diff --git a/scripts/replace-container.sh b/scripts/replace-container.sh
index 821c993..0f360c7 100755
--- a/scripts/replace-container.sh
+++ b/scripts/replace-container.sh
@@ -280,6 +280,7 @@ docker run -d \
   --name "$compat_name" \
   --network "$network_name" \
   --env-file "$compat_env" \
+  --volumes-from "$current_backend_id:ro" \
   -e MQTT_INGEST_ENABLED=false \
   -e OWNER_AUTHORIZATION_MODE=shadow \
   -e OWNER_ACL_MODE=shadow \
diff --git a/scripts/test-replace-container.sh b/scripts/test-replace-container.sh
index eca2838..ac2af8a 100755
--- a/scripts/test-replace-container.sh
+++ b/scripts/test-replace-container.sh
@@ -259,6 +259,9 @@ run_case() {
       "${test_root}/docker.log" || true
   )"
   test "$up_count" -eq "$expected_up_count"
+  grep -Eq -- \
+    '^run .* --volumes-from current-backend:ro( |$)' \
+    "${test_root}/docker.log"
   if [ "$signature_mode" = "keyless" ]; then
     grep -q -- '--certificate-identity-regexp' "${test_root}/cosign.log"
     grep -q -- '--certificate-oidc-issuer' "${test_root}/cosign.log"