diff --git a/test/docker-compose.yml b/test/docker-compose.yml
index e6225f2..225c3d8 100644
--- a/test/docker-compose.yml
+++ b/test/docker-compose.yml
@@ -29,8 +29,8 @@ services:
       - mosquitto_data:/mosquitto/data
       - mosquitto_log:/mosquitto/log
       - ./mosquitto.conf:/mosquitto/config/mosquitto.conf:ro
-    # ensure a password file exists and start mosquitto with our config
-    command: sh -c "mosquitto_passwd -b /mosquitto/config/passwordfile testuser testpass >/dev/null 2>&1 || true; /usr/sbin/mosquitto -c /mosquitto/config/mosquitto.conf"
+    # ensure a password file exists (in the writable data volume) and start mosquitto with our config
+    command: sh -c "mosquitto_passwd -b /mosquitto/data/passwordfile testuser testpass >/dev/null 2>&1 || true; /usr/sbin/mosquitto -c /mosquitto/config/mosquitto.conf"
     healthcheck:
       test: ["CMD", "sh", "-c", "nc -z localhost 1883 || exit 1"]
       interval: 2s
diff --git a/test/mosquitto.conf b/test/mosquitto.conf
index 3572c5b..4af9417 100644
--- a/test/mosquitto.conf
+++ b/test/mosquitto.conf
@@ -3,7 +3,8 @@
 listener 1883 0.0.0.0
 # do not allow anonymous in this test stack; require password_file
 allow_anonymous false
-password_file /mosquitto/config/passwordfile
+# place password file in the data volume (writable)
+password_file /mosquitto/data/passwordfile
 # Increase persistence location so container can map volume if needed
 persistence true
 persistence_location /mosquitto/data/