diff --git a/examples/cosmos3/Dockerfile b/examples/cosmos3/Dockerfile
index af8aa4c673c1..7cca53876b54 100644
--- a/examples/cosmos3/Dockerfile
+++ b/examples/cosmos3/Dockerfile
@@ -6,11 +6,9 @@
 # There is no DeepInfra copy of the framework repo — this directory plus the
 # pin below is the complete, reviewable definition of the image.
 #
-# Build (from this directory; token file must hold an HF token whose account
-# has accepted the nvidia/Cosmos-Guardrail1 auto-gate — the secret mount keeps
-# it out of image layers and history):
-#   docker build --secret id=hf_token,src=/path/to/token-file \
-#     -t localhost:30500/cosmos3-worker:v1 .
+# Build (from this directory; no HF token needed — all prefetched repos are
+# public now that the gated Cosmos-Guardrail1 snapshot is no longer fetched):
+#   docker build -t localhost:30500/cosmos3-worker:v1 .
 
 ARG CUDA_VERSION=13.0.2
 ARG BASE_IMAGE=nvidia/cuda:${CUDA_VERSION}-cudnn-devel-ubuntu24.04
@@ -49,7 +47,7 @@ RUN git clone --filter=blob:none ${COSMOS_FRAMEWORK_REPO} /workspace && \
 # NOTE: patches are applied LAST (near the entrypoint), not here. cosmos_framework
 # is installed editable (`uv pip install -e`), so patching /workspace afterward is
 # picked up live at runtime — and keeping the patch layer last means editing a
-# patch rebuilds in seconds instead of re-running the ~11GB gated HF prefetch.
+# patch rebuilds in seconds instead of re-running the HF prefetch below.
 RUN --mount=type=cache,target=/root/.cache/uv uv python install
 RUN echo "$CUDA_VERSION" | sed -E 's/^([0-9]+)\.([0-9]+).*/cu\1\2/' > /root/.cuda-name
 RUN --mount=type=cache,target=/root/.cache/uv \
@@ -73,20 +71,19 @@ RUN --mount=type=cache,target=/root/.cache/uv \
 RUN --mount=type=cache,target=/root/.cache/uv \
     uv pip install --no-deps -e /workspace
 
-# Pre-fetch HuggingFace dependencies needed by cosmos_framework at model init
-# time: Qwen tokenizer configs (*.json, *.txt — few MB), Wan VAE checkpoints,
-# and the full Cosmos-Guardrail1 snapshot (the one gated repo — auto-approve
-# gate; the token account must have accepted it). The token comes in via a
-# BuildKit secret mount so it never persists in a layer or in image history.
-# This eliminates any runtime dependency on HuggingFace availability.
+# Pre-fetch the public HuggingFace dependencies cosmos_framework needs at model
+# init time: Qwen tokenizer configs (*.json, *.txt — few MB) and the Wan VAE
+# checkpoints. All are public repos, so the build needs NO HF token. This
+# eliminates any runtime dependency on HuggingFace availability.
 # Revisions MUST match the pins in
-# cosmos_framework/inference/common/checkpoints.py and
-# cosmos_framework/auxiliary/guardrail/common/core.py at the ref above — the
+# cosmos_framework/inference/common/checkpoints.py at the ref above — the
 # runtime looks up these exact revisions; a mismatch silently falls back to a
 # live (unauthenticated, rate-limited) HF fetch at every pod boot.
-RUN --mount=type=secret,id=hf_token \
-    export HF_TOKEN=$(cat /run/secrets/hf_token 2>/dev/null || true) && \
-    uvx hf@1.13.0 download --format=json \
+# NOTE: the gated nvidia/Cosmos-Guardrail1 snapshot is intentionally NOT fetched
+# — guardrails are disabled in worker.py (guardrails=False), so it is never
+# loaded at runtime. Re-add its download here (and the BuildKit hf_token secret
+# it needs) if guardrails are ever turned back on.
+RUN uvx hf@1.13.0 download --format=json \
         Qwen/Qwen3-0.6B \
         --repo-type model \
         --revision c1899de289a04d12100db370d81485cdf75e47ca \
@@ -115,11 +112,7 @@ RUN --mount=type=secret,id=hf_token \
         Wan-AI/Wan2.2-TI2V-5B \
         --repo-type model \
         --revision 921dbaf3f1674a56f47e83fb80a34bac8a8f203e \
-        Wan2.2_VAE.pth && \
-    uvx hf@1.13.0 download --format=json \
-        nvidia/Cosmos-Guardrail1 \
-        --repo-type model \
-        --revision d6d4bfa899a71454a700907664f3e88f503950cf
+        Wan2.2_VAE.pth
 
 # DeepInfra runtime settings.
 # - LD_LIBRARY_PATH is cleared so the venv/CUDA libs resolve without host leakage.