diff --git a/MQTT_DEVICE_AUTH.md b/MQTT_DEVICE_AUTH.md
index a2eb168..f057b51 100644
--- a/MQTT_DEVICE_AUTH.md
+++ b/MQTT_DEVICE_AUTH.md
@@ -19,6 +19,11 @@ exposes three listeners, each with a different trust model:
 The former anonymous WebSocket listener on `9001` is disabled. The current web portal receives
 live updates from the backend rather than connecting directly to Mosquitto.
 
+The TLS listeners use `mosquitto/certs/public-fullchain.pem` and
+`mosquitto/certs/public-privkey.pem`, copied from the host's Let's Encrypt certificate during
+deployment with owner `1883:1883` and mode `0600`. These files are deployment secrets/artifacts
+and are excluded from Git.
+
 Device authentication happens on **port 8883**. A device presents a client
 certificate signed by the app's own Certificate Authority (CA); Mosquitto
 verifies the chain and uses the certificate's Common Name (CN) as the MQTT
diff --git a/docker-compose.yml b/docker-compose.yml
index 3bc7196..e3e3848 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -16,9 +16,6 @@ services:
       - "8884:8884"
     volumes:
       - ./mosquitto:/mosquitto
-      # Publicly trusted server identity for app MQTTS. The device listener still
-      # validates client certificates against /mosquitto/certs/ca.crt.
-      - /etc/letsencrypt:/etc/letsencrypt:ro
 
   backend:
     build:
diff --git a/mosquitto/config/mosquitto.conf b/mosquitto/config/mosquitto.conf
index a508bdd..e201680 100644
--- a/mosquitto/config/mosquitto.conf
+++ b/mosquitto/config/mosquitto.conf
@@ -14,8 +14,8 @@ allow_anonymous false
 # since there's no config/cert hot-reload.
 listener 8883 0.0.0.0
 cafile /mosquitto/certs/ca.crt
-certfile /etc/letsencrypt/live/dev.hub.umagul.net/fullchain.pem
-keyfile /etc/letsencrypt/live/dev.hub.umagul.net/privkey.pem
+certfile /mosquitto/certs/public-fullchain.pem
+keyfile /mosquitto/certs/public-privkey.pem
 require_certificate true
 use_identity_as_username true
 allow_anonymous false
@@ -24,8 +24,8 @@ acl_file /mosquitto/config/devices.acl
 # TLS MQTT — app/admin username+password access (port 8884). App usernames are orgIds;
 # devices.acl confines them to ul/{orgId}/app/... . No anonymous listener is exposed.
 listener 8884 0.0.0.0
-certfile /etc/letsencrypt/live/dev.hub.umagul.net/fullchain.pem
-keyfile /etc/letsencrypt/live/dev.hub.umagul.net/privkey.pem
+certfile /mosquitto/certs/public-fullchain.pem
+keyfile /mosquitto/certs/public-privkey.pem
 require_certificate false
 password_file /mosquitto/config/passwd
 allow_anonymous false