diff --git a/infra/files/activate.sh b/infra/files/activate.sh
index 5805a63b..85b3caca 100755
--- a/infra/files/activate.sh
+++ b/infra/files/activate.sh
@@ -38,7 +38,7 @@ fi
 # release parameter says, and the relay password the instance made at first
 # boot. Root-only, because of the last.
 install -m 0644 "$dir/compose.yml" "$home/compose.yml"
-install -m 0644 "$dir/Caddyfile" "$home/Caddyfile"
+install -D -m 0644 "$dir/Caddyfile" "$home/caddy/Caddyfile"
 (
     umask 077
     cat "$home/static.env" "$dir/release.env" "$home/secret.env" > "$home/.env.next"
@@ -55,6 +55,14 @@ cd "$home"
 registry-login
 docker compose pull --quiet
 docker compose up -d --remove-orphans --wait
+# Compose recreates a container whose definition changed, and a Caddyfile is
+# not part of caddy's: so the running caddy is asked to read it again. Caddy
+# swaps in the new config without dropping a connection, and does nothing
+# when the file is the one it already has. A Caddyfile that will not load
+# fails here, leaves the old config serving, and converge tries again.
+docker compose exec -T caddy caddy reload --config /etc/caddy/Caddyfile --adapter caddyfile
+# The single-file path an older compose file mounted. Nothing reads it now.
+rm -f "$home/Caddyfile"
 docker image prune -f >/dev/null
 
 # Live. The link moves last, so release.txt answering with this version means
diff --git a/infra/files/compose.yml b/infra/files/compose.yml
index 1a0b91a1..da036ef5 100644
--- a/infra/files/compose.yml
+++ b/infra/files/compose.yml
@@ -14,14 +14,6 @@
 # parameter, and the relay password the instance made at first boot.
 name: vibescrobble
 
-# The Caddyfile travels with the release, and this is what makes a change to
-# it take effect: compose hashes a config's content into the container it is
-# mounted in, so a new Caddyfile is a new caddy — where a bind mount of the
-# same path would be read once at start and never again.
-configs:
-  caddyfile:
-    file: ./Caddyfile
-
 services:
   caddy:
     # Pinned by digest, so a new instance runs the Caddy that was tested.
@@ -30,10 +22,12 @@ services:
     ports:
       - "80:80"
       - "443:443"
-    configs:
-      - source: caddyfile
-        target: /etc/caddy/Caddyfile
     volumes:
+      # The directory, never the file. activate.sh puts a release's Caddyfile
+      # in place by rename, and a mount of the file would go on showing caddy
+      # the inode it started with. Through the directory the new file is the
+      # one caddy reads, and activate.sh's `caddy reload` is what makes it.
+      - /opt/vibescrobble/caddy:/etc/caddy:ro
       - /srv/web:/srv/web:ro
       - caddy-data:/data
       - caddy-config:/config