diff --git a/.gitea/workflows/ci-cd.yaml b/.gitea/workflows/ci-cd.yaml
index 1373e5c..6b7fcab 100644
--- a/.gitea/workflows/ci-cd.yaml
+++ b/.gitea/workflows/ci-cd.yaml
@@ -51,6 +51,8 @@ jobs:
 
           # Ship the compose file and Lavalink config to the server. .env and
           # catchphrases.txt live on the server and are intentionally not copied.
+          # Plugins live in a named Docker volume (see docker-compose.yaml), so
+          # only the lavalink/ dir for application.yml is needed here.
           ssh -i ~/.ssh/key $HOST "mkdir -p $DIR/lavalink"
           scp -i ~/.ssh/key docker-compose.yaml $HOST:"$DIR/docker-compose.yaml"
           scp -i ~/.ssh/key lavalink/application.yml $HOST:"$DIR/lavalink/application.yml"
diff --git a/docker-compose.yaml b/docker-compose.yaml
index 4a3cd63..572e827 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -34,6 +34,13 @@ services:
       - LAVALINK_SERVER_PASSWORD=${LAVALINK_PASSWORD}
     volumes:
       - ./lavalink/application.yml:/opt/Lavalink/application.yml:ro
-      - ./lavalink/plugins/:/opt/Lavalink/plugins/
+      # Named volume (managed by Docker) rather than a host bind mount. Docker
+      # initializes it from the image, so it's owned by Lavalink's container user
+      # and the plugin jars download without permission errors. No root-owned (or
+      # UID-mismatched) plugins/ dir in the deploy directory.
+      - lavalink-plugins:/opt/Lavalink/plugins
     ports:
       - "2333:2333"
+
+volumes:
+  lavalink-plugins: