diff --git a/Containerfile b/Containerfile
index ee2b95c..b5f7059 100644
--- a/Containerfile
+++ b/Containerfile
@@ -25,10 +25,9 @@ ARG UPSTREAM_JQ
 ARG TARBALL_JQ
 
 RUN fetch -qo /latest.json "${UPSTREAM_URL}" && \
-    echo $(jq -r "${UPSTREAM_JQ}" /latest.json) > /version && \
+    echo $(jq -r "${UPSTREAM_JQ}" /latest.json | sed  's/v//') > /version && \
     echo $(jq -r "${TARBALL_JQ}" /latest.json) > /tarball_url
 
-ARG CACHB=2
 # Fetch and extract source tarball
 RUN fetch -qo /tmp/opencloud.tar.gz "$(cat /tarball_url)" && \
     mkdir -m 0755 /opencloud && \
@@ -47,8 +46,11 @@ RUN for f in $(find /patches -name "*.patch");do \
     done
 
 RUN go install github.com/bwplotka/bingo@latest
-RUN EDITION=rolling gmake clean generate
-RUN EDITION=rolling gmake -C opencloud build
+
+ARG EDITION=rolling
+
+RUN EDITION="${EDITION}" gmake clean generate VERSION=$(cat /version)
+RUN EDITION="${EDITION}" gmake -C opencloud build VERSION=$(cat /version)
 
 
 FROM ghcr.io/daemonless/base:${BASE_VERSION}
@@ -92,7 +94,7 @@ LABEL org.opencontainers.image.title="OpenCloud" \
 COPY --from=builder --chmod=0755 --chown=bsd:bsd /opencloud/opencloud/bin/opencloud /app/opencloud
 
 # Record version information
-RUN su -m bsd -c "/app/opencloud version --skip-services 2>/dev/null" | sed -n 's/^Version: \(.*\)\+.*$/\1/p' > /app/version
+RUN su -m bsd -c "/app/opencloud version --skip-services 2>/dev/null" | sed -n 's/^Version: \(.*\)$/\1/p' > /app/version
 
 # Copy root filesystem
 COPY root/ /
@@ -100,6 +102,9 @@ COPY root/ /
 # Set permissions
 RUN chmod +x /etc/services.d/opencloud/run /healthz
 
+ENV OC_CONFIG_DIR=${OC_CONFIG_DIR:-/config/config/}
+ENV OC_BASE_DATA_PATH=${OC_BASE_DATA_PATH:-/config/}
+
 # --- Expose (Injected by Generator) ---
 EXPOSE 9200
 
diff --git a/Containerfile.j2 b/Containerfile.j2
index 54406e3..5851c3c 100644
--- a/Containerfile.j2
+++ b/Containerfile.j2
@@ -19,10 +19,9 @@ ARG UPSTREAM_JQ
 ARG TARBALL_JQ
 
 RUN fetch -qo /latest.json "${UPSTREAM_URL}" && \
-    echo $(jq -r "${UPSTREAM_JQ}" /latest.json) > /version && \
+    echo $(jq -r "${UPSTREAM_JQ}" /latest.json | sed  's/v//') > /version && \
     echo $(jq -r "${TARBALL_JQ}" /latest.json) > /tarball_url
 
-ARG CACHB=2
 # Fetch and extract source tarball
 RUN fetch -qo /tmp/opencloud.tar.gz "$(cat /tarball_url)" && \
     mkdir -m 0755 /opencloud && \
@@ -41,8 +40,11 @@ RUN for f in $(find /patches -name "*.patch");do \
     done
 
 RUN go install github.com/bwplotka/bingo@latest
-RUN EDITION=rolling gmake clean generate
-RUN EDITION=rolling gmake -C opencloud build
+
+ARG EDITION=rolling
+
+RUN EDITION="${EDITION}" gmake clean generate VERSION=$(cat /version)
+RUN EDITION="${EDITION}" gmake -C opencloud build VERSION=$(cat /version)
 
 
 FROM ghcr.io/daemonless/base:${BASE_VERSION}
@@ -88,7 +90,7 @@ LABEL org.opencontainers.image.title="OpenCloud" \
 COPY --from=builder --chmod=0755 --chown=bsd:bsd /opencloud/opencloud/bin/opencloud /app/opencloud
 
