diff --git a/docs/CONFIGURATION.md b/docs/CONFIGURATION.md
index 14b85aa2b9..9cb9dbde06 100644
--- a/docs/CONFIGURATION.md
+++ b/docs/CONFIGURATION.md
@@ -327,12 +327,14 @@ TLS_CERT_FILE=/etc/pulse/cert.pem
 TLS_KEY_FILE=/etc/pulse/key.pem
 
 # Docker
-docker run -e HTTPS_ENABLED=true \
+docker run --init -e HTTPS_ENABLED=true \
   -v /path/to/certs:/certs \
   -e TLS_CERT_FILE=/certs/cert.pem \
   -e TLS_KEY_FILE=/certs/key.pem ...
 ```
 
+> **Important (Docker with HTTPS)**: Always use `--init` (or `init: true` in docker-compose) when enabling HTTPS. The Alpine-based healthcheck uses busybox `wget`, which spawns `ssl_client` subprocesses. Without an init process to reap them, these become zombie processes over time.
+
 ---
 
 ## 🛡️ Security Best Practices
diff --git a/scripts/install.sh b/scripts/install.sh
index ec37517fb5..ec0d71b2e0 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -1437,6 +1437,8 @@ if command -v systemctl >/dev/null 2>&1; then
         EXEC_ARGS="$EXEC_ARGS --enable-host=false"
     fi
     if [[ "$ENABLE_DOCKER" == "true" ]]; then EXEC_ARGS="$EXEC_ARGS --enable-docker"; fi
+    # Pass explicit false when Docker was explicitly disabled (prevents auto-detection)
+    if [[ "$ENABLE_DOCKER" == "false" && "$DOCKER_EXPLICIT" == "true" ]]; then EXEC_ARGS="$EXEC_ARGS --enable-docker=false"; fi
     if [[ "$ENABLE_KUBERNETES" == "true" ]]; then EXEC_ARGS="$EXEC_ARGS --enable-kubernetes"; fi
     if [[ -n "$KUBECONFIG_PATH" ]]; then EXEC_ARGS="$EXEC_ARGS --kubeconfig ${KUBECONFIG_PATH}"; fi
     if [[ "$ENABLE_PROXMOX" == "true" ]]; then EXEC_ARGS="$EXEC_ARGS --enable-proxmox"; fi