diff --git a/docker-compose.yml b/docker-compose.yml
index b886bef..cbb2813 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -95,12 +95,16 @@ services:
       - mc_data:/data
       - ./runtime:/extras:ro          # authlib-injector.jar lives here
       - ./server-mods:/mods:ro        # itzg auto-syncs /mods → /data/mods
-      # Distribution client-override files the server also needs. kubejs holds
-      # server_scripts/data/startup_scripts (server-side); CustomSkinLoader by
-      # request. Mounted from the live distribution (DISTRIBUTION_WEB_ROOT), same
-      # source as the caddy distribution. mode ro so the server can't pollute the
-      # client distribution with kubejs-generated files.
-      - ${DISTRIBUTION_WEB_ROOT:?DISTRIBUTION_WEB_ROOT unset in .env}/servers/ulicraft-1.21.1/files/kubejs:/data/kubejs:ro
+      # Distribution client-override files the server also needs, from the live
+      # distribution (DISTRIBUTION_WEB_ROOT), same source as caddy. Only the kubejs
+      # *source* subdirs are bind-mounted ro — kubejs itself writes config/, cache/,
+      # generated/, logs/ at boot, so the kubejs ROOT must stay writable (lives in
+      # mc_data). Mounting the whole kubejs dir ro makes BaseProperties.save() NPE
+      # and kubejs never initialises. CustomSkinLoader is ro (read-only json).
+      - ${DISTRIBUTION_WEB_ROOT:?DISTRIBUTION_WEB_ROOT unset in .env}/servers/ulicraft-1.21.1/files/kubejs/server_scripts:/data/kubejs/server_scripts:ro
+      - ${DISTRIBUTION_WEB_ROOT}/servers/ulicraft-1.21.1/files/kubejs/startup_scripts:/data/kubejs/startup_scripts:ro
+      - ${DISTRIBUTION_WEB_ROOT}/servers/ulicraft-1.21.1/files/kubejs/data:/data/kubejs/data:ro
+      - ${DISTRIBUTION_WEB_ROOT}/servers/ulicraft-1.21.1/files/kubejs/assets:/data/kubejs/assets:ro
       - ${DISTRIBUTION_WEB_ROOT}/servers/ulicraft-1.21.1/files/CustomSkinLoader:/data/CustomSkinLoader:ro
     depends_on:
       - drasl                         # authlib (auth.) must resolve at boot