diff --git a/.gitignore b/.gitignore
index 0295812..57ca5e7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,3 +6,4 @@ data/
 .env
 
 .idea/
+bzod.env
diff --git a/deploy.sh b/deploy.sh
index 52e5d08..6cdd48b 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -12,8 +12,8 @@
 #
 # Environment overrides:
 #   BZOD_VERSION=0.7.0
-#   BZOD_IMAGE=ghcr.io/thakares/nx9-url-shortener
-#   BZOD_ROOT=/DATA/AppData/bzod
+#   BZOD_IMAGE=nx9-url-shortener
+#   BZOD_ROOT=/DATA/AppData/nx9-url-shortener
 #   BZOD_PORT=8654
 #
 
@@ -24,8 +24,8 @@ set -euo pipefail
 # ============================================================
 
 BZOD_VERSION="${BZOD_VERSION:-0.7.0}"
-BZOD_IMAGE="${BZOD_IMAGE:-ghcr.io/thakares/nx9-url-shortener}"
-BZOD_ROOT="${BZOD_ROOT:-/DATA/AppData/bzod}"
+BZOD_IMAGE="${BZOD_IMAGE:-nx9-url-shortener}"
+BZOD_ROOT="${BZOD_ROOT:-/DATA/AppData/nx9-url-shortener}"
 BZOD_PORT="${BZOD_PORT:-8654}"
 
 CONTAINER_NAME="${CONTAINER_NAME:-bzod}"
@@ -310,13 +310,18 @@ echo "  ${BACKUP_DIR}"
 # 6. Pull new image
 # ============================================================
 
-info "[6/8] Pulling BZOD ${BZOD_VERSION} image..."
+info "[6/8] Building BZOD ${BZOD_VERSION} image..."
 
-if ! docker pull "${IMAGE}"; then
-    die "Unable to pull ${IMAGE}"
+# Build locally from the current deployment tree.  The package/repository is
+# nx9-url-shortener; the application binary and container remain named bzod.
+if ! docker build \
+    --tag "${IMAGE}" \
+    --file "${BZOD_ROOT}/Dockerfile" \
+    "${BZOD_ROOT}"; then
+    die "Unable to build ${IMAGE}"
 fi
 
-success "✓ Docker image downloaded"
+success "✓ Docker image built locally"
 
 # ============================================================
 # 7. Deploy
diff --git a/docker-compose.yml b/docker-compose.yml
index d49acaa..7fd3b5c 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,57 +1,87 @@
 name: app-bzod
+
 services:
   bzod:
     build:
-      context: /DATA/AppData/bzod
+      context: /DATA/AppData/nx9-url-shortener
       dockerfile: Dockerfile
-    cpu_shares: 90
-    command: []
+
     container_name: bzod
+
     deploy:
       resources:
         limits:
           memory: 31940M
+
     environment:
+      - ADMIN_PASSWORD=${ADMIN_PASSWORD}
+      - ADMIN_USERNAME=${ADMIN_USERNAME}
+      - CONFIG_DIR=/app/config
       - COOKIE_SECURE=false
       - DATA_DIR=/app/data
-      - ADMIN_USERNAME=${ADMIN_USERNAME}
-      - ADMIN_PASSWORD=${ADMIN_PASSWORD}
       - HOST=0.0.0.0
+      - IMAGES_DIR=/app/images
       - PORT=8654
       - RUST_LOG=info
+      - BASE_URL=${BASE_URL}
+
     hostname: bzod
+
     image: nx9-url-shortener:v0.7.0
+
     ports:
       - mode: ingress
         target: 8654
         published: "8654"
         protocol: tcp
+
     restart: unless-stopped
+
+    security_opt:
+      - no-new-privileges:true
+
     volumes:
       - type: bind
-        source: /DATA/AppData/bzod/data
+        source: /DATA/AppData/nx9-url-shortener/data
         target: /app/data
         bind:
           create_host_path: true
+
       - type: bind
-        source: /DATA/AppData/bzod/config
+        source: /DATA/AppData/nx9-url-shortener/config
         target: /app/config
         bind:
           create_host_path: true
+
       - type: bind
-        source: /DATA/AppData/bzod/www
+        source: /DATA/AppData/nx9-url-shortener/www
         target: /app/www
+        bind:
+          create_host_path: true
+
       - type: bind
-        source: /DATA/AppData/bzod/images
+        source: /DATA/AppData/nx9-url-shortener/images
         target: /app/images
+        bind:
+          create_host_path: true
+
     devices: []
+
     cap_add: []
+
+    command: []
+
     networks:
       - default
+
     privileged: false
+
+    cpu_shares: 90
+
 networks:
   default:
     name: app_default
+
 x-casaos:
   author: self
   category: self
@@ -62,4 +92,4 @@ x-casaos:
   port_map: "8654"
   scheme: http
   title:
-    custom: nx9-url-shortener
\ No newline at end of file
+    custom: nx9-url-shortener