diff --git a/ansible/roles/netbird-proxy/templates/docker-compose.yml.j2 b/ansible/roles/netbird-proxy/templates/docker-compose.yml.j2
index 9d6b0268..d86ff4a7 100644
--- a/ansible/roles/netbird-proxy/templates/docker-compose.yml.j2
+++ b/ansible/roles/netbird-proxy/templates/docker-compose.yml.j2
@@ -16,10 +16,15 @@ services:
     ports:
       - "443:443"
     volumes:
-      - /opt/netbird-proxy/certs:/certs
+      # Named volume (like VPS-1) — inherits the image's writable ownership so
+      # the non-root proxy can write ACME certs. A root-owned bind mount can't.
+      - netbird_proxy_certs:/certs
       - /opt/netbird-proxy/state:/var/lib/netbird
     logging:
       driver: "json-file"
       options:
         max-size: "500m"
         max-file: "2"
+
+volumes:
+  netbird_proxy_certs: