diff --git a/cameleer-server-app/src/main/java/com/cameleer/server/app/runtime/DeploymentExecutor.java b/cameleer-server-app/src/main/java/com/cameleer/server/app/runtime/DeploymentExecutor.java
index 73e1ed19..0e881878 100644
--- a/cameleer-server-app/src/main/java/com/cameleer/server/app/runtime/DeploymentExecutor.java
+++ b/cameleer-server-app/src/main/java/com/cameleer/server/app/runtime/DeploymentExecutor.java
@@ -593,6 +593,14 @@ public class DeploymentExecutor {
         envVars.put("CAMELEER_AGENT_REPLAY_ENABLED", String.valueOf(config.replayEnabled()));
         envVars.put("CAMELEER_AGENT_HEALTH_ENABLED", "true");
         envVars.put("CAMELEER_AGENT_HEALTH_PORT", String.valueOf(agentHealthPort));
+        // Tenant rootfs is readonly; the agent's default ./cameleer-diagrams
+        // (resolved against CWD /app) hits "Read-only file system" at startup
+        // and the agent logs the error every restart. Redirect to the
+        // per-container tmpfs — diagrams continue to flow to the server via
+        // HTTP, the on-disk copy goes to ephemeral storage that vanishes with
+        // the container, and no persistent artifact is written to the host.
+        // See AGENT-REFERENCE.md §3 "Metrics & Diagrams" for the property.
+        envVars.put("CAMELEER_AGENT_DIAGRAM_OUTPUTDIR", "/tmp/cameleer-diagrams");
         if (bootstrapToken != null && !bootstrapToken.isBlank()) {
             envVars.put("CAMELEER_AGENT_AUTH_TOKEN", bootstrapToken);
         }