diff --git a/app/services/enrichment/barcode/retry.py b/app/services/enrichment/barcode/retry.py
index ddf2515..82c98fd 100644
--- a/app/services/enrichment/barcode/retry.py
+++ b/app/services/enrichment/barcode/retry.py
@@ -1,8 +1,10 @@
 """
 Configurable retry-with-exponential-backoff for barcode source calls.
 
-Built on `tenacity`, already a project dependency (see requirements.txt -
-used elsewhere for httpx-based retries). Only retries on genuinely
+Built on `tenacity`, declared in requirements.txt. The import below is at
+module scope and this module sits on app/main.py's import path, so tenacity
+is a hard startup dependency, not an optional extra - without it the
+container exits 1 before uvicorn binds. Only retries on genuinely
 transient failures (network/timeout errors); a malformed response or a
 "no results" outcome is not retried, since retrying those wastes the
 source's rate-limit budget for no benefit (relevant for UPCItemDB's
diff --git a/requirements.txt b/requirements.txt
index 6647884..a3d4784 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -42,6 +42,16 @@ httpx>=0.27.2
 # POST /api/catalog/generate to pull in NEW brands. If you only ever use
 # the bundled seed data (scripts/seed_sample_data.py) + RAG chat/search,
 # you can skip everything below this line.
+# Retry/backoff for the barcode enrichment sources
+# (app/services/enrichment/barcode/retry.py). This is NOT an optional extra:
+# retry.py imports it at module scope, and that module is reached from
+# app/main.py's own import of the store_catalog router - so a missing tenacity
+# is not a degraded feature, it is the container exiting 1 on boot with
+# ModuleNotFoundError before uvicorn ever binds a socket. Swarm then restarts
+# it, and each restart re-runs ~21s of pandas/scipy/sklearn imports, which on a
+# 1-vCPU host reads as pinned-at-100% CPU rather than as a crash.
+tenacity>=8.2.3
+
 beautifulsoup4>=4.12.3
 lxml>=4.9.3
 python-slugify>=8.0.4