diff --git a/ansible/roles/netbird-proxy/templates/docker-compose.yml.j2 b/ansible/roles/netbird-proxy/templates/docker-compose.yml.j2
index d86ff4a7..695311ef 100644
--- a/ansible/roles/netbird-proxy/templates/docker-compose.yml.j2
+++ b/ansible/roles/netbird-proxy/templates/docker-compose.yml.j2
@@ -16,10 +16,11 @@ services:
     ports:
       - "443:443"
     volumes:
-      # Named volume (like VPS-1) — inherits the image's writable ownership so
-      # the non-root proxy can write ACME certs. A root-owned bind mount can't.
+      # Named volumes — they inherit the image's writable ownership, so the
+      # non-root proxy can write certs + netbird state. Root-owned bind mounts
+      # can't (permission denied on /certs and /var/lib/netbird).
       - netbird_proxy_certs:/certs
-      - /opt/netbird-proxy/state:/var/lib/netbird
+      - netbird_proxy_state:/var/lib/netbird
     logging:
       driver: "json-file"
       options:
@@ -28,3 +29,4 @@ services:
 
 volumes:
   netbird_proxy_certs:
+  netbird_proxy_state: