diff --git a/deploy/service-controller/service_controller.py b/deploy/service-controller/service_controller.py
index d1fa35b..3f2c3a6 100644
--- a/deploy/service-controller/service_controller.py
+++ b/deploy/service-controller/service_controller.py
@@ -117,9 +117,9 @@ def _do(kind: str, action: str, target: str, remote: str | None = None) -> str:
                          (system units; `remote` sends it over ssh)
 
     `systemd-system` requires a NOPASSWD sudoers rule for that exact
-    command+argument on the target host. On .27 this is granted for
-    `systemctl start|stop|restart ollama` (see hosts/sam-4screen-desktop),
-    where `target` must match the rule verbatim: "ollama", not "ollama.service".
+    command+argument on the target host, and `target` must match the rule
+    verbatim (e.g. "foo", not "foo.service"). No service currently uses this
+    kind — it is kept as a tested capability.
 
     Note: sudo matches the *literal* PATH-resolved path, and NixOS puts a
     symlink (`/run/current-system/sw/bin/systemctl`) on PATH, so a bare
diff --git a/deploy/service-controller/services.toml b/deploy/service-controller/services.toml
index b180a5b..b5f092b 100644
--- a/deploy/service-controller/services.toml
+++ b/deploy/service-controller/services.toml
@@ -10,7 +10,8 @@
 #   systemd-system  -> sudo -n systemctl start/stop <target>  (system units; `remote`
 #                      sends it over ssh). Needs a matching NOPASSWD sudoers rule on
 #                      the target host, and `target` must match it verbatim
-#                      ("ollama", not "ollama.service").
+#                      (e.g. "foo", not "foo.service").
+#                      NOTE: no service currently uses this kind.
 #
 # group "media": family-facing editors (shared by everyone).
 # group "pipeline": photo ingestion (prefect worker + dashboard) — admin only.
@@ -98,19 +99,3 @@ label = "World Monitor"
 ram_mb = 120
 default_state = "running"
 who = ["sam"]
-
-# Ollama on .27 — now a NixOS *system* service (services.ollama in
-# hosts/sam-4screen-desktop/configuration.nix). The old user unit was deleted, so
-# this must be toggled with `sudo systemctl`, not `systemctl --user`. Bound to
-# 0.0.0.0:11434 for OmniRoute/dsh on .13. Models live in /var/lib/ollama/models.
-# RAM is the loaded model; OLLAMA_KEEP_ALIVE=5m unloads it when idle.
-[[services]]
-id = "ollama"
-kind = "systemd-system"
-target = "ollama"
-remote = "sam@192.168.20.27"
-group = "ai"
-label = "Local LLM Server (Ollama .27)"
-ram_mb = 9000
-default_state = "running"
-who = ["sam", "jo", "harry", "finn"]
diff --git a/docs/portal-architecture.md b/docs/portal-architecture.md
index 68b3c0e..3a34a02 100644
--- a/docs/portal-architecture.md
+++ b/docs/portal-architecture.md
@@ -112,7 +112,6 @@ To allow family members to free up RAM on `.13` without exposing `/var/run/docke
 | `prefect-worker` | `prefect-worker` (systemd user) | ~129 MB | `pipeline` | `sam` |
 | `photo-dashboard` | `photo-dashboard` (systemd user) | ~112 MB | `pipeline` | `sam` |
 | `worldmonitor` | 4-container group (Container) | ~120 MB | `admin` | `sam` |
-| `ollama` | `ollama` on **`.27`** (`systemd-system`, via ssh) | ~9000 MB (loaded model) | `ai` | `sam`, `jo`, `harry`, `finn` |
 
 ### Controller kinds (`kind` in `services.toml`)
 
@@ -120,12 +119,12 @@ To allow family members to free up RAM on `.13` without exposing `/var/run/docke
 | :--- | :--- | :--- |
 | `container` | `docker start/stop <target>` | Same host (`.13`); `sam` is in the `docker` group. |
 | `systemd-user` | `systemctl --user <action> <target>` | Local `.13` user units (paperclip, prefect-worker, photo-dashboard). |
-| `systemd-system` | `sudo -n <canonical systemctl> <action> <target>` | System units, local or on a `remote` host over ssh. |
+| `systemd-system` | `sudo -n <canonical systemctl> <action> <target>` | System units, local or on a `remote` host over ssh. **Currently unused** — kept as a tested capability. |
 
-**`systemd-system` gotchas** (both were hit while wiring `ollama`):
+**`systemd-system` gotchas** (learned while it was in use; apply if it is ever wired up again):
 
 1. It needs a matching **NOPASSWD** sudoers rule on the target host, and the
-   `target` must match the rule verbatim — `ollama`, never `ollama.service`.
+   `target` must match the rule verbatim — `foo`, never `foo.service`.
 2. On NixOS, `systemctl` on `PATH` is a symlink (`/run/current-system/sw/bin/systemctl`)
    while the sudoers rule names the store path, and sudo matches the *literal*
    resolved path. A bare `sudo systemctl …` therefore does **not** match. The
diff --git a/portal/tools.py b/portal/tools.py
index cb81447..03991c4 100644
--- a/portal/tools.py
+++ b/portal/tools.py
@@ -85,9 +85,6 @@ def _cat() -> list[Tool]:
              "Chat admin console (admins only)", "https://pb.chat.lab.audasmedia.com.au", login=True, admin=True),
         Tool("ai-router", "AI Router", "ai",
              "OmniRoute LLM gateway dashboard", "https://omniroute.lab.audasmedia.com.au"),
-        Tool("ollama", "Ollama Local LLM", "ai",
-             "Local AI model server (Qwen 2.5 Coder on .27)", "http://192.168.20.27:11434",
-             service_id="ollama", ram_mb=9000, togglable=True, lan=True),
         Tool("n8n", "n8n", "ai",
              "Workflow automation", "https://n8n.lab.audasmedia.com.au", login=True),
         Tool("prefect", "Prefect", "ai",