diff --git a/dev2/README.md b/dev2/README.md
index 46131cf..d404616 100644
--- a/dev2/README.md
+++ b/dev2/README.md
@@ -32,7 +32,7 @@ dev2-site migrate <site> --yes   the whole move, resumable; each step below is a
 | `railway-stop` | `deploymentRemove` + `serviceDisconnect` (or the next push silently redeploys on Railway) |
 | `merge` | merges the scaffold PR; CI deploys the default branch to dev2 |
 | `retire` | `--yes`: `serviceDelete` for the app, companions and data services. Only after `verify --public` |
-| `supabase-stack` | (kind `supabase`, second pass) a self-hosted Supabase stack of its own under `~/www/<site>/supabase` (compose project `<slug>-supabase`, api `8200+n`, db `5500+n`, pooler `6600+n`, subnet `172.31.(100+n).0/24`, `n = port-3200`), public host `supabase.<site>` added to the site's cert/vhost/dns via `sites.d`. The `auth` service also reads `volumes/auth/auth.env` (created empty, 0600), which holds the site's `GOTRUE_*` settings that the base compose file only ships commented out. For example, phone sign-in needs `GOTRUE_SMS_PROVIDER=twilio` and the `GOTRUE_SMS_TWILIO_*` credentials there |
+| `supabase-stack` | (kind `supabase`, second pass) a self-hosted Supabase stack of its own under `~/www/<site>/supabase` (compose project `<slug>-supabase`, api `8200+n`, db `5500+n`, pooler `6600+n`, subnet `172.31.(100+n).0/24`, `n = port-3200`), public host `supabase.<site>` added to the site's cert/vhost/dns via `sites.d`. The `auth` service also reads `volumes/auth/auth.env` (created empty, 0600), which holds the site's `GOTRUE_*` settings that the base compose file only ships commented out. For example, phone sign-in needs `GOTRUE_SMS_PROVIDER=twilio` and the `GOTRUE_SMS_TWILIO_*` credentials there. Phone signup is off unless auth.env sets `GOTRUE_SMS_PROVIDER` or `GOTRUE_HOOK_SEND_SMS_ENABLED`, and phone (like email) autoconfirm is always off: upstream ships both on, which hands a session to any made-up number |
 | `supabase-pull` | dumps the cloud project through its session pooler (password from the app's `SUPABASE_DB_PASSWORD`, or `--reset-password` through the management API) into `/root/dumps/<slug>-supabase-<ts>` |
 | `supabase-load` | loads it (extensions, schema, data, grants, buckets, absolute storage-URL rewrite over every text/json column, realtime, cron) |
 | `supabase-storage` | copies every Storage object through the two Storage APIs (node in a container on dev2; resumable) |
diff --git a/dev2/templates/supabase-stack.sh b/dev2/templates/supabase-stack.sh
index d4456b0..2009596 100755
--- a/dev2/templates/supabase-stack.sh
+++ b/dev2/templates/supabase-stack.sh
@@ -228,6 +228,17 @@ set_env POOLER_PROXY_PORT_TRANSACTION "$POOLER_PORT"
 set_env DISABLE_SIGNUP false
 set_env ENABLE_EMAIL_SIGNUP true
 set_env ENABLE_EMAIL_AUTOCONFIRM false
+# Upstream .env.example ships phone signup ON with SMS autoconfirm ON. With no
+# SMS provider, POST /auth/v1/signup {phone,password} then returns a live session
+# for any made-up number, skipping email confirmation entirely; with a provider,
+# autoconfirm still skips the OTP. So: autoconfirm always off, and phone signup
+# only on for a site whose auth.env configures a way to send the SMS.
+set_env ENABLE_PHONE_AUTOCONFIRM false
+if grep -qE '^GOTRUE_(SMS_PROVIDER|HOOK_SEND_SMS_ENABLED)=' "$DIR/volumes/auth/auth.env" 2>/dev/null; then
+  set_env ENABLE_PHONE_SIGNUP true
+else
+  set_env ENABLE_PHONE_SIGNUP false
+fi
 if [ -n "${SMTP_PASS:-}" ]; then
   set_env SMTP_HOST smtp.resend.com; set_env SMTP_PORT 465; set_env SMTP_USER resend; set_env SMTP_PASS "$SMTP_PASS"
   set_env SMTP_SENDER_NAME "${SMTP_SENDER:-$SITE}"; set_env SMTP_ADMIN_EMAIL "${SMTP_ADMIN:-noreply@$SITE}"