diff --git a/DOCKER.md b/DOCKER.md
index 9f3a590..2adadb8 100644
--- a/DOCKER.md
+++ b/DOCKER.md
@@ -50,9 +50,15 @@ Additional environment variables are optional:
 Use the `docker-compose.yml` file provided in the repository (or download the
 [raw file from GitHub](https://raw.githubusercontent.com/l5yth/potato-mesh/main/docker-compose.yml)).
 It already references the published GHCR images, defines persistent volumes for
-data and logs, and includes optional bridge-profile services for environments
-that require classic port mapping. Place this file in the same directory as
-your `.env` file so Compose can pick up both.
+data, configuration, and logs, and includes optional bridge-profile services for
+environments that require classic port mapping. Place this file in the same
+directory as your `.env` file so Compose can pick up both.
+
+The dedicated configuration volume binds to `/app/.config/potato-mesh` inside
+the container. This path stores the instance private key and staged
+`/.well-known/potato-mesh` documents. Because the volume persists independently
+of container lifecycle events, generated credentials are not replaced on reboot
+or re-deploy.
 
 ## Start the stack
 
diff --git a/README.md b/README.md
index e2b571a..f84c8bd 100644
--- a/README.md
+++ b/README.md
@@ -81,6 +81,11 @@ The migrated key is written to `<XDG_CONFIG_HOME>/potato-mesh/keyfile` and the
 well-known document is staged in
 `<XDG_CONFIG_HOME>/potato-mesh/well-known/potato-mesh`.
 
+When deploying with Docker Compose, the default `docker-compose.yml` mounts a
+named volume at `/app/.config/potato-mesh` to persist these files. Avoid
+removing this volume once a key has been generated so the instance identity and
+well-known metadata remain stable across restarts.
+
 The web app can be configured with environment variables (defaults shown):
 
 * `SITE_NAME` - title and header shown in the UI (default: "PotatoMesh Demo")
diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml
index 9520e39..97ac8d6 100644
--- a/docker-compose.dev.yml
+++ b/docker-compose.dev.yml
@@ -6,6 +6,7 @@ services:
     volumes:
       - ./web:/app
       - ./data:/app/.local/share/potato-mesh
+      - ./.config/potato-mesh:/app/.config/potato-mesh
       - /app/vendor/bundle
 
   web-bridge:
@@ -14,6 +15,7 @@ services:
     volumes:
       - ./web:/app
       - ./data:/app/.local/share/potato-mesh
+      - ./.config/potato-mesh:/app/.config/potato-mesh
       - /app/vendor/bundle
     ports:
       - "41447:41447"
@@ -25,6 +27,7 @@ services:
     volumes:
       - ./data:/app
       - ./data:/app/.local/share/potato-mesh
+      - ./.config/potato-mesh:/app/.config/potato-mesh
       - /app/.local
 
   ingestor-bridge:
@@ -33,4 +36,5 @@ services:
     volumes:
       - ./data:/app
       - ./data:/app/.local/share/potato-mesh
+      - ./.config/potato-mesh:/app/.config/potato-mesh
       - /app/.local
diff --git a/docker-compose.yml b/docker-compose.yml
index 8fd9500..0eef588 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -14,6 +14,7 @@ x-web-base: &web-base
   command: ["ruby", "app.rb", "-p", "41447", "-o", "0.0.0.0"]
   volumes:
     - potatomesh_data:/app/.local/share/potato-mesh
+    - potatomesh_config:/app/.config/potato-mesh
     - potatomesh_logs:/app/logs
   restart: unless-stopped
   deploy:
@@ -35,6 +36,7 @@ x-ingestor-base: &ingestor-base
     DEBUG: ${DEBUG:-0}
   volumes:
     - potatomesh_data:/app/.local/share/potato-mesh
+    - potatomesh_config:/app/.config/potato-mesh
     - potatomesh_logs:/app/logs
   devices:
     - ${CONNECTION:-/dev/ttyACM0}:${CONNECTION:-/dev/ttyACM0}
@@ -85,6 +87,8 @@ services:
 volumes:
   potatomesh_data:
     driver: local
+  potatomesh_config:
+    driver: local
   potatomesh_logs:
     driver: local