diff --git a/ghost-en/deployment.yaml b/ghost-en/deployment.yaml
index 1b0b831..a7f36df 100644
--- a/ghost-en/deployment.yaml
+++ b/ghost-en/deployment.yaml
@@ -41,6 +41,24 @@ spec:
       labels:
         app: ghost-en
     spec:
+      # Stage the GitOps-managed redirects file onto the writable content PVC.
+      # A ConfigMap volume is always read-only at the FS level, so the Ghost
+      # entrypoint's `chown -R` on content/ fails ("Read-only file system").
+      # Copying via an initContainer leaves a normal, chownable file on the PVC,
+      # refreshed from the ConfigMap (git source of truth) on every pod start.
+      initContainers:
+        - name: install-redirects
+          image: ghost:5-alpine
+          command:
+            - sh
+            - -c
+            - "mkdir -p /var/lib/ghost/content/data && cp /redirects-src/redirects.yaml /var/lib/ghost/content/data/redirects.yaml"
+          volumeMounts:
+            - name: ghost-en-content
+              mountPath: /var/lib/ghost/content
+            - name: redirects
+              mountPath: /redirects-src
+              readOnly: true
       containers:
         - name: ghost
           image: ghost:5-alpine
@@ -101,12 +119,6 @@ spec:
           volumeMounts:
             - name: ghost-en-content
               mountPath: /var/lib/ghost/content
-            # Custom redirects, GitOps-managed via the ghost-en-redirects ConfigMap.
-            # Nested read-only file mount inside the content PVC's data dir.
-            - name: redirects
-              mountPath: /var/lib/ghost/content/data/redirects.yaml
-              subPath: redirects.yaml
-              readOnly: true
       volumes:
         - name: ghost-en-content
           persistentVolumeClaim: