diff --git a/Dockerfile b/Dockerfile
index 2539d09..2452f5d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -10,6 +10,7 @@ RUN apk add --no-cache ca-certificates tzdata
 WORKDIR /app
 COPY --from=builder /build/clab-webserver .
 COPY docroot/ docroot/
+COPY config/ config/
 EXPOSE 80
 ENTRYPOINT ["/app/clab-webserver"]
 CMD ["-listen", ":80"]
diff --git a/README.md b/README.md
index 624bbe2..8922804 100644
--- a/README.md
+++ b/README.md
@@ -36,10 +36,10 @@ topology:
       kind: linux
       image: git.ipng.ch/ipng/clab-webserver:latest
       binds:
-        - client-map.yaml:/app/client-map.yaml:ro
+        - config:/app/config:ro
         - docroot:/app/docroot:ro
       env:
-        CLIENT_MAP: /app/client-map.yaml
+        CLIENT_MAP: /app/config/client-map.yaml
         DOCROOT: /app/docroot
         LISTEN: ":80"
       ports:
@@ -143,11 +143,11 @@ All options can be set via CLI flag or environment variable. Flags take preceden
 
 ```sh
 # Run directly
-go run . -client-map client-map.yaml
+go run . -client-map config/client-map.yaml
 
 # Build and run
 go build -o clab-webserver .
-./clab-webserver -client-map client-map.yaml -listen :8080
+./clab-webserver -client-map config/client-map.yaml -listen :8080
 
 # Docker
 docker compose build
@@ -221,6 +221,6 @@ them and returning a unique token they can record and submit.
 ### Deployment
 
 - Packaged as a multi-stage Docker image based on Alpine.
-- `docroot/` is baked into the image; `client-map.yaml` is expected as a bind mount.
+- `docroot/` is baked into the image; `config/` (containing `client-map.yaml`) is expected as a bind-mounted directory.
 - All configuration is available as both CLI flags and environment variables.
 - Image: `git.ipng.ch/ipng/clab-webserver:latest`
diff --git a/client-map.yaml b/config/client-map.yaml
similarity index 100%
rename from client-map.yaml
rename to config/client-map.yaml
diff --git a/docker-compose.yml b/docker-compose.yml
index 2adcb23..8e54d55 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -5,9 +5,9 @@ services:
     ports:
       - "80:80"
     volumes:
-      - ./client-map.yaml:/app/client-map.yaml:ro
+      - ./config:/app/config:ro
     environment:
       LISTEN: ":80"
-      CLIENT_MAP: /app/client-map.yaml
+      CLIENT_MAP: /app/config/client-map.yaml
       DOCROOT: /app/docroot
     restart: unless-stopped
diff --git a/main.go b/main.go
index 9558b88..9599207 100644
--- a/main.go
+++ b/main.go
@@ -180,7 +180,7 @@ func (lrw *loggingResponseWriter) Write(b []byte) (int, error) {
 }
 
 func main() {
-	clientMapPath := flag.String("client-map", getEnv("CLIENT_MAP", "client-map.yaml"), "path to client-map YAML file [$CLIENT_MAP]")
+	clientMapPath := flag.String("client-map", getEnv("CLIENT_MAP", "config/client-map.yaml"), "path to client-map YAML file [$CLIENT_MAP]")
 	listenAddr := flag.String("listen", getEnv("LISTEN", ":80"), "listen address [$LISTEN]")
 	docrootDir := flag.String("docroot", getEnv("DOCROOT", "docroot"), "path to docroot directory [$DOCROOT]")
 	flag.Parse()