diff --git a/docker-compose.yml b/docker-compose.yml
index dbd7df3..dfba15d 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -51,6 +51,20 @@ services:
       # A bind mount, not a named volume: petal.db must be trivially reachable
       # from the host for the nightly backup and for a restore.
       - ./data:/data
+      # Mount-liveness guard. On the VPS ./data is an encrypted LUKS volume, and
+      # the mountpoint directory still exists when that volume is NOT mounted —
+      # so without this, a boot where the unlock failed would start Petal
+      # against an empty unencrypted directory and quietly serve a blank
+      # database. .volume-ok lives on the encrypted filesystem, and
+      # create_host_path: false turns its absence into a container start
+      # failure instead. Harmless elsewhere: create the file once and it is a
+      # no-op. See deploy/README.md §6.
+      - type: bind
+        source: ./data/.volume-ok
+        target: /data/.volume-ok
+        read_only: true
+        bind:
+          create_host_path: false
     networks:
       - traefik
       - internal