diff --git a/examples/app-showcase/README.md b/examples/app-showcase/README.md
index cb1c8e04563..a2ba0fd0470 100644
--- a/examples/app-showcase/README.md
+++ b/examples/app-showcase/README.md
@@ -40,6 +40,32 @@ pnpm dev            # → http://localhost:3000/_studio
 pnpm verify
 ```
 
+### Booting it walled (`isolated` / `group`)
+
+The showcase declares `@objectstack/organizations` (the Apache-2.0 multi-organization
+runtime, app-declared per ADR-0132 D3). `os serve` loads it only when
+`OS_TENANCY_POSTURE` is `isolated` or `group`; under `single`, the default, it is never
+loaded and the boot is unchanged. A production walled boot needs this env, with no edit
+to the app:
+
+```bash
+pnpm --filter '@objectstack/example-showcase^...' build   # once
+cd examples/app-showcase
+NODE_ENV=production \
+OS_TENANCY_POSTURE=isolated \
+OS_AUTH_SECRET=$(openssl rand -hex 32) \
+OS_SECRET_KEY=$(openssl rand -hex 32) \
+OS_DATABASE_URL=file:./.objectstack/data/app.db \
+OS_PLATFORM_OWNER_EMAIL=owner@example.com \
+OS_AUTH_MEMBERSHIP_POLICY=invite-only \
+  pnpm exec objectstack serve -p 3000
+```
+
+Each variable answers one boot refusal: the auth secret, the encryption key, the
+storage, the platform owner (a walled posture never promotes the first sign-up), and a
+declared membership policy (`invite-only` or an explicit `auto`). Keep both secrets
+stable across restarts of the same database.
+
 ## What it covers
 
 ### Data layer (ObjectQL)
diff --git a/examples/app-showcase/package.json b/examples/app-showcase/package.json
index a3bd0532d35..855a6a83abc 100644
--- a/examples/app-showcase/package.json
+++ b/examples/app-showcase/package.json
@@ -30,6 +30,7 @@
     "@objectstack/connector-rest": "workspace:*",
     "@objectstack/connector-slack": "workspace:*",
     "@objectstack/driver-sql": "workspace:*",
+    "@objectstack/organizations": "workspace:*",
     "@objectstack/runtime": "workspace:*",
     "@objectstack/service-datasource": "workspace:*",
     "@objectstack/service-i18n": "workspace:*",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 5faacde46ea..a5c12b11783 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -233,6 +233,9 @@ importers:
       '@objectstack/driver-sql':
         specifier: workspace:*
         version: link:../../packages/drivers/driver-sql
+      '@objectstack/organizations':
+        specifier: workspace:*
+        version: link:../../packages/plugins/organizations
       '@objectstack/runtime':
         specifier: workspace:*
         version: link:../../packages/runtime