diff --git a/README.md b/README.md
index 0c4787f..3b92f2f 100644
--- a/README.md
+++ b/README.md
@@ -255,7 +255,7 @@ Files are read from `BOOKS_ROOT` (default `/books` when it exists, otherwise `~/
 - `BOOKS_ROOT/library/<books.files.path>` for book files (written by `scripts/books-ingest.py`)
 - `BOOKS_ROOT/covers/<books.works.cover_path>` for downloaded covers
 
-In production, `scripts/deploy-remote.sh` writes `/opt/personal-website/compose.books.yml`, which
+In production, `scripts/deploy-remote.sh` writes `~deploy/compose.books.yml` (the deploy account may only sudo-tee `/opt/personal-website/.env`), which
 bind-mounts the host's `BOOKS_HOST_DIR` (default `/home/stan/books`) read-only at `/books` and sets
 `BOOKS_ROOT=/books`. Without a `library` directory there the deploy still succeeds, but files can't
 be opened.
diff --git a/scripts/deploy-remote.sh b/scripts/deploy-remote.sh
index ee6a73a..0a8d8bd 100644
--- a/scripts/deploy-remote.sh
+++ b/scripts/deploy-remote.sh
@@ -32,14 +32,18 @@ fi
 # Book files (ebooks + covers) live on the host and are bind-mounted read-only at /books;
 # the app streams them only to the owner via /trackers/books/files/<id> (no static path).
 # Layout: $books_host_dir/library/<files.path> and $books_host_dir/covers/<works.cover_path>.
-# compose.prod.yml is host-managed, so the mount goes in a generated override file.
+# compose.prod.yml is host-managed, so the mount goes in a generated override file (~deploy).
 books_host_dir=${BOOKS_HOST_DIR:-/home/stan/books}
 case "$books_host_dir" in /*) ;; *) echo 'BOOKS_HOST_DIR must be absolute' >&2; exit 2 ;; esac
 # The deploy account can't traverse /home/stan (0750); check from a root container instead.
 if sudo docker run --rm --entrypoint sh \
   --mount "type=bind,source=$books_host_dir,target=/books,readonly" "$image" \
   -c 'test -d /books/library' 2>/dev/null; then
-  sudo tee "$directory/compose.books.yml" >/dev/null <<YAML
+  # The deploy account may only sudo-tee $directory/.env, so the override lives in its home;
+  # the compose CLI runs as root and can read it from there.
+  books_override="$HOME/compose.books.yml"
+  rm -f "$books_override"
+  cat >"$books_override" <<YAML
 services:
   app:
     environment:
@@ -50,7 +54,7 @@ services:
         target: /books
         read_only: true
 YAML
-  compose_files+=(-f "$directory/compose.books.yml")
+  compose_files+=(-f "$books_override")
 else
   echo "No $books_host_dir/library on this host; book files will not be readable" >&2
 fi