 # Record version information
-RUN su -m bsd -c "/app/opencloud version --skip-services 2>/dev/null" | sed -n 's/^Version: \(.*\)\+.*$/\1/p' > /app/version
+RUN su -m bsd -c "/app/opencloud version --skip-services 2>/dev/null" | sed -n 's/^Version: \(.*\)$/\1/p' > /app/version
 
 # Copy root filesystem
 COPY root/ /
@@ -96,6 +98,9 @@ COPY root/ /
 # Set permissions
 RUN chmod +x /etc/services.d/opencloud/run /healthz
 
+ENV OC_CONFIG_DIR=${OC_CONFIG_DIR:-/config/config/}
+ENV OC_BASE_DATA_PATH=${OC_BASE_DATA_PATH:-/config/}
+
 # --- Expose (Injected by Generator) ---
 {%- if ports %}
 EXPOSE {{ ports | map(attribute='target') | join(' ') }}
diff --git a/README.md b/README.md
index b5ce01f..2e0a37a 100644
--- a/README.md
+++ b/README.md
@@ -150,12 +150,20 @@ podman run -d --name opencloud \
 |------|----------|-------------|
 | `9200` | TCP | Web UI |
 
+!!! warning "Work in Progress"  
+This image is functional but may change significantly in a future release.
+
+## Breaking changes
+### untagged -> 0.1.0
+- `config` and data directories moved from `/config/.opencloud` to `/config`  
+  Existing data will be moved automatically during container initialization.
+
 ## Upgrade from 6.2.0 to 7.0.0
 The upgrade requires a change to the configuration of the "sharing" service. Please follow the steps outlined in the [Upgrade Guide](https://docs.opencloud.eu/docs/admin/maintenance/upgrade/upgrade-guide#verify-configuration-changes) to achieve that.
 
 ## First run
-OpenCloud generates a default config with insecure settings (not TLS validation) on first start
-or if the `/config/.opencloud` directory does not exist.  
+OpenCloud generates a default config with insecure settings (no TLS validation) on first start
+or if the file `/config/config/opencloud.yaml` does not exist.  
 
 You can define the inital password for the `admin` user by setting the environment variable `IDM_ADMIN_PASSWORD` like this:
 ```yaml
@@ -166,7 +174,7 @@ services:
 ```
 
 If you do not set the password with the variable above, OpenCloud generates a random password for the `admin` user and
-you can find it in the logs or in the file `/config/.opencloud/config/opencloud.yaml`.
+you can find it in the logs or in the file `/config/config/opencloud.yaml`.
 
 ## Remarks
 So far I have only tested this image with `bridge` networking.  
diff --git a/compose.yaml b/compose.yaml
index 922f081..c46c5d3 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -24,12 +24,20 @@ x-daemonless:
       9200: "Web UI"
 
   notes: |
+    !!! warning "Work in Progress"  
+    This image is functional but may change significantly in a future release.
+
+    ## Breaking changes
+    ### untagged -> 0.1.0
+    - `config` and data directories moved from `/config/.opencloud` to `/config`  
+      Existing data will be moved automatically during container initialization.
+
     ## Upgrade from 6.2.0 to 7.0.0
     The upgrade requires a change to the configuration of the "sharing" service. Please follow the steps outlined in the [Upgrade Guide](https://docs.opencloud.eu/docs/admin/maintenance/upgrade/upgrade-guide#verify-configuration-changes) to achieve that.
 
     ## First run
-    OpenCloud generates a default config with insecure settings (not TLS validation) on first start
-    or if the `/config/.opencloud` directory does not exist.  
+    OpenCloud generates a default config with insecure settings (no TLS validation) on first start
+    or if the file `/config/config/opencloud.yaml` does not exist.  
     
     You can define the inital password for the `admin` user by setting the environment variable `IDM_ADMIN_PASSWORD` like this:
     ```yaml
@@ -40,7 +48,7 @@ x-daemonless:
     ```
 
     If you do not set the password with the variable above, OpenCloud generates a random password for the `admin` user and
-    you can find it in the logs or in the file `/config/.opencloud/config/opencloud.yaml`.
+    you can find it in the logs or in the file `/config/config/opencloud.yaml`.
 
