diff --git a/docker-compose.yml b/docker-compose.yml
index 7f9c973..9da0ee4 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -52,7 +52,7 @@ services:
       - /tmp:noexec,nosuid,size=64m
       - /var/cache/nginx:noexec,nosuid,size=64m
       - /var/run:noexec,nosuid,size=64m
-      - /etc/nginx/conf.d:noexec,nosuid,size=1m,uid=101,gid=101
+      - /etc/nginx/conf.d:noexec,nosuid,size=1m
     cap_drop:
       - ALL
 
diff --git a/frontend/Dockerfile b/frontend/Dockerfile
index 2895395..b5a90b1 100644
--- a/frontend/Dockerfile
+++ b/frontend/Dockerfile
@@ -32,6 +32,11 @@ RUN npm run build
 # -----------------------------------------------------------------------------
 FROM nginxinc/nginx-unprivileged:1.27-alpine AS runner
 
+# Redirect envsubst output to /tmp (writable under read_only: true)
+# and update nginx main config to include from there instead of /etc/nginx/conf.d/
+ENV NGINX_ENVSUBST_OUTPUT_DIR=/tmp
+RUN sed -i 's|include /etc/nginx/conf.d/\*.conf;|include /tmp/default.conf;|' /etc/nginx/nginx.conf
+
 # Copy custom nginx config as template for envsubst processing
 # nginx-unprivileged automatically substitutes env vars in .template files
 COPY nginx.conf /etc/nginx/templates/default.conf.template