diff --git a/mqtt/unsec/docker-compose-auto.yml b/mqtt/unsec/docker-compose-auto.yml
index 2215a82..db61b16 100644
--- a/mqtt/unsec/docker-compose-auto.yml
+++ b/mqtt/unsec/docker-compose-auto.yml
@@ -10,9 +10,13 @@ services:
       MQTT_PORT: ${MQTT_PORT:-1883}
 
     volumes:
-      - ${CONFIG_PATH:-./config}:/mosquitto/config
-      - ${DATA_PATH:-./data}:/mosquitto/data
-      - ${LOG_PATH:-./log}:/mosquitto/log
+      # Dein einziges Root-Volume
+      - ${VOLUME_ROOT:-./mosquitto}/config:/mosquitto/config
+      - ${VOLUME_ROOT:-./mosquitto}/data:/mosquitto/data
+      - ${VOLUME_ROOT:-./mosquitto}/log:/mosquitto/log
+
+      # Host-Zertifikate (read-only), z.B. für Bridges
+      - /etc/ssl/certs:/etc/ssl/certs:ro
 
     ports:
       - "${MQTT_PORT:-1883}:1883"
@@ -27,6 +31,9 @@ services:
         CONF=/mosquitto/config/mosquitto.conf
         PASSWD=/mosquitto/config/passwd
 
+        echo "=== Preparing directories ==="
+        mkdir -p /mosquitto/config /mosquitto/data /mosquitto/log
+
         echo "=== Checking mosquitto.conf ==="
         if [ ! -f "$CONF" ]; then
           echo "Generating mosquitto.conf..."