     ## Remarks
     So far I have only tested this image with `bridge` networking.  
diff --git a/patches/patch-.make_protobuf.mk.patch b/patches/patch-.make_protobuf.mk.patch
index 86a1435..3830b23 100644
--- a/patches/patch-.make_protobuf.mk.patch
+++ b/patches/patch-.make_protobuf.mk.patch
@@ -8,3 +8,12 @@
  	@cd ../.. && GOPATH="" GOBIN=".bingo" $(BINGO) get -l github.com/go-micro/generator/cmd/protoc-gen-micro
  	@cd ../.. && GOPATH="" GOBIN=".bingo" $(BINGO) get -l github.com/owncloud/protoc-gen-microweb
  	@cd ../.. && GOPATH="" GOBIN=".bingo" $(BINGO) get -l github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2
+@@ -16,7 +16,7 @@
+ .PHONY: buf-generate
+ buf-generate: $(SHA1_LOCK_FILE)
+ 	@find $(abspath $(CURDIR)/../../protogen/proto/) -type f -print0 | sort -z | xargs -0 sha1sum > buf.sha1.lock.tmp
+-	@cmp $(SHA1_LOCK_FILE) buf.sha1.lock.tmp --quiet || $(MAKE) -B $(SHA1_LOCK_FILE)
++	@cmp -s $(SHA1_LOCK_FILE) buf.sha1.lock.tmp || $(MAKE) -B $(SHA1_LOCK_FILE)
+ 	@rm -f buf.sha1.lock.tmp
+
+ $(SHA1_LOCK_FILE): $(BUF) protoc-deps
diff --git a/root/etc/cont-init.d/19-move-config b/root/etc/cont-init.d/19-move-config
new file mode 100755
index 0000000..d75f1d7
--- /dev/null
+++ b/root/etc/cont-init.d/19-move-config
@@ -0,0 +1,22 @@
+#!/bin/sh
+# Move the config and data from the old default location
+# directly into /config
+
+# Ensure directories exist and have correct ownership
+mkdir -p /config
+chown -R bsd:bsd /config
+
+if [ ! -d /config/.opencloud ]; then
+  # If the old base directory does not exist, we do not do anything
+  exit 0
+fi
+
+# Generate default config if missing
+if [ ! -d /config/config ]; then
+  mv /config/.opencloud/* /config
+  if [ "$?" -eq 0 ]; then
+    rm -r /config/.opencloud
+  fi
+  echo "[move-config] OpenCloud config and data moved from /config/.opencloud to /config"
+fi
+
diff --git a/root/etc/cont-init.d/20-opencloud-init b/root/etc/cont-init.d/20-opencloud-init
index 5689d9e..aedc9c2 100755
--- a/root/etc/cont-init.d/20-opencloud-init
+++ b/root/etc/cont-init.d/20-opencloud-init
@@ -6,7 +6,7 @@ mkdir -p /config
 chown -R bsd:bsd /config
 
 # Generate default config if missing
-if [ ! -d /config/opencloud ]; then
+if [ ! -f /config/config/opencloud.yaml ]; then
   HOME=/config s6-setuidgid bsd /app/opencloud init --insecure yes || true
 fi
 
diff --git a/root/etc/services.d/opencloud/run b/root/etc/services.d/opencloud/run
index d633f5e..074cb30 100755
--- a/root/etc/services.d/opencloud/run
+++ b/root/etc/services.d/opencloud/run
@@ -1,14 +1,6 @@
 #!/bin/sh
 # OpenCloud s6 service
 
-#if [ -z "$TUNNEL_TOKEN" ]; then
-#    echo "[WARN] TUNNEL_TOKEN is not set. Starting in CIT mock mode."
-#    # Log version to prove binary is functional
-#    /usr/local/bin/opencloud --version
-#    # Listen on port 8080 to satisfy CI port check
-#    exec /usr/bin/nc -lk 0.0.0.0 8080
-#fi
-
 echo "[INFO] Starting opencloud..."
 
 HOME=/config