diff --git a/apps/wave-0/plex.yaml b/apps/wave-0/plex.yaml
index dfffcb2..94cf3e7 100644
--- a/apps/wave-0/plex.yaml
+++ b/apps/wave-0/plex.yaml
@@ -80,7 +80,7 @@ spec:
         - containerPort: 32400
         volumeMounts:
         - name: config
-          mountPath: /data/config
+          mountPath: /config
       volumes:
       - name: config
         persistentVolumeClaim:
diff --git a/catalog/plex.yaml b/catalog/plex.yaml
index 1fec967..e4a6f44 100644
--- a/catalog/plex.yaml
+++ b/catalog/plex.yaml
@@ -29,6 +29,15 @@ storage:
   - name: config
     size: 8Gi
     class: longhorn           # Plex DB/metadata: replicated app state on the 3-replica tier (docs/04; R-STATE-01/02)
+    mountPath: /config        # plexinc/pms-docker writes its identity/claim + "Library" DB under /config, NOT the
+                              # renderer default /data/config. Without this the PVC sat unused and Plex wrote to the
+                              # container's EPHEMERAL layer -> unclaimed + all state lost on restart. The image inits as
+                              # root (s6-svscan PID 1), chowns /config to the plex user, then drops -> no fsGroup needed
+                              # (verified in-cluster: PID1=root, "Plex Media Server"=plex). Persisting /config here also
+                              # makes the claim survive restarts once claimed. To auto-claim on first boot instead of the
+                              # UI sign-in, the operator adds a PLEX_CLAIM env from a fresh https://plex.tv/claim token
+                              # (4-min TTL) — deliberately NOT wired here: the env secretKeyRef pattern has no `optional`,
+                              # so a placeholder/absent claim Secret would crashloop the pod. See operator hand-off.
 dependencies: []              # default-deny: reaches only DNS; clients/Seerr reach IT (docs/03; R-NET-01/02)
 ingressRoutes:
   - host: plex.home.keithjackson.dev