diff --git a/CHANGELOG.md b/CHANGELOG.md
index e0402f04d..2aea6bbad 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -159,6 +159,18 @@ Version 5.x is JDK17 LTS bytecode compatible, with Docker and JUnit / direct Jav
 * Version updates (build dependencies)
   * TBD
 
+## 5.2.1
+
+* Features and fixes
+  * fix: Restore the ability to persist data to a mounted Docker volume. Since the migration to the Cloud Native Buildpacks OCI image (which runs as the non-root `cnb` user), a mounted named volume was no longer writable. The image now pre-creates a `cnb`-owned `/s3mockroot` directory, so a Docker named volume mounted at `/s3mockroot` (with `COM_ADOBE_TESTING_S3MOCK_STORE_ROOT=/s3mockroot`) is writable without running the container as root. S3Mock now also fails fast with a clear message when the configured store root is not writable, creates nested store-root paths (not just a single missing directory), and `S3MockContainer.withNamedVolume(...)` plus a container restart persistence test were added. The image also restores `/` (rather than the Buildpacks default `/workspace`) as its working directory, so a *relative* `COM_ADOBE_TESTING_S3MOCK_STORE_ROOT` resolves exactly as it did before 5.2 instead of silently resolving under `/workspace` and missing the mounted volume; the resolved absolute root folder is now always logged at startup alongside the configured value. ([#3139](https://github.com/adobe/S3Mock/issues/3139))
+* Version updates (deliverable dependencies)
+  * N/A
+* Version updates (build dependencies)
+  * Bump actions/setup-java from 5.7.0 to 6.0.0
+  * Bump github/codeql-action from 4.37.7 to 4.37.9
+  * Bump docker/setup-qemu-action from 4.2.0 to 4.3.0
+  * Bump step-security/harden-runner from 2.21.0 to 2.21.1
+
 ## 5.2.0
 
 * Features and fixes
@@ -216,7 +228,7 @@ Version 5.x is JDK17 LTS bytecode compatible, with Docker and JUnit / direct Jav
   * Bump docker/setup-qemu-action from 4.1.0 to 4.2.0
   * Bump github/codeql-action from 4.36.2 to 4.37.7
   * Bump ossf/scorecard-action from 2.4.3 to 2.4.4
-  * Bump step-security/harden-runner from 2.19.4 to 2.21.1
+  * Bump step-security/harden-runner from 2.19.4 to 2.21.0
 
