diff --git a/files/common/lib/systemd/system/nfs-server.service.d/override.conf b/files/common/lib/systemd/system/nfs-server.service.d/override.conf
index ba4723e3a..ebed4958a 100644
--- a/files/common/lib/systemd/system/nfs-server.service.d/override.conf
+++ b/files/common/lib/systemd/system/nfs-server.service.d/override.conf
@@ -14,3 +14,11 @@ ExecStartPost=-/bin/sh -c "echo 65536 > /proc/fs/nfsd/max_connections"
 # running when inside of the container.
 #
 ConditionVirtualization=!container
+#
+# Port 2049 (NFS) is closed by default on most appliance variants: image
+# build creates /etc/nfs_disable, and while it exists systemd will not
+# start this service -- even a manual "systemctl start" is a no-op. Multiple
+# Condition*= keys are ANDed together, so this does not weaken the container
+# check above.
+#
+ConditionPathExists=!/etc/nfs_disable
diff --git a/files/common/var/lib/delphix-platform/ansible/10-delphix-platform/roles/delphix-platform/tasks/main.yml b/files/common/var/lib/delphix-platform/ansible/10-delphix-platform/roles/delphix-platform/tasks/main.yml
index 0f20ed717..dd0ad5b33 100644
--- a/files/common/var/lib/delphix-platform/ansible/10-delphix-platform/roles/delphix-platform/tasks/main.yml
+++ b/files/common/var/lib/delphix-platform/ansible/10-delphix-platform/roles/delphix-platform/tasks/main.yml
@@ -199,6 +199,30 @@
 #
 - command: systemctl mask nfs-blkmap.service
 
+#
+# Close port 2049 by default on every appliance variant except the ones
+# listed below (internal engineering/test/infra images, left untouched).
+# A "delphix engine" variant (internal-dev, internal-qa, external-standard)
+# re-enables this at setup time if VIRTUALIZATION or BOTH is chosen -- see
+# ProductServiceImpl#setEngineType(). DCT/Hyperscale/UCF variants never
+# re-enable it; it is a permanent fact about those variants.
+#
+# ansible_is_chroot restricts this to image-build time ONLY. Without it,
+# this task re-runs on every real engine's first boot after every upgrade
+# of the delphix-platform package (debian/prerm deletes ansible-done on
+# every upgrade), which would recreate /etc/nfs_disable on a live
+# VIRTUALIZATION/BOTH engine and silently undo NfsServerAccess.enable().
+# Existing engines are retrofitted by UpgradeManagerImpl#postUpgradeCleanup
+# instead -- keep the leave-alone list below in sync with that Java logic.
+#
+- file:
+    path: /etc/nfs_disable
+    state: touch
+  when:
+    - ansible_is_chroot
+    - variant not in ['internal-minimal', 'internal-unittest', 'internal-dcenter',
+                       'internal-buildserver', 'internal-package-mirror', 'internal-claude']
+
 #
 # By default, the ulimit for core files is set to 0, and the default
 # filename and location for a core file is 'core' in the cwd. Update