diff --git a/deploy/thermograph.env.example b/deploy/thermograph.env.example
index 2738f9f..832cb9e 100644
--- a/deploy/thermograph.env.example
+++ b/deploy/thermograph.env.example
@@ -8,7 +8,9 @@ PORT=8137
 # (e.g. a cache-miss weather lookup) from blocking every other request — the cause of
 # past brief outages. Prod runs 3; leave unset (defaults to 1) on a small box. Workers
 # share one metrics store (THERMOGRAPH_METRICS_DB, defaulted in the systemd unit) so the
-# ops dashboard still sees the whole picture. ~200 MB RAM per worker.
+# ops dashboard still sees the whole picture, and elect one leader for the subscription
+# notifier via a lockfile (THERMOGRAPH_SINGLETON_LOCK, also defaulted in the unit) so its
+# timer-driven upstream sweep runs once, not once per worker. ~200 MB RAM per worker.
 WORKERS=3
 
 # Base path the app is served under.
diff --git a/deploy/thermograph.service b/deploy/thermograph.service
index e08e8d5..58c1bd4 100644
--- a/deploy/thermograph.service
+++ b/deploy/thermograph.service
@@ -16,6 +16,10 @@ WorkingDirectory=/opt/thermograph/backend
 # dashboard, polling one random worker, would see only a fraction of the traffic.
 Environment=WORKERS=1
 Environment=THERMOGRAPH_METRICS_DB=/opt/thermograph/data/metrics.db
+# Elect one worker to run the subscription notifier (its timer-driven upstream sweep
+# must run once across the deploy, not once per worker — else it multiplies the
+# Open-Meteo quota use). Workers race for this lockfile; the winner runs the notifier.
+Environment=THERMOGRAPH_SINGLETON_LOCK=/opt/thermograph/data/notifier.lock
 # THERMOGRAPH_BASE, PORT, WORKERS, etc. See deploy/thermograph.env.example.
 EnvironmentFile=/etc/thermograph.env
 # Clear the shared metrics DB on each (re)start so the dashboard's "since start" tallies