diff --git a/infra/docker-compose.nas.yml b/infra/docker-compose.nas.yml
index d885d71..b16881a 100644
--- a/infra/docker-compose.nas.yml
+++ b/infra/docker-compose.nas.yml
@@ -209,11 +209,15 @@ services:
     read_only: true
     tmpfs:
       - /tmp:rw,noexec,nosuid,size=16m
-      # nginx가 client/proxy/fastcgi 임시 파일과 PID를 기록해야 한다.
-      # 루트 FS는 계속 read-only로 유지한다.
+      # nginx needs writable temporary paths while the root filesystem remains read-only.
       - /var/cache/nginx:rw,noexec,nosuid,size=16m
       - /var/run:rw,noexec,nosuid,size=1m
     cap_drop: [ALL]
+    cap_add:
+      - NET_BIND_SERVICE
+      - CHOWN
+      - SETUID
+      - SETGID
     security_opt:
       - no-new-privileges:true
     labels:
@@ -240,6 +244,8 @@ services:
       - /config:rw,noexec,nosuid,size=16m
       - /tmp:rw,noexec,nosuid,size=16m
     cap_drop: [ALL]
+    cap_add:
+      - NET_BIND_SERVICE
     security_opt:
       - no-new-privileges:true
     labels:
@@ -264,10 +270,12 @@ services:
         source: ${VIGNETTE_TUNNEL_CONFIG_PATH:?Rendered cloudflared config path is required}
         target: /etc/cloudflared/config.yml
         read_only: true
-      - type: bind
-        source: ${VIGNETTE_TUNNEL_CREDENTIAL_PATH:?Tunnel credential JSON path is required}
-        target: /run/secrets/vignette-tunnel.json
+      - type: volume
+        source: cloudflaredsecrets
+        target: /run/secrets
         read_only: true
+        volume:
+          nocopy: true
     read_only: true
     tmpfs:
       - /tmp:rw,noexec,nosuid,size=32m
@@ -288,6 +296,9 @@ volumes:
   apiuploads:
     external: true
     name: ${VIGNETTE_NAS_APIUPLOADS_VOLUME:?Explicit NAS uploads volume name is required}
+  cloudflaredsecrets:
+    external: true
+    name: ${VIGNETTE_NAS_CLOUDFLARED_SECRETS_VOLUME:?Explicit NAS cloudflared secrets volume name is required}
 
 networks:
   backend: