diff --git a/README.md b/README.md
index cc6e63a..7f6ecbf 100644
--- a/README.md
+++ b/README.md
@@ -38,18 +38,20 @@ No static SSH keys required — Provisioning generates ephemeral keys per rebuil
 ### Setup
 
 ```bash
-mkdir -p /opt/provisioning
-cd /opt/provisioning
-
 # Log in to the container registry
 docker login gitea.thewrightserver.net
 
-# Pull the compose file
-curl -sO https://gitea.thewrightserver.net/josh/Provisioning/raw/branch/main/docker-compose.yml
+# Run the install script (creates /opt/provisioning with config templates)
+curl -sf https://gitea.thewrightserver.net/josh/Provisioning/raw/branch/main/deploy/install.sh | bash
+```
 
-# Pull example configs
-curl -s https://gitea.thewrightserver.net/josh/Provisioning/raw/branch/main/deploy/provisioning.example.yaml -o provisioning.yaml
-curl -s https://gitea.thewrightserver.net/josh/Provisioning/raw/branch/main/deploy/server-types.example.yaml -o server-types.yaml
+Or manually:
+
+```bash
+mkdir -p /opt/provisioning && cd /opt/provisioning
+curl -sfO https://gitea.thewrightserver.net/josh/Provisioning/raw/branch/main/docker-compose.yml
+curl -sf https://gitea.thewrightserver.net/josh/Provisioning/raw/branch/main/deploy/provisioning.example.yaml -o provisioning.yaml
+curl -sf https://gitea.thewrightserver.net/josh/Provisioning/raw/branch/main/deploy/server-types.example.yaml -o server-types.yaml
 ```
 
 ### Configure
diff --git a/deploy/Dockerfile b/deploy/Dockerfile
index f73e2aa..c83e5ef 100644
--- a/deploy/Dockerfile
+++ b/deploy/Dockerfile
@@ -19,10 +19,10 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 
 COPY --from=builder /provisioning /usr/local/bin/provisioning
 
-RUN mkdir -p /data /etc/provisioning/keys
+RUN mkdir -p /data
 
 EXPOSE 8080
-VOLUME ["/data", "/etc/provisioning"]
+VOLUME ["/data"]
 
 ENTRYPOINT ["/usr/local/bin/provisioning"]
 CMD ["-config", "/etc/provisioning/provisioning.yaml"]
diff --git a/deploy/install.sh b/deploy/install.sh
new file mode 100644
index 0000000..bd4f5c3
--- /dev/null
+++ b/deploy/install.sh
@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+DEPLOY_DIR="${1:-/opt/provisioning}"
+
+mkdir -p "$DEPLOY_DIR"
+cd "$DEPLOY_DIR"
+
+REPO_RAW="https://gitea.thewrightserver.net/josh/Provisioning/raw/branch/main"
+
+# Always pull latest compose file
+curl -sfO "$REPO_RAW/docker-compose.yml"
+
+# Create config files from examples if they don't exist
+if [ ! -f provisioning.yaml ]; then
+    curl -sf "$REPO_RAW/deploy/provisioning.example.yaml" -o provisioning.yaml
+    echo "Created provisioning.yaml — edit it with your values before starting."
+fi
+
+if [ ! -f server-types.yaml ]; then
+    curl -sf "$REPO_RAW/deploy/server-types.example.yaml" -o server-types.yaml
+    echo "Created server-types.yaml — edit it with your hardware types."
+fi
+
+echo ""
+echo "Deploy directory: $DEPLOY_DIR"
+echo ""
+echo "Next steps:"
+echo "  1. Edit provisioning.yaml with your network/cluster settings"
+echo "  2. Edit server-types.yaml with your hardware types"
+echo "  3. docker compose up -d"
diff --git a/docker-compose.yml b/docker-compose.yml
index 4e64d66..27860c5 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -7,7 +7,6 @@ services:
     volumes:
       - ./provisioning.yaml:/etc/provisioning/provisioning.yaml:ro
       - ./server-types.yaml:/etc/provisioning/server-types.yaml:ro
-      - ./keys:/etc/provisioning/keys:ro
       - data:/data
     command: ["-config", "/etc/provisioning/provisioning.yaml"]
     cap_add: