diff --git a/Dockerfile b/Dockerfile
index c63318f..5c28c01 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -28,6 +28,12 @@ COPY backend/ ./backend/
 
 # Run
 WORKDIR /app/backend
+# Explicit data dir so operators mount a persistent volume here.
+# Without a volume, ALL user data (incl. the admin password change from first-run
+# setup) is lost on every container recreate -> re-login with the new password fails.
+# Persist with:  docker run -v ./data:/app/backend/data  (or compose ./data)
+ENV DATA_DIR=/app/backend/data
 ENV FLASK_DEBUG=0
 EXPOSE 5001
+VOLUME ["/app/backend/data"]
 CMD ["python", "run.py"]
diff --git a/README.md b/README.md
index a6d9afd..a0b0db5 100644
--- a/README.md
+++ b/README.md
@@ -118,3 +118,14 @@ Real-model verification requires a live `LLM_API_KEY` in `.env`.
 | super_admin | `admin` | `1234` (forced to set email + change on first login) |
 
 Admins create additional users (users/login has no self-registration).
+
+## ⚠️ Data persistence (IMPORTANT)
+All data (users, passwords, groups, sessions) lives in `DATA_DIR` (default `/app/backend/data`).
+**This directory MUST be a persistent volume in production.** If the container restarts/recreates
+without a volume, all data is wiped — including the admin password you changed on first login, so
+you will not be able to log back in with your new password.
+
+- Docker run: `-v ./data:/app/backend/data`
+- Docker Compose: already mounts `./data:/app/backend/data` (see `docker-compose.yml`)
+- EasyPanel / other platforms: **mount a persistent volume to `/app/backend/data`** (or point
+  `DATA_DIR` at a mounted path), otherwise user data resets on every deploy.