diff --git a/app.py b/app.py
index 0692d8a..774e7ca 100644
--- a/app.py
+++ b/app.py
@@ -151,8 +151,10 @@ def login():
     if not _has_password():
         return redirect(url_for("setup"))
     if request.method == "POST":
-        if _check_password(request.form.get("password", "")):
+        pw = request.form.get("password", "")
+        if _check_password(pw):
             session["authed"] = True
+            _sync_grafana_password(pw)   # self-heal if the setup-time sync missed
             return redirect(url_for("index"))
         flash("Wrong password.", "error")
     return render_template("auth.html", mode="login")
diff --git a/docker-compose.yml b/docker-compose.yml
index 913ea97..1681627 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -41,7 +41,9 @@ services:
       # the password you set on the AHDX setup screen. Don't pin it here or AHDX
       # can't bootstrap it.
     volumes:
-      - ./grafana-data:/var/lib/grafana
+      # Named volume (not a host bind mount) so Grafana's user can write to it
+      # on any host — a bind-mounted dir trips file-permission errors on Linux.
+      - grafana-data:/var/lib/grafana
       # Auto-adds the "AHDX" datasource + the Apple Health dashboard.
       - ./grafana/provisioning:/etc/grafana/provisioning
       - ./grafana/dashboards:/etc/dashboards
@@ -49,3 +51,6 @@ services:
       ahdx:
         condition: service_healthy   # Grafana waits until AHDX is up
     restart: unless-stopped
+
+volumes:
+  grafana-data: