diff --git a/docker-compose.yaml b/docker-compose.yaml
index 1f58276..8f0992b 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -55,7 +55,9 @@ services:
       retries: 3
 
   grafana:
-    image: grafana/grafana:11.0.0
+    build:
+      context: ./grafana
+      dockerfile: Dockerfile
     restart: always
     depends_on:
       timescale_db:
@@ -67,7 +69,7 @@ services:
       - GF_DASHBOARDS_DEFAULT_HOME_DASHBOARD_PATH=/etc/grafana/provisioning/dashboards-json/noc_fleet_dashboard.json
     volumes:
       - grafana-data:/var/lib/grafana
-      - ./grafana/provisioning:/etc/grafana/provisioning:ro
+      # Provisioning is baked into the image via grafana/Dockerfile — no bind mount needed.
     # COOLIFY DOMAIN LOGIC:
     # You will set the actual URL in the Coolify UI,
     # but the service needs to expose port 3000 internally.
diff --git a/grafana/Dockerfile b/grafana/Dockerfile
new file mode 100644
index 0000000..0680845
--- /dev/null
+++ b/grafana/Dockerfile
@@ -0,0 +1,5 @@
+FROM grafana/grafana:11.0.0
+
+# Bake provisioning files into the image so Coolify bind mounts are not needed.
+# Grafana substitutes ${ENV_VAR} references in provisioning files at startup.
+COPY provisioning /etc/grafana/provisioning