diff --git a/MQTT_DEVICE_AUTH.md b/MQTT_DEVICE_AUTH.md
index 3f3238a..db7d11c 100644
--- a/MQTT_DEVICE_AUTH.md
+++ b/MQTT_DEVICE_AUTH.md
@@ -28,7 +28,9 @@ and are excluded from Git.
 
 The live password database is likewise outside Git at
 `/home/ubuntu/.config/ul-platform/mosquitto.passwd`, bind-mounted read-only as
-`/mosquitto/secrets/passwd`. Provisioning updates that host file and restarts Mosquitto; the
+`/run/secrets/mosquitto_passwd`. The deployed ACL is copied to
+`/home/ubuntu/.config/ul-platform/mosquitto.acl` and bind-mounted beside it. Both files are owned
+by broker uid/gid 1883 with mode 0600. Provisioning updates the host password file and restarts Mosquitto; the
 tracked `mosquitto/config/passwd` is only a legacy/bootstrap sample and must not receive new
 organization credentials.
 
diff --git a/docker-compose.yml b/docker-compose.yml
index e18576c..dd4e9cf 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -16,7 +16,8 @@ services:
       - "127.0.0.1:9001:9001"
     volumes:
       - ./mosquitto:/mosquitto
-      - /home/ubuntu/.config/ul-platform/mosquitto.passwd:/mosquitto/secrets/passwd:ro
+      - /home/ubuntu/.config/ul-platform/mosquitto.passwd:/run/secrets/mosquitto_passwd:ro
+      - /home/ubuntu/.config/ul-platform/mosquitto.acl:/run/secrets/mosquitto_acl:ro
 
   backend:
     build:
diff --git a/mosquitto/config/mosquitto.conf b/mosquitto/config/mosquitto.conf
index a191c5e..4079308 100644
--- a/mosquitto/config/mosquitto.conf
+++ b/mosquitto/config/mosquitto.conf
@@ -2,16 +2,16 @@ per_listener_settings true
 
 # Plain MQTT — internal services and clients authenticate with username/password on port 1883
 listener 1883 0.0.0.0
-password_file /mosquitto/secrets/passwd
-acl_file /mosquitto/config/devices.acl
+password_file /run/secrets/mosquitto_passwd
+acl_file /run/secrets/mosquitto_acl
 allow_anonymous false
 
 # Authenticated MQTT over WebSocket for app clients. Docker binds this listener only to
 # host loopback; nginx supplies the public WSS/TLS endpoint at /mqtt on port 443.
 listener 9001 0.0.0.0
 protocol websockets
-password_file /mosquitto/secrets/passwd
-acl_file /mosquitto/config/devices.acl
+password_file /run/secrets/mosquitto_passwd
+acl_file /run/secrets/mosquitto_acl
 allow_anonymous false
 
 # TLS MQTT — devices authenticate with client certificates (port 8883)
@@ -27,7 +27,7 @@ keyfile /mosquitto/certs/public-privkey.pem
 require_certificate true
 use_identity_as_username true
 allow_anonymous false
-acl_file /mosquitto/config/devices.acl
+acl_file /run/secrets/mosquitto_acl
 
 # TLS MQTT — app/admin username+password access (port 8884). App usernames are orgIds;
 # devices.acl confines them to ul/{orgId}/app/... . No anonymous listener is exposed.
@@ -35,6 +35,6 @@ listener 8884 0.0.0.0
 certfile /mosquitto/certs/public-fullchain.pem
 keyfile /mosquitto/certs/public-privkey.pem
 require_certificate false
-password_file /mosquitto/secrets/passwd
+password_file /run/secrets/mosquitto_passwd
 allow_anonymous false
-acl_file /mosquitto/config/devices.acl
+acl_file /run/secrets/mosquitto_acl