diff --git a/.gitignore b/.gitignore
index 4ceea4d1a1..1bb18ef356 100644
--- a/.gitignore
+++ b/.gitignore
@@ -89,9 +89,3 @@ apps/android/app/release
 apps/multiplatform/.kotlin/sessions
 # anywhere in the tree: this file holds a real BTCPay api_key and webhook_secret
 badge_service.ini
-
-# Badge service Docker deployment: the Dockerfile, compose, and example config are tracked; the
-# live config (a secret) and its data volume are not.
-scripts/badge-service/badge_service.ini
-scripts/badge-service/data/
-scripts/badge-service/web/
diff --git a/scripts/badge-service/.gitignore b/scripts/badge-service/.gitignore
new file mode 100644
index 0000000000..78d3246083
--- /dev/null
+++ b/scripts/badge-service/.gitignore
@@ -0,0 +1,4 @@
+.env
+config/
+data/
+web/
diff --git a/scripts/badge-service/badge_service.ini.example b/scripts/badge-service/badge_service.ini.example
index e919294d70..f0dea005ac 100644
--- a/scripts/badge-service/badge_service.ini.example
+++ b/scripts/badge-service/badge_service.ini.example
@@ -37,8 +37,8 @@ waiting_seconds = 3
 idle_seconds = 60
 
 ; optional; without it every App Store receipt is answered provider_not_configured, which the app retries later.
-; root_certificates lists, comma-separated, the roots trusted to sign receipts, each in DER and mounted
-; in compose.yml. Today that is https://www.apple.com/certificateauthority/AppleRootCA-G3.cer.
+; root_certificates lists, comma-separated, the roots trusted to sign receipts, each in DER and placed
+; in config/. Today that is https://www.apple.com/certificateauthority/AppleRootCA-G3.cer.
 ; When Apple adds a root, list it beside the old one rather than in its place.
 ;[apple]
 ;bundle_id = chat.simplex.app
@@ -48,7 +48,7 @@ idle_seconds = 60
 ; service_account_file is the JSON key of a service account with the Play Console permissions "View
 ; financial data, orders, and cancellation survey responses" and "Manage orders and subscriptions", to
 ; read and acknowledge purchases. Without the second, a purchase the app has not already acknowledged
-; itself is answered internal until the permission is granted. Uncomment its mount in compose.yml; the file must be readable by the service's user alone.
+; itself is answered internal until the permission is granted. Place it in config/; the file must be readable by the service's user alone.
 ;[google]
 ;package_name = chat.simplex.app
 ;service_account_file = /etc/simplex-badge-service/play-service-account.json
diff --git a/scripts/badge-service/compose.yml b/scripts/badge-service/compose.yml
index 5047f2725f..6a81ac8200 100644
--- a/scripts/badge-service/compose.yml
+++ b/scripts/badge-service/compose.yml
@@ -20,22 +20,10 @@ services:
       - "/etc/simplex-badge-service/badge_service.ini"
     volumes:
       - type: bind
-        source: ./badge_service.ini
-        target: /etc/simplex-badge-service/badge_service.ini
+        source: ./config
+        target: /etc/simplex-badge-service
         read_only: true
         bind:
           create_host_path: false
-      # - type: bind
-      #   source: ./AppleRootCA-G3.cer
-      #   target: /etc/simplex-badge-service/AppleRootCA-G3.cer
-      #   read_only: true
-      #   bind:
-      #     create_host_path: false
-      # - type: bind
-      #   source: ./play-service-account.json
-      #   target: /etc/simplex-badge-service/play-service-account.json
-      #   read_only: true
-      #   bind:
-      #     create_host_path: false
       - ./web:/srv/webapp
     stop_grace_period: 10s