # Demo-activity-bot. Disabled by default everywhere; flip to "true"
       # only in prod. When unset, DEMO_BOT_PERSONA uses the built-in
diff --git a/openspec/changes/social-federation/tasks.md b/openspec/changes/social-federation/tasks.md
index a143e99..03c3c41 100644
--- a/openspec/changes/social-federation/tasks.md
+++ b/openspec/changes/social-federation/tasks.md
@@ -109,7 +109,7 @@
   > Same staging soak: pushed Create(Note) rendered in the Mastodon home timeline (tombstone + 10s-timeout lessons recorded in design.md).
 - [ ] 12.4 Soak outbound trails-to-trails — bring up second trails instance (staging or self-host), follow across, both directions verified
   > Protocol mechanics fully verified by the two-instance harness (`e2e/federation/`, task 11.4) — which found and fixed the cross-origin Accept bug. Live surface is ready: PR previews run federated (#491), so the soak is: follow from staging.trails.cool to a user on `pr-<N>.staging.trails.cool` and back. Needs a seeded user on a preview (server-side); queued for the next operator session.
-- [ ] 12.5 Flip flag on; restore home marketing copy; document in deployment runbook
-  > Runbook documented (docs/deployment.md, 10.2) and the home blurb already states the accurate scope (10.3) — remaining: the prod `FEDERATION_ENABLED=true` flip, an operator decision.
+- [x] 12.5 Flip flag on; restore home marketing copy; document in deployment runbook
+  > Flipped 2026-06-07 (operator-approved): `FEDERATION_ENABLED=true` ships in cd-apps.yml's flagship env, with the compose wiring defaulting *off* for self-hosters. Home blurb already accurate (10.3), runbook documented (10.2). Applied via a manual cd-apps dispatch after merge.
 - [x] 12.6 Rollback: flag off (instant) or revert PR. Existing `follows` rows stay intact
   > Documented in the deployment runbook's federation section; flag-off instantly 404s every federation surface while rows persist.