diff --git a/Docker/README.md b/Docker/README.md
index 10e75ed..2645985 100644
--- a/Docker/README.md
+++ b/Docker/README.md
@@ -63,11 +63,20 @@ schema reconcile itself.
 Both default to Docker-managed named volumes. In the prod file, set `PB_DATA` /
 `API_DATA` to absolute host paths for bind mounts instead.
 
-> The API Server container runs as an unprivileged user, and a **named** volume
-> inherits that ownership from the image. A **bind mount** does not — the host
-> directory's ownership wins, so `chown` it to the container's `app` user (or
-> `chmod` it writable) before setting `API_DATA` to a host path, otherwise the
-> server cannot write `plugins.json`.
+> The API Server serves as the unprivileged `app` user, so `/data` has to be
+> writable by it. Its entrypoint arranges that itself: it starts as root, takes
+> ownership of `/data` if `app` does not already hold it, then drops privileges.
+> So a **bind mount** to a root-owned host path needs no manual `chown`, and
+> neither does a **named volume** left over from an image that ran as root. The
+> one case it cannot fix is a container forced to another user (`user:` in
+> compose, `docker run --user`), where the entrypoint has no privileges to
+> `chown` with — prepare the host directory yourself there.
+>
+> If `/data` is still unwritable the server says so at boot, with
+> `WARNING: plugin changes will NOT survive a restart`. That warning is worth
+> watching for: the alternative symptom is plugins that enable normally in the
+> panel and come back disabled after the next redeploy. PocketBase runs as
+> root, so `PB_DATA` is unaffected either way.
 
 ## Charger control (OCPP)