diff --git a/dankserver/compose.yaml b/dankserver/compose.yaml
index 3944c15..13ffc2b 100644
--- a/dankserver/compose.yaml
+++ b/dankserver/compose.yaml
@@ -86,7 +86,7 @@ services:
     ports:
       - "3923:3923"
     volumes:
-      - /mnt/entropy:/w
+      - /mnt/entropy:/w:ro
       - /opt/copyparty/cfg:/cfg
     healthcheck:
       test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:3923/')"]
@@ -112,8 +112,7 @@ services:
     volumes:
       - /opt/jellyfin/config:/config
       - /opt/jellyfin/cache:/cache
-      - /mnt/entropy/Movies:/data/movies:ro
-      - /mnt/entropy/TVShows:/data/shows:ro
+      - /mnt/entropy:/data:ro
     devices:
       - /dev/dri:/dev/dri
     group_add:
diff --git a/dankserver/copyparty/quadlet/copyparty.container b/dankserver/copyparty/quadlet/copyparty.container
index e187ec2..79869c5 100644
--- a/dankserver/copyparty/quadlet/copyparty.container
+++ b/dankserver/copyparty/quadlet/copyparty.container
@@ -12,8 +12,8 @@
 # that env file exists, so a missing env file fails the unit instead of
 # creating an admin account with a garbage password.
 #
-# /w is the entropy volume: copyparty's dank admin account is the only write
-# path into it; every other service mounts the share read-only or not at all.
+# /w is the entropy volume, mounted read-only: nothing writes into /mnt/entropy
+# anymore; every consumer of the share is a read-only client.
 
 [Unit]
 Description=Copyparty file server container
@@ -25,7 +25,7 @@ Image=ghcr.io/9001/copyparty-ac:latest
 Network=dankserver_appnet
 EnvironmentFile=/home/dank/Containers/copyparty/env
 Exec=-a ${COPAY_ACCOUNT}:${COPAY_PASSWORD} -v /w::r:ra,dank
-Volume=/mnt/entropy:/w
+Volume=/mnt/entropy:/w:ro
 Volume=/home/dank/Containers/copyparty/cfg:/cfg
 PublishPort=3923:3923
 
diff --git a/dankserver/jellyfin/quadlet/jellyfin.container b/dankserver/jellyfin/quadlet/jellyfin.container
index 1a183aa..1dfae33 100644
--- a/dankserver/jellyfin/quadlet/jellyfin.container
+++ b/dankserver/jellyfin/quadlet/jellyfin.container
@@ -4,8 +4,8 @@
 # Unit name: jellyfin.service (podman 5.x drops the container- prefix)
 #
 # Data roots migrated from /opt/jellyfin to /home/dank/Containers/jellyfin at
-# cutover. The entropy volume is mounted read-only: nothing automated ever
-# writes there; copyparty is the only write path for /mnt/entropy. Every
+# cutover. All of /mnt/entropy is mounted read-only at /data: nothing automated
+# anywhere writes to the entropy volume. Every
 # creation-time environment variable of the compose-era container is kept as
 # an Environment= line (zero drift); none of them are secrets, so this unit
 # needs no EnvironmentFile.
@@ -41,8 +41,7 @@ PublishPort=7359:7359/udp
 PublishPort=1900:1900/udp
 Volume=/home/dank/Containers/jellyfin/config:/config
 Volume=/home/dank/Containers/jellyfin/cache:/cache
-Volume=/mnt/entropy/Movies:/data/movies:ro
-Volume=/mnt/entropy/TVShows:/data/shows:ro
+Volume=/mnt/entropy:/data:ro
 AddDevice=/dev/dri
 GroupAdd=keep-groups
 HealthCmd=curl -f http://localhost:8096/health