diff --git a/docker-compose.yaml b/docker-compose.yaml
index d86f454..b4b8e93 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -65,7 +65,12 @@ services:
       # happens outside this mount, in the container's own filesystem — a
       # large country's .osm.pbf plus Planetiler's working set can be
       # several GB, worth knowing if the host is ever short on space there.
-      - ./data:/app/data
+      # :Z (not :z — this path is only ever mounted into this one
+      # container) relabels the host directory for SELinux, since Podman
+      # on an SELinux-enforcing host otherwise denies the container write
+      # access to a bind-mounted directory regardless of Unix permissions
+      # — harmless/ignored on a host without SELinux.
+      - ./data:/app/data:Z
 
   # Fakes a GNSS fix (a loop around Bratislava, see
   # bin/gnss_simulator.rb/docs/development.adoc) since there's no real
@@ -118,4 +123,5 @@ services:
     # ever talks to this container directly.
     command: ["--urlRootLocation=/kiwix", "/data/wikipedia.zim"]
     volumes:
-      - ./data/kiwix/wikipedia.zim:/data/wikipedia.zim
+      # :Z, same SELinux reasoning as maptool's own ./data mount above.
+      - ./data/kiwix/wikipedia.zim:/data/wikipedia.zim:Z
diff --git a/docs/deployment.adoc b/docs/deployment.adoc
index d2a509c..d59311b 100644
--- a/docs/deployment.adoc
+++ b/docs/deployment.adoc
@@ -55,6 +55,13 @@ expect this to flip the other way, `/srv/docker` symlinked to
   only holds what's checked into this public repo, and gets wiped and
   replaced by the checkout sync on every deploy same as the rest of
   `build/`.
+  `data/` (and the kiwix ZIM path) carries a `:Z` SELinux relabel in
+  `docker-compose.yaml`'s bind mounts — without it, Podman on an
+  SELinux-enforcing host denies the container write access to the
+  bind-mounted directory regardless of its Unix permissions (surfaces
+  as a plain `Permission denied` in the app's own logs, nothing
+  SELinux-labeled unless you go looking in `audit.log`); harmless/
+  ignored on a host where SELinux isn't enforcing.
 * `.env` — regenerated every deploy (see below), lives here rather
   than in `build/` for the same reason as the symlink: `docker
   compose`/`podman compose` auto-load `.env` from the compose file's