diff --git a/compose.prod.yaml b/compose.prod.yaml
index 7b85f693f..54f682fbe 100644
--- a/compose.prod.yaml
+++ b/compose.prod.yaml
@@ -129,8 +129,11 @@ services:
       - "8333"
       - "9333"
       - "8888"
+    configs:
+      - source: seaweedfs_s3_json
+        target: /etc/seaweedfs/s3.json
+        mode: 0444
     volumes:
-      - "./compose/seaweedfs/s3.json:/etc/seaweedfs/s3.json:ro"
       - "seaweedfs-data:/data:rw"
 
   chrome:
@@ -153,3 +156,12 @@ volumes:
   probo-data:
   postgres-data-prod:
   seaweedfs-data:
+
+configs:
+  # Read fresh from the repo on every `up`, then mounted as a real file in
+  # the container (not a host bind mount). Avoids the classic Docker footgun
+  # where a bind-mounted file whose host source doesn't exist yet at
+  # container-creation time gets silently auto-created as a directory
+  # instead — which is what caused "s3.json: is a directory" here.
+  seaweedfs_s3_json:
+    file: ./compose/seaweedfs/s3.json