diff --git a/.github/workflows/chart-publish.yml b/.github/workflows/chart-publish.yml
new file mode 100644
index 0000000..fb521ed
--- /dev/null
+++ b/.github/workflows/chart-publish.yml
@@ -0,0 +1,42 @@
+name: Publish chart
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Chart version to publish (e.g. 0.14.0-sha-fdfc584)'
+        required: false
+        default: '0.14.0-dev'
+        type: string
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  publish-chart:
+    name: Package & push Helm chart to GHCR
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: azure/setup-helm@v4
+
+      - name: Log in to GHCR (Helm OCI)
+        run: |
+          echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io \
+            --username "${{ github.actor }}" \
+            --password-stdin
+
+      - name: Package chart
+        run: |
+          VERSION="${{ inputs.version }}"
+          helm package charts/openconcho \
+            --version "$VERSION" \
+            --app-version "$VERSION"
+
+      - name: Push chart
+        run: |
+          VERSION="${{ inputs.version }}"
+          helm push "openconcho-$VERSION.tgz" \
+            oci://ghcr.io/${{ github.repository_owner }}/charts
diff --git a/Dockerfile b/Dockerfile
index 6ac2e92..48a47ae 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -31,8 +31,12 @@ RUN pnpm --filter @openconcho/web build
 FROM nginxinc/nginx-unprivileged:alpine
 
 COPY --chown=101:101 --from=builder /app/packages/web/dist /usr/share/nginx/html
-# Rendered to /etc/nginx/conf.d/default.conf by the image's envsubst entrypoint.
-COPY --chown=101:101 docker/nginx.conf.template /etc/nginx/templates/default.conf.template
+# Served verbatim by 40-openconcho-config.sh from /etc/openconcho/nginx.conf
+# to /etc/nginx/conf.d/default.conf at container start. Stored outside
+# /etc/nginx/templates/ on purpose so the base image's 20-envsubst-on-templates.sh
+# does not try to render it back into the read-only root filesystem — the
+# template has no $VAR placeholders, so envsubst adds nothing.
+COPY --chown=101:101 docker/nginx.conf.template /etc/openconcho/nginx.conf
 # Writes /usr/share/nginx/html/config.js from OPENCONCHO_DEFAULT_HONCHO_URL.
 # --chmod=0755 so nginx's docker-entrypoint.d actually executes it.
 COPY --chown=101:101 --chmod=0755 docker/40-openconcho-config.sh /docker-entrypoint.d/40-openconcho-config.sh
diff --git a/charts/openconcho/README.md b/charts/openconcho/README.md
index 82a0529..3f2ae60 100644
--- a/charts/openconcho/README.md
+++ b/charts/openconcho/README.md
@@ -226,4 +226,4 @@ helm test openconcho --logs
 | `seccompProfile` | `RuntimeDefault` |
 | `allowPrivilegeEscalation` | `false` |
 | `automountServiceAccountToken` | `false` |
-| Writable paths | `/var/cache/nginx`, `/var/run`, `/tmp` (tmpfs) |
+| Writable paths | `/etc/nginx/conf.d`, `/var/cache/nginx`, `/var/run`, `/tmp` (tmpfs) |
diff --git a/charts/openconcho/templates/deployment.yaml b/charts/openconcho/templates/deployment.yaml
index 900d459..e0bf8a4 100644
--- a/charts/openconcho/templates/deployment.yaml
+++ b/charts/openconcho/templates/deployment.yaml
@@ -54,14 +54,14 @@ spec:
           {{- if .Values.tmpfsMounts }}
           volumeMounts:
             {{- range .Values.tmpfsMounts }}
-            - name: {{ .mountPath | trimPrefix "/" | replace "/" "-" | trunc 63 | trimSuffix "-" }}
+            - name: {{ .mountPath | trimPrefix "/" | replace "/" "-" | replace "." "-" | trunc 63 | trimSuffix "-" }}
               mountPath: {{ .mountPath }}
             {{- end }}
           {{- end }}
       {{- if .Values.tmpfsMounts }}
       volumes:
         {{- range .Values.tmpfsMounts }}
-        - name: {{ .mountPath | trimPrefix "/" | replace "/" "-" | trunc 63 | trimSuffix "-" }}
+        - name: {{ .mountPath | trimPrefix "/" | replace "/" "-" | replace "." "-" | trunc 63 | trimSuffix "-" }}
           emptyDir:
             medium: Memory
         {{- end }}
diff --git a/docker/40-openconcho-config.sh b/docker/40-openconcho-config.sh
index 8e4937a..0d7fda8 100644
--- a/docker/40-openconcho-config.sh
+++ b/docker/40-openconcho-config.sh
@@ -7,6 +7,15 @@
 # so the container works cleanly under a read-only root filesystem.
 set -eu
 
+# Stage the openconcho server config into the writable tmpfs the chart mounts
+# at /etc/nginx/conf.d. The image ships the config at /etc/openconcho/nginx.conf
+# so the base image's envsubst step has nothing to render against the read-only
+# filesystem. The base image's 10-listen-on-ipv6-by-default.sh may have created
+# default.conf already on a writable mount, so we force-overwrite with cp -f.
+cp -f /etc/openconcho/nginx.conf /etc/nginx/conf.d/default.conf
+chmod 0644 /etc/nginx/conf.d/default.conf
+chown 101:101 /etc/nginx/conf.d/default.conf
+
 cat > /tmp/openconcho-config.js <<EOF
 window.__OPENCONCHO_DEFAULT_HONCHO_URL__ = "${OPENCONCHO_DEFAULT_HONCHO_URL:-}";
 EOF