 ## 5.1.0
 
diff --git a/README.md b/README.md
index 1791d4b79..4ebbf7096 100755
--- a/README.md
+++ b/README.md
@@ -302,20 +302,46 @@ services:
       - 9191:9191
 ```
 
-**With persistent storage:**
+**With persistent storage (named volume):**
 ```yaml
 services:
   s3mock:
     image: adobe/s3mock:latest
     environment:
-      - COM_ADOBE_TESTING_S3MOCK_STORE_ROOT=containers3root
+      # /s3mockroot is pre-created in the image, owned by the non-root user the container runs as,
+      # so a mounted named volume is writable without running the container as root.
+      - COM_ADOBE_TESTING_S3MOCK_STORE_ROOT=/s3mockroot
       - COM_ADOBE_TESTING_S3MOCK_STORE_RETAIN_FILES_ON_EXIT=true
     ports:
       - 9090:9090
     volumes:
-      - ./locals3root:/containers3root
+      - s3mockdata:/s3mockroot
+
+volumes:
+  s3mockdata:
 ```
 
+> The store root **must** be `/s3mockroot` for a Docker named volume: the image runs as the
+> non-root `cnb` user, and Docker only makes a named volume writable by that user when it is
+> mounted onto a directory that already exists in the image with that ownership. A bind mount
+> (`./host/path:/s3mockroot`) keeps its host ownership instead, so it must be writable by that
+> user (uid 1000).
+>
+> A Docker named volume (`s3mockdata:/s3mockroot` above) is **not** a host directory you can
+> browse directly — Docker manages its storage location internally. Use
+> `docker volume inspect <project>_s3mockdata` to find its `Mountpoint`, or
+> `docker run --rm -v <project>_s3mockdata:/v alpine ls /v` to list its contents. If you need a
+> predictable, browsable host path instead, use a bind mount
+> (`./locals3root:/s3mockroot`), keeping in mind the ownership requirement above.
+>
+> A **relative** `COM_ADOBE_TESTING_S3MOCK_STORE_ROOT` (e.g. `data` instead of `/data`) resolves
+> against the container's working directory, which the image sets to `/` — so `data` resolves
+> to `/data`, matching a volume mounted at `/data`. This is unrelated to the `/s3mockroot`
+> named-volume requirement above: prefer an absolute path in general so the resolved location
+> doesn't depend on the image's working directory. The resolved absolute root folder is always
+> logged at startup, alongside the configured value, to make a mismatch between the two easy to
+> spot.
+
 ### Testcontainers
 
 The [`S3MockContainer`](testsupport/testcontainers/src/main/kotlin/com/adobe/testing/s3mock/testcontainers/S3MockContainer.kt) provides a ready-to-use Testcontainers implementation.
@@ -443,7 +469,7 @@ Configure S3Mock using environment variables:
 
 | Variable                                              | Default             | Description                                                   |
 |-------------------------------------------------------|---------------------|---------------------------------------------------------------|
-| `COM_ADOBE_TESTING_S3MOCK_STORE_ROOT`                 | Java temp directory | Base directory for file storage                               |
+| `COM_ADOBE_TESTING_S3MOCK_STORE_ROOT`                 | Java temp directory | Base directory for file storage (use `/s3mockroot` to persist to a mounted named volume) |
 | `COM_ADOBE_TESTING_S3MOCK_STORE_REGION`               | `us-east-1`         | AWS region to mock                                            |
 | `COM_ADOBE_TESTING_S3MOCK_STORE_INITIAL_BUCKETS`      | none                | Comma-separated list of buckets to create on startup          |
 | `COM_ADOBE_TESTING_S3MOCK_STORE_RETAIN_FILES_ON_EXIT` | `false`             | Keep files after shutdown                                     |
diff --git a/docs/SETUP.md b/docs/SETUP.md
index 82d42fe1b..f845cde3e 100644
--- a/docs/SETUP.md
+++ b/docs/SETUP.md
@@ -36,7 +36,7 @@ S3Mock is configured via environment variables (Docker / Testcontainers) or Spri
 
 | Environment variable | Spring property | Default | Description |
 |---|---|---|---|
-| `COM_ADOBE_TESTING_S3MOCK_STORE_ROOT` | `com.adobe.testing.s3mock.store.root` | temp dir | Storage root directory |
+| `COM_ADOBE_TESTING_S3MOCK_STORE_ROOT` | `com.adobe.testing.s3mock.store.root` | temp dir | Storage root directory (use `/s3mockroot` to persist to a mounted Docker named volume) |
 | `COM_ADOBE_TESTING_S3MOCK_STORE_RETAIN_FILES_ON_EXIT` | `com.adobe.testing.s3mock.store.retainFilesOnExit` | `false` | Keep files on shutdown |
 | `COM_ADOBE_TESTING_S3MOCK_STORE_REGION` | `com.adobe.testing.s3mock.store.region` | `us-east-1` | AWS region |
 | `COM_ADOBE_TESTING_S3MOCK_STORE_INITIAL_BUCKETS` | `com.adobe.testing.s3mock.store.initialBuckets` | _(none)_ | Comma-separated bucket names to create on startup |
@@ -56,16 +56,20 @@ Or with Docker directly:
 docker run -p 9090:9090 -p 9191:9191 adobe/s3mock
 ```
 
