diff --git a/docker/compose.yml b/docker/compose.yml
index 4d71dca..29c2738 100644
--- a/docker/compose.yml
+++ b/docker/compose.yml
@@ -14,7 +14,9 @@ services:
       - TZ=America/New_York
       - AGENTCHAT_DB=/data/agentchat.db
     volumes:
-      - ./data:/data:Z        # :Z mandatory under SELinux Enforcing; see AGENTS.md §6
+      # lowercase :z, NOT :Z — watchtower recreates drop the relabel flag, and
+      # :Z-category files lock the recreated container out (VPS AGENTS.md §6)
+      - ./data:/data:z
     labels: ['com.centurylinklabs.watchtower.enable=true']
     restart: unless-stopped
     healthcheck: