diff --git a/rootfs/usr/local/etc/docker/functions/entrypoint.sh b/rootfs/usr/local/etc/docker/functions/entrypoint.sh
index bf2f7b6..0699c40 100644
--- a/rootfs/usr/local/etc/docker/functions/entrypoint.sh
+++ b/rootfs/usr/local/etc/docker/functions/entrypoint.sh
@@ -417,22 +417,6 @@ __display_user_info() {
   fi
 }
 # - - - - - - - - - - - - - - - - - - - - - - - - -
-__init_config_etc() {
-  local copy="no"
-  local name="$SERVICE_NAME"
-  local etc_dir="${ETC_DIR:-/etc/$name}"
-  local conf_dir="${CONF_DIR:-/config/$name}"
-  __is_dir_empty "$conf_dir" && copy=yes
-  if [ "$copy" = "yes" ]; then
-    if [ -d "$etc_dir" ]; then
-      mkdir -p "$conf_dir"
-      __copy_templates "$etc_dir/." "$conf_dir/"
-    elif [ -f "$etc_dir" ]; then
-      __copy_templates "$etc_dir" "$conf_dir"
-    fi
-  fi
-  # - - - - - - - - - - - - - - - - - - - - - - - - -
-}
 __create_ssl_cert() {
   local SSL_DIR="${SSL_DIR:-/etc/ssl}"
   [ -f "/config/env/ssl.sh" ] && . "/config/env/ssl.sh"
diff --git a/rootfs/usr/local/etc/docker/init.d/05-dockerd.sh b/rootfs/usr/local/etc/docker/init.d/05-dockerd.sh
index 3c2b463..206ab3a 100755
--- a/rootfs/usr/local/etc/docker/init.d/05-dockerd.sh
+++ b/rootfs/usr/local/etc/docker/init.d/05-dockerd.sh
@@ -178,7 +178,7 @@ EXEC_CMD_ARGS='-H tcp://0.0.0.0:$SERVICE_PORT '
 # command arguments
 EXEC_CMD_ARGS+='-H unix:///var/run/docker.sock '
 # command arguments
-EXEC_CMD_ARGS+='-H unix:///tmp/docker.sock --config-file $ETC_DIR/daemon.json'
+EXEC_CMD_ARGS+='-H unix:///tmp/docker.sock --config-file $CONF_DIR/daemon.json'
 # execute script before
 EXEC_PRE_SCRIPT=''
 # Set to no if the service is not running otherwise leave blank
@@ -263,10 +263,16 @@ __run_precopy() {
 	# Define environment
 	local hostname=${HOSTNAME}
 	[ -d "/run/healthcheck" ] || mkdir -p "/run/healthcheck"
-	# Seed /config/$SERVICE_NAME from the baked /etc copy on first run
-	if [ -d "$ETC_DIR" ] && __is_dir_empty "$CONF_DIR"; then
-		mkdir -p "$CONF_DIR"
-		cp -Rf "$ETC_DIR/." "$CONF_DIR/" 2>/dev/null || true
+	# Seed /config/$SERVICE_NAME from the baked /etc copy on first run,
+	# then replace the /etc/$SERVICE_NAME directory with a symlink to /config/$SERVICE_NAME
+	# so both paths always resolve to the same processed config.
+	if [ -d "$ETC_DIR" ] && ! [ -L "$ETC_DIR" ]; then
+		if __is_dir_empty "$CONF_DIR"; then
+			mkdir -p "$CONF_DIR"
+			cp -Rf "$ETC_DIR/." "$CONF_DIR/" 2>/dev/null || true
+		fi
+		rm -Rf "$ETC_DIR"
+		ln -sf "$CONF_DIR" "$ETC_DIR"
 	fi
 	# allow custom functions
 	if builtin type -t __run_precopy_local | grep -q 'function'; then __run_precopy_local; fi
@@ -445,10 +451,6 @@ EOF
 EOF
 			fi
 		fi
-		if [ -f "/config/docker/daemon.json" ] && [ ! -L "/etc/docker/daemon.json" ]; then
-			cp -Rf "/config/docker/daemon.json" "/etc/docker/daemon.json"
-		fi
-		[ -f "$ETC_DIR/daemon.json" ] && sed -i 's|"REPLACE_DOCKER_REGISTRIES"|'$registry'|g' "$ETC_DIR/daemon.json"
 		[ -f "$CONF_DIR/daemon.json" ] && sed -i 's|"REPLACE_DOCKER_REGISTRIES"|'$registry'|g' "$CONF_DIR/daemon.json"
 	}
 	exitStatus=$?
@@ -976,13 +978,8 @@ __run_secure_function
 # - - - - - - - - - - - - - - - - - - - - - - - - -
 __run_precopy
 # - - - - - - - - - - - - - - - - - - - - - - - - -
-# Copy /config to /etc
-for config_2_etc in $CONF_DIR $ADDITIONAL_CONFIG_DIRS; do
-	__initialize_system_etc "$config_2_etc" 2>/dev/stderr | tee -p -a "/data/logs/init.txt"
-done
-# - - - - - - - - - - - - - - - - - - - - - - - - -
 # Replace variables
-__initialize_replace_variables "$ETC_DIR" "$CONF_DIR" "$ADDITIONAL_CONFIG_DIRS" "$WWW_ROOT_DIR"
+__initialize_replace_variables "$CONF_DIR" "$ADDITIONAL_CONFIG_DIRS" "$WWW_ROOT_DIR"
 # - - - - - - - - - - - - - - - - - - - - - - - - -
 #
 __initialize_database
diff --git a/rootfs/usr/local/etc/docker/init.d/08-gitea.sh b/rootfs/usr/local/etc/docker/init.d/08-gitea.sh
index 0ee6ee2..7f1235a 100755
--- a/rootfs/usr/local/etc/docker/init.d/08-gitea.sh
+++ b/rootfs/usr/local/etc/docker/init.d/08-gitea.sh
@@ -176,7 +176,7 @@ EXEC_CMD_BIN='gitea'
 # command arguments
 EXEC_CMD_ARGS='web '
 # command arguments
-EXEC_CMD_ARGS+='--port $SERVICE_PORT --config $ETC_DIR/app.ini '
+EXEC_CMD_ARGS+='--port $SERVICE_PORT --config $CONF_DIR/app.ini '
 # command arguments
 EXEC_CMD_ARGS+='--custom-path $CONF_DIR/custom --work-path $DATA_DIR '
 # execute script before
@@ -291,10 +291,16 @@ __run_precopy() {
 	# during container startup, after the entrypoint's initial copy. Applying it here
 	# (in the init.d phase) ensures it takes effect after Docker finishes network setup.
 	[ -f "/usr/local/etc/resolv.conf" ] && cp -f "/usr/local/etc/resolv.conf" "/etc/resolv.conf" 2>/dev/null || true
-	# Seed /config/$SERVICE_NAME from the baked /etc copy on first run
-	if [ -d "$ETC_DIR" ] && __is_dir_empty "$CONF_DIR"; then
-		mkdir -p "$CONF_DIR"
-		cp -Rf "$ETC_DIR/." "$CONF_DIR/" 2>/dev/null || true
+	# Seed /config/$SERVICE_NAME from the baked /etc copy on first run,
+	# then replace the /etc/$SERVICE_NAME directory with a symlink to /config/$SERVICE_NAME
+	# so both paths always resolve to the same processed config.
+	if [ -d "$ETC_DIR" ] && ! [ -L "$ETC_DIR" ]; then
+		if __is_dir_empty "$CONF_DIR"; then
+			mkdir -p "$CONF_DIR"
+			cp -Rf "$ETC_DIR/." "$CONF_DIR/" 2>/dev/null || true
+		fi
+		rm -Rf "$ETC_DIR"
+		ln -sf "$CONF_DIR" "$ETC_DIR"
 	fi
 	# allow custom functions
 	if builtin type -t __run_precopy_local | grep -q 'function'; then __run_precopy_local; fi
@@ -392,10 +398,7 @@ __update_conf_files() {
 		sed -i "s|REPLACE_GITEA_LFS_JWT_SECRET|$GITEA_LFS_JWT_SECRET|g" "$CONF_DIR/app.ini"
 	fi
 	# Re-stamp dynamic values and remove deprecated settings on every startup.
-	# Applied to both the persistent copy (/config/gitea) and the runtime copy
-	# (/etc/gitea) so Gitea sees the correct values on this boot without needing
-	# a second restart.
-	for _ini_file in "$CONF_DIR/app.ini" "$ETC_DIR/app.ini"; do
+	for _ini_file in "$CONF_DIR/app.ini"; do
 		[ -f "$_ini_file" ] || continue
 		# Sync ROOT_URL, DOMAIN, and SSH_DOMAIN from current env vars
 		sed -i "s|^ROOT_URL[[:space:]]*=.*|ROOT_URL = ${SERVICE_PROTOCOL:-http}://${HOSTNAME}|" "$_ini_file"
@@ -908,13 +911,8 @@ __run_secure_function
 # - - - - - - - - - - - - - - - - - - - - - - - - -
 __run_precopy
 # - - - - - - - - - - - - - - - - - - - - - - - - -
-# Copy /config to /etc
-for config_2_etc in $CONF_DIR $ADDITIONAL_CONFIG_DIRS; do
-	__initialize_system_etc "$config_2_etc" 2>/dev/stderr | tee -p -a "/data/logs/init.txt"
-done
-# - - - - - - - - - - - - - - - - - - - - - - - - -
 # Replace variables
-__initialize_replace_variables "$ETC_DIR" "$CONF_DIR" "$ADDITIONAL_CONFIG_DIRS" "$WWW_ROOT_DIR"
+__initialize_replace_variables "$CONF_DIR" "$ADDITIONAL_CONFIG_DIRS" "$WWW_ROOT_DIR"
 # - - - - - - - - - - - - - - - - - - - - - - - - -
 #
 __initialize_database
diff --git a/rootfs/usr/local/etc/docker/init.d/zz-act_runner.sh b/rootfs/usr/local/etc/docker/init.d/zz-act_runner.sh
index 6911676..9f86445 100755
--- a/rootfs/usr/local/etc/docker/init.d/zz-act_runner.sh
+++ b/rootfs/usr/local/etc/docker/init.d/zz-act_runner.sh
@@ -297,13 +297,13 @@ RUNNER_LABELS+="ubuntu-latest:docker://catthehacker/ubuntu:full-latest"
 unset _HOST_ARCH _ARCH_LABEL
 # - - - - - - - - - - - - - - - - - - - - - - - - -
 RUNNER_IP_ADDRESS="${RUNNER_IP_ADDRESS:-$IP4_ADDRESS}"
-RUNNER_CONFIG_DEFAULT="${RUNNER_CONFIG_DEFAULT:-$ETC_DIR/default_config.yaml}"
+RUNNER_CONFIG_DEFAULT="${RUNNER_CONFIG_DEFAULT:-$CONF_DIR/default_config.yaml}"
 RUNNER_DEFAULT_HOME="${RUNNER_DEFAULT_HOME:-$CONF_DIR/gitea}"
 RUNNER_CONFIG_NAME="${RUNNER_CONFIG_NAME:-act_runner.yaml}"
 RUNNER_LOG_FILE="${RUNNER_LOG_FILE:-$LOG_DIR/register.log}"
 RUNNER_DAEMON_LOG="${RUNNER_DAEMON_LOG:-$LOG_DIR/daemon.log}"
 RUNNER_CACHE_HOST="${RUNNER_CACHE_HOST:-$IP4_ADDRESS}"
-CACHE_CONFIG_FILE="${CACHE_CONFIG_FILE:-$ETC_DIR/cache_server.yaml}"
+CACHE_CONFIG_FILE="${CACHE_CONFIG_FILE:-$CONF_DIR/cache_server.yaml}"
 CACHE_LOG_FILE="${CACHE_LOG_FILE:-$LOG_DIR/cache.log}"
 # - - - - - - - - - - - - - - - - - - - - - - - - -
 # Additional variables
@@ -333,10 +333,16 @@ __run_precopy() {
 	# Define environment
 	local hostname=${HOSTNAME}
 	[ -d "/run/healthcheck" ] || mkdir -p "/run/healthcheck"
-	# Seed /config/$SERVICE_NAME from the baked /etc copy on first run
-	if [ -d "$ETC_DIR" ] && __is_dir_empty "$CONF_DIR"; then
-		mkdir -p "$CONF_DIR"
-		cp -Rf "$ETC_DIR/." "$CONF_DIR/" 2>/dev/null || true
+	# Seed /config/$SERVICE_NAME from the baked /etc copy on first run,
+	# then replace the /etc/$SERVICE_NAME directory with a symlink to /config/$SERVICE_NAME
+	# so both paths always resolve to the same processed config.
+	if [ -d "$ETC_DIR" ] && ! [ -L "$ETC_DIR" ]; then
+		if __is_dir_empty "$CONF_DIR"; then
+			mkdir -p "$CONF_DIR"
+			cp -Rf "$ETC_DIR/." "$CONF_DIR/" 2>/dev/null || true
+		fi
+		rm -Rf "$ETC_DIR"
+		ln -sf "$CONF_DIR" "$ETC_DIR"
 	fi
 	# allow custom functions
 	if builtin type -t __run_precopy_local | grep -q 'function'; then __run_precopy_local; fi
@@ -952,13 +958,8 @@ __run_secure_function
 # - - - - - - - - - - - - - - - - - - - - - - - - -
 __run_precopy
 # - - - - - - - - - - - - - - - - - - - - - - - - -
-# Copy /config to /etc
-for config_2_etc in $CONF_DIR $ADDITIONAL_CONFIG_DIRS; do
-	__initialize_system_etc "$config_2_etc" 2>/dev/stderr | tee -p -a "/data/logs/init.txt"
-done
-# - - - - - - - - - - - - - - - - - - - - - - - - -
 # Replace variables
-__initialize_replace_variables "$ETC_DIR" "$CONF_DIR" "$ADDITIONAL_CONFIG_DIRS" "$WWW_ROOT_DIR"
+__initialize_replace_variables "$CONF_DIR" "$ADDITIONAL_CONFIG_DIRS" "$WWW_ROOT_DIR"
 # - - - - - - - - - - - - - - - - - - - - - - - - -
 #
 __initialize_database