diff --git a/apps/moodle/Dockerfile b/apps/moodle/Dockerfile
index e7dcad1f1..baaf2810e 100644
--- a/apps/moodle/Dockerfile
+++ b/apps/moodle/Dockerfile
@@ -11,6 +11,7 @@ LABEL org.opencontainers.image.authors="https://www.websoft9.com" \
     org.opencontainers.image.version="5.1.3"
 
 ENV MOODLE_VERSION=5.1.3 \
+    MOODLE_SRC=/usr/src/moodle \
     MOODLE_DATA=/var/moodledata \
     APACHE_DOCUMENT_ROOT=/var/www/html/public
 
@@ -34,13 +35,14 @@ RUN mkdir -p ${MOODLE_DATA} \
 # For CI/CD: no proxy needed. For local builds behind a firewall:
 #   docker build --network=host --build-arg CURL_PROXY=socks5h://127.0.0.1:1080 ...
 ARG CURL_PROXY=
-WORKDIR /var/www/html
+WORKDIR ${MOODLE_SRC}
 RUN curl ${CURL_PROXY:+--proxy "$CURL_PROXY"} -fsSL -o /tmp/moodle.zip \
     "https://packaging.moodle.org/stable501/moodle-${MOODLE_VERSION}.zip" \
     && unzip -q /tmp/moodle.zip -d /tmp/moodle_src \
-    && cp -a /tmp/moodle_src/moodle/. /var/www/html/ \
+    && mkdir -p ${MOODLE_SRC} /var/www/html \
+    && cp -a /tmp/moodle_src/moodle/. ${MOODLE_SRC}/ \
     && rm -rf /tmp/moodle.zip /tmp/moodle_src \
-    && chown -R www-data:www-data /var/www/html
+    && chown -R www-data:www-data ${MOODLE_SRC} /var/www/html
 
 # Moodle scheduled task (cron)
 RUN echo "* * * * * www-data /usr/local/bin/php /var/www/html/admin/cli/cron.php >/dev/null 2>&1" \
diff --git a/apps/moodle/docker-compose.yml b/apps/moodle/docker-compose.yml
index 5756d7172..6bf0393f0 100644
--- a/apps/moodle/docker-compose.yml
+++ b/apps/moodle/docker-compose.yml
@@ -10,6 +10,7 @@ services:
     ports:
       - "${W9_HTTP_PORT_SET}:${W9_HTTP_PORT}"
     volumes:
+      - moodle_app:/var/www/html
       - moodle_data:/var/moodledata
       - ./src/php.ini:/usr/local/etc/php/conf.d/moodle.ini
     depends_on:
@@ -33,6 +34,7 @@ services:
       start_period: 30s
 
 volumes:
+  moodle_app:
   moodle_data:
   mariadb_data:
 
diff --git a/apps/moodle/entrypoint.sh b/apps/moodle/entrypoint.sh
index 8f8e51bd9..6d3a0b68c 100644
--- a/apps/moodle/entrypoint.sh
+++ b/apps/moodle/entrypoint.sh
@@ -20,10 +20,20 @@ set -euo pipefail
 rm -f /var/run/cron.pid 2>/dev/null || true
 cron
 
+# Initialize the mounted application directory from the image seed on first start.
+if [ ! -f /var/www/html/public/index.php ]; then
+    echo "Initializing Moodle application directory..."
+    mkdir -p /var/www/html
+    cp -a /usr/src/moodle/. /var/www/html/
+    chown -R www-data:www-data /var/www/html
+fi
+
 # Restore config.php from moodledata if it was persisted after a previous install
 if [ -f "${MOODLE_DATA}/.moodle_config.php" ] && [ ! -f /var/www/html/config.php ]; then
     echo "Restoring config.php from moodledata..."
     cp "${MOODLE_DATA}/.moodle_config.php" /var/www/html/config.php
+    chown www-data:www-data /var/www/html/config.php
+    chmod 644 /var/www/html/config.php
 fi
 
 # Wait for the database to be ready (max 120 seconds)
@@ -72,12 +82,14 @@ if [ ! -f /var/www/html/config.php ]; then
     # Persist config.php to moodledata so it survives container recreations
     cp /var/www/html/config.php "${MOODLE_DATA}/.moodle_config.php"
     chown www-data:www-data /var/www/html/config.php
+    chmod 644 /var/www/html/config.php
 elif php /var/www/html/admin/cli/upgrade.php --is-pending --non-interactive 2>/dev/null | grep -q "pending\|Upgrade"; then
     echo "Database upgrade pending, running upgrade..."
     php /var/www/html/admin/cli/upgrade.php --non-interactive
     echo "Moodle upgrade complete."
     cp /var/www/html/config.php "${MOODLE_DATA}/.moodle_config.php"
     chown www-data:www-data /var/www/html/config.php
+    chmod 644 /var/www/html/config.php
 fi
 
 exec "$@"