diff --git a/src/Backend/SolutionErp.Api/appsettings.Development.json b/src/Backend/SolutionErp.Api/appsettings.Development.json
index 9c6fec8..bb67798 100644
--- a/src/Backend/SolutionErp.Api/appsettings.Development.json
+++ b/src/Backend/SolutionErp.Api/appsettings.Development.json
@@ -17,5 +17,9 @@
     "WriteTo": [
       { "Name": "Console" }
     ]
+  },
+  "DemoSeed": {
+    "_Comment": "Plan T S23 t10 — Dev override: false để test demo seed local. Production appsettings.json mặc định true (skip).",
+    "Disabled": false
   }
 }
diff --git a/src/Backend/SolutionErp.Api/appsettings.json b/src/Backend/SolutionErp.Api/appsettings.json
index 6fd4462..db516df 100644
--- a/src/Backend/SolutionErp.Api/appsettings.json
+++ b/src/Backend/SolutionErp.Api/appsettings.json
@@ -29,5 +29,9 @@
   },
   "Uploads": {
     "RootPath": "uploads"
+  },
+  "DemoSeed": {
+    "_Comment": "Plan T S23 t10 (2026-05-15) — DbInitializer skip auto re-seed Demo workflows + PE + Contracts khi true. Production UAT clean slate sau Plan R+S. Dev override false trong appsettings.Development.json để test fresh seed local.",
+    "Disabled": true
   }
 }
diff --git a/src/Backend/SolutionErp.Infrastructure/Persistence/DbInitializer.cs b/src/Backend/SolutionErp.Infrastructure/Persistence/DbInitializer.cs
index 6c1cad2..a7733f1 100644
--- a/src/Backend/SolutionErp.Infrastructure/Persistence/DbInitializer.cs
+++ b/src/Backend/SolutionErp.Infrastructure/Persistence/DbInitializer.cs
@@ -1,5 +1,6 @@
 using Microsoft.AspNetCore.Identity;
 using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Configuration;  // Plan T S23 t10 — DemoSeed:Disabled flag
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging;
 using SolutionErp.Application.Contracts.Services;
@@ -60,6 +61,23 @@ public static class DbInitializer
         logger.LogInformation("Applying migrations...");
         await db.Database.MigrateAsync();
 
+        // Plan T S23 t10 (2026-05-15) — DemoSeed:Disabled flag. Khi true thì skip
+        // 5 method auto-seed demo data:
+        //   - SeedWorkflowDefinitionsAsync (V1 PE workflow sample: QT-DN-A + QT-DN-B)
+        //   - SeedPurchaseEvaluationWorkflowsAsync (V1 PE workflow extended)
+        //   - SeedDemoContractsAsync ([DEMO] HĐ 7-type sample)
+        //   - SeedDemoPurchaseEvaluationsAsync ([DEMO] PE 4 sample)
+        //   - SeedSampleApprovalWorkflowsV2Async (V2 sample mẫu UAT cho type B)
+        // GIỮ: SeedRoles, SeedAdmin, SeedDepartments, SeedDemoUsers (30 user UAT),
+        // SeedMenuTree, SeedAdminPermissions, SeedDemoMasterData (Supplier/Project
+        // master), SeedContractTemplates (file template), SeedCatalogs, backfill
+        // helpers. Production UAT clean slate: bro toàn quyền setup workflow mới
+        // qua Designer.
+        var config = sp.GetRequiredService<IConfiguration>();
+        var demoSeedDisabled = config.GetValue<bool>("DemoSeed:Disabled");
+        if (demoSeedDisabled)
+            logger.LogInformation("DemoSeed:Disabled=true — skip workflow + contracts + PE + sample V2 seed (Plan T S23 t10)");
+
         await SeedRolesAsync(roleManager, logger);
         // Phase 6 rebrand: rename user email @solutionerp.local → @solutions.com.vn
         // TRƯỚC SeedAdmin để SeedAdmin tìm theo new email thấy user đã rename → skip create.
@@ -71,8 +89,11 @@ public static class DbInitializer
         await SeedAdminPermissionsAsync(db, roleManager, logger);
         await SeedDemoMasterDataAsync(db, logger);
         await SeedContractTemplatesAsync(db, logger);
-        await SeedWorkflowDefinitionsAsync(db, logger);
-        await SeedPurchaseEvaluationWorkflowsAsync(db, logger);
+        if (!demoSeedDisabled)
+        {
+            await SeedWorkflowDefinitionsAsync(db, logger);
+            await SeedPurchaseEvaluationWorkflowsAsync(db, logger);
+        }
         await SeedCatalogsAsync(db, logger);
 
         // Backfill mã HĐ cho HĐ legacy chưa có (sau khi đổi policy gen-tại-create).
@@ -80,9 +101,12 @@ public static class DbInitializer
         var codeGen = sp.GetRequiredService<IContractCodeGenerator>();
         await BackfillContractCodesAsync(db, codeGen, logger);
 
-        await SeedDemoContractsAsync(db, userManager, codeGen, logger);
-        await SeedDemoPurchaseEvaluationsAsync(db, userManager, logger);
-        await SeedSampleApprovalWorkflowsV2Async(db, userManager, logger);
+        if (!demoSeedDisabled)
+        {
+            await SeedDemoContractsAsync(db, userManager, codeGen, logger);
+            await SeedDemoPurchaseEvaluationsAsync(db, userManager, logger);
+            await SeedSampleApprovalWorkflowsV2Async(db, userManager, logger);
+        }
 
         await WarnDefaultAdminPasswordAsync(userManager, logger);
     }