diff --git a/Dockerfile b/Dockerfile
index e3a2877..d74fef7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -19,6 +19,9 @@ RUN chmod +x /app/code/start.sh
 
 # Default config — will be overridden by Cloudron env vars at runtime
 COPY config.yaml /app/data/config.yaml
+# A second copy inside the image: start.sh syncs it over the persistent
+# /app/data volume at boot, so config changes in the repo actually deploy.
+COPY config.yaml /app/code/config.yaml
 
 # Append the co-op credit-pack hint to LiteLLM's hardcoded budget-exceeded
 # messages. Done at BUILD time — the runtime rootfs is read-only under
diff --git a/README.md b/README.md
index 96bcb2b..13fff76 100644
--- a/README.md
+++ b/README.md
@@ -85,6 +85,14 @@ The following are auto-generated and should **not** be set manually:
 - `DATABASE_URL` — from Cloudron's PostgreSQL addon
 - `REDIS_HOST`, `REDIS_PORT`, `REDIS_PASSWORD` — from Cloudron's Redis addon
 
+### Config deployment
+
+`config.yaml` ships **with the image** and `start.sh` syncs it over the persistent
+`/app/data/config.yaml` at boot whenever they differ. The volume copy would
+otherwise shadow the image's file forever — which is exactly how a config change
+can be merged, built and "deployed" while the gateway keeps serving the old
+configuration. Change the repo and redeploy; never edit the volume copy directly.
+
 ### Admin access
 
 The LiteLLM admin UI and API docs are **disabled** on the public gateway (hardened by default; see `start.sh`). Administrative operations run through the [member portal](https://git.inference.coop/code/member-portal), which holds the master key server-side. If direct LiteLLM admin access is ever needed, re-enable the UI in `start.sh`, redeploy, and use the master key from `/app/data/.master_key` — then disable it again.
diff --git a/start.sh b/start.sh
index 2583ce6..0414d38 100644
--- a/start.sh
+++ b/start.sh
@@ -150,6 +150,17 @@ YAML
     echo "Config written to $CONFIG_FILE"
 fi
 
+# --- Ship config updates with the image ---
+# /app/data is a persistent volume, so the copy the Dockerfile bakes into
+# /app/data/config.yaml is shadowed by the volume's file forever — config
+# changes in the repo would never reach a running gateway. The repo is the
+# source of truth (README: repos mirror production), so sync the shipped copy
+# over the volume whenever they differ.
+if [ -f /app/code/config.yaml ] && ! cmp -s /app/code/config.yaml "$CONFIG_FILE"; then
+    echo "Updating /app/data/config.yaml from the image (repo is the source of truth)"
+    cp /app/code/config.yaml "$CONFIG_FILE"
+fi
+
 # --- Start LiteLLM ---
 echo "Starting LiteLLM on port 4000..."