diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 0dc6e69..4534b2e 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -160,6 +160,11 @@ jobs:
           export RENDEZVOUS_UDP_HOST_PORT="$(( 40000 + port_suffix ))"
           export RENDEZVOUS_SMOKE_HTTP_URL="http://127.0.0.1:${RENDEZVOUS_HTTP_HOST_PORT}/"
           export RENDEZVOUS_SMOKE_UDP_ENDPOINT="127.0.0.1:${RENDEZVOUS_UDP_HOST_PORT}"
+          runner_workspace_source="$(docker inspect "$HOSTNAME" | jq -er \
+            --arg destination "$GITHUB_WORKSPACE" \
+            '.[0].Mounts[] | select(.Destination == $destination) | .Source')"
+          export RENDEZVOUS_CONFIG_SOURCE="$runner_workspace_source/deploy/compose/appsettings.Production.json"
+          export RENDEZVOUS_SECRET_SOURCE="$runner_workspace_source/deploy/compose/secrets/signing-key"
           export SOURCE_REVISION_ID="$GITHUB_SHA"
           docker compose -f "$compose_file" build \
             --build-arg SOURCE_REVISION_ID="$SOURCE_REVISION_ID"
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index d1ae279..44458e6 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -128,6 +128,11 @@ jobs:
           export RENDEZVOUS_UDP_HOST_PORT="$(( 40000 + port_suffix ))"
           export RENDEZVOUS_SMOKE_HTTP_URL="http://127.0.0.1:${RENDEZVOUS_HTTP_HOST_PORT}/"
           export RENDEZVOUS_SMOKE_UDP_ENDPOINT="127.0.0.1:${RENDEZVOUS_UDP_HOST_PORT}"
+          runner_workspace_source="$(docker inspect "$HOSTNAME" | jq -er \
+            --arg destination "$GITHUB_WORKSPACE" \
+            '.[0].Mounts[] | select(.Destination == $destination) | .Source')"
+          export RENDEZVOUS_CONFIG_SOURCE="$runner_workspace_source/deploy/compose/appsettings.Production.json"
+          export RENDEZVOUS_SECRET_SOURCE="$runner_workspace_source/deploy/compose/secrets/signing-key"
           export RENDEZVOUS_IMAGE="git.finalfactory.de/heikyu/rendezvous:${RENDEZVOUS_VERSION}"
           docker compose -f deploy/compose/compose.yaml up --detach --no-build
           for attempt in {1..100}; do
diff --git a/deploy/compose/compose.yaml b/deploy/compose/compose.yaml
index 59ea1cf..df98ae1 100644
--- a/deploy/compose/compose.yaml
+++ b/deploy/compose/compose.yaml
@@ -30,8 +30,8 @@ services:
       Rendezvous__Diagnostics__Enabled: "${RENDEZVOUS_DIAGNOSTICS_ENABLED:-false}"
       Rendezvous__Metrics__Enabled: "${RENDEZVOUS_METRICS_ENABLED:-false}"
     volumes:
-      - ./appsettings.Production.json:/app/appsettings.Production.json:ro
-      - ./secrets/signing-key:/run/secrets/rendezvous-signing-key:ro
+      - ${RENDEZVOUS_CONFIG_SOURCE:-./appsettings.Production.json}:/app/appsettings.Production.json:ro
+      - ${RENDEZVOUS_SECRET_SOURCE:-./secrets/signing-key}:/run/secrets/rendezvous-signing-key:ro
     ports:
       - "127.0.0.1:${RENDEZVOUS_HTTP_HOST_PORT:-8080}:8080/tcp"
       - "${RENDEZVOUS_UDP_HOST_PORT:-9050}:9050/udp"
diff --git a/docs/deployment/linux.md b/docs/deployment/linux.md
index f530c7e..8dd6ffc 100644
--- a/docs/deployment/linux.md
+++ b/docs/deployment/linux.md
@@ -46,7 +46,10 @@ The example defaults to host TCP 8080 and UDP 9050. On a shared host, set
 `RENDEZVOUS_HTTP_HOST_PORT` and `RENDEZVOUS_UDP_HOST_PORT` before starting
 Compose, then point `RENDEZVOUS_SMOKE_HTTP_URL` and
 `RENDEZVOUS_SMOKE_UDP_ENDPOINT` at those published ports. The container ports
-and production-advertised service ports remain 8080/9050.
+and production-advertised service ports remain 8080/9050. Sibling-container CI
+runners may also set `RENDEZVOUS_CONFIG_SOURCE` and
+`RENDEZVOUS_SECRET_SOURCE` to host-visible absolute bind-source paths; local
+operators should normally keep the checked-in relative defaults.
 
 `deploy/compose/appsettings.Production.json` is a local/private-bridge smoke
 profile, not an Internet template: TCP is published only on host loopback, the
diff --git a/tests/FinalFactory.Rendezvous.Tests/Release/ReleaseCompatibilityTests.cs b/tests/FinalFactory.Rendezvous.Tests/Release/ReleaseCompatibilityTests.cs
index 90d3cea..fa790c3 100644
--- a/tests/FinalFactory.Rendezvous.Tests/Release/ReleaseCompatibilityTests.cs
+++ b/tests/FinalFactory.Rendezvous.Tests/Release/ReleaseCompatibilityTests.cs
@@ -171,6 +171,8 @@ public sealed class ReleaseCompatibilityTests
         string compose = File.ReadAllText(Path.Combine(root, "deploy/compose/compose.yaml"));
         Assert.Contains("${RENDEZVOUS_HTTP_HOST_PORT:-8080}:8080/tcp", compose, StringComparison.Ordinal);
         Assert.Contains("${RENDEZVOUS_UDP_HOST_PORT:-9050}:9050/udp", compose, StringComparison.Ordinal);
+        Assert.Contains("${RENDEZVOUS_CONFIG_SOURCE:-./appsettings.Production.json}", compose, StringComparison.Ordinal);
+        Assert.Contains("${RENDEZVOUS_SECRET_SOURCE:-./secrets/signing-key}", compose, StringComparison.Ordinal);
 
         foreach (string workflowName in new[] { "ci.yml", "release.yml" })
         {
@@ -180,6 +182,9 @@ public sealed class ReleaseCompatibilityTests
             Assert.Contains("RENDEZVOUS_UDP_HOST_PORT", workflow, StringComparison.Ordinal);
             Assert.Contains("RENDEZVOUS_SMOKE_HTTP_URL", workflow, StringComparison.Ordinal);
             Assert.Contains("RENDEZVOUS_SMOKE_UDP_ENDPOINT", workflow, StringComparison.Ordinal);
+            Assert.Contains("runner_workspace_source", workflow, StringComparison.Ordinal);
+            Assert.Contains("RENDEZVOUS_CONFIG_SOURCE", workflow, StringComparison.Ordinal);
+            Assert.Contains("RENDEZVOUS_SECRET_SOURCE", workflow, StringComparison.Ordinal);
         }
     }