diff --git a/infrastructure/deploy/deploy.sh b/infrastructure/deploy/deploy.sh
index 5a14e9a..92c8801 100755
--- a/infrastructure/deploy/deploy.sh
+++ b/infrastructure/deploy/deploy.sh
@@ -11,9 +11,9 @@ set -uo pipefail
 # Required mounts:
 #   /var/run/docker.sock:/var/run/docker.sock
 #   <host>/src:/app/src          persistent git checkout + state
-#   <host>/certs:/certs          TLS certificates (rw, generated on demand)
+#   ff-certs:/certs              TLS certificates named volume (rw)
 #   ff-nginx-conf:/cfg           shared nginx config named volume (rw)
-#   create: docker volume create ff-nginx-conf
+#   create: docker volume create ff-certs; docker volume create ff-nginx-conf
 # ============================================================================
 
 log() { echo "[deployer] $(date '+%F %T') $*"; }
@@ -69,6 +69,7 @@ ensure_network() {
 }
 
 ensure_certs() {
+  docker volume create ff-certs >/dev/null 2>&1 || true
   if [ ! -f "$CERT_DIR/fleetforge.pem" ] || [ ! -f "$CERT_DIR/fleetforge-key.pem" ]; then
     log "generating self-signed certificate for $HOST_IP"
     mkdir -p "$CERT_DIR"
@@ -148,7 +149,7 @@ run_containers() {
   docker run -d --name ff-nginx --restart unless-stopped --network "$NETWORK" \
     -p "$HTTPS_PORT:443" \
     -p "$HTTP_PORT:80" \
-    -v "$CERT_DIR:/etc/nginx/certs:ro" \
+    -v "ff-certs:/etc/nginx/certs:ro" \
     -v "ff-nginx-conf:/etc/nginx/conf.d:ro" \
     nginx:1.27-alpine
 }