-With persistent storage:
+With persistent storage (named volume):
 ```bash
 docker run \
   -p 9090:9090 -p 9191:9191 \
-  -e COM_ADOBE_TESTING_S3MOCK_STORE_ROOT=/data \
+  -e COM_ADOBE_TESTING_S3MOCK_STORE_ROOT=/s3mockroot \
   -e COM_ADOBE_TESTING_S3MOCK_STORE_RETAIN_FILES_ON_EXIT=true \
-  -v /local/path:/data \
+  -v s3mockdata:/s3mockroot \
   adobe/s3mock
 ```
 
+`/s3mockroot` is pre-created in the image owned by the non-root `cnb` user the container runs as,
+so a Docker named volume mounted there is writable without running as root. A bind mount
+(`-v /local/path:/s3mockroot`) keeps its host ownership and must be writable by uid 1000 instead.
+
 ## Running Tests
 
 ```bash
@@ -119,3 +123,5 @@ MANAGEMENT_ENDPOINTS_ACCESS_DEFAULT=unrestricted docker run -p 9090:9090 -p 9191
 | `NoClassDefFoundError` in in-process test | Spring Boot version mismatch | Ensure your project is Spring Boot 4.x compatible |
 | HTTPS connection refused | Client not trusting self-signed cert | Configure trust-all-certs on your AWS SDK client |
 | Empty bucket after restart | `retainFilesOnExit` defaults to false | Set `COM_ADOBE_TESTING_S3MOCK_STORE_RETAIN_FILES_ON_EXIT=true` and use a fixed `STORE_ROOT` |
+| HTTP 500 / `not writable` at startup when mounting a volume | Docker named volume or bind mount not writable by the non-root `cnb` user | Mount a **named volume** at `/s3mockroot` and set `COM_ADOBE_TESTING_S3MOCK_STORE_ROOT=/s3mockroot`; for a bind mount, make the host directory writable by uid 1000 |
+| Container starts fine, `2xx` responses, but a mounted volume stays empty | A **relative** `STORE_ROOT` (e.g. `s3root`) resolved against the wrong working directory, missing the mounted volume | Use an **absolute** `STORE_ROOT` (e.g. `/s3root`); check the startup log line showing the resolved absolute root folder against your mount path |
diff --git a/pom.xml b/pom.xml
index 4acfb931e..c1c719e96 100644
--- a/pom.xml
+++ b/pom.xml
@@ -76,6 +76,12 @@
     <checkstyle.version>14.0.0</checkstyle.version>
 
     <docker.image.name>adobe/s3mock</docker.image.name>
+    <!--
+      Local-only Cloud Native Buildpacks run image (see server/src/main/docker/run-image/Dockerfile).
+      It is built into the daemon and baked into the published app image, so it is never pushed to a
+      registry itself.
+    -->
+    <docker.run.image.name>adobe/s3mock-run</docker.run.image.name>
     <dokka-maven-plugin.version>2.2.0</dokka-maven-plugin.version>
     <exec-maven-plugin.version>3.6.3</exec-maven-plugin.version>
 
@@ -231,7 +237,7 @@
                  year bumps scoped to files actually touched (see INVARIANTS.md). -->
             <ratchetFrom>origin/main</ratchetFrom>
             <kotlin>
-              <ktlint />
+              <ktlint/>
               <licenseHeader>
                 <file>${maven.multiModuleProjectDirectory}/etc/license-header-spotless.txt</file>
               </licenseHeader>
@@ -401,8 +407,8 @@
               <requireJavaVersion>
                 <version>${java.version}</version>
               </requireJavaVersion>
-              <dependencyConvergence />
-              <requireUpperBoundDeps />
+              <dependencyConvergence/>
+              <requireUpperBoundDeps/>
             </rules>
           </configuration>
         </plugin>
@@ -470,15 +476,24 @@
           <configuration>
             <autoVersionSubmodules>true</autoVersionSubmodules>
             <goals>deploy -DskipTests -Prelease -P!build-docker-image -Ppush-docker-image</goals>
-            <!-- Skip Spotless during the release. The source already passed spotless:check in
-                 CI and every PRB. The maven-release-plugin rewrites every pom to set the
-                 release/next-dev version, and its JDOM writer normalizes empty elements to
-                 `<foo />` (with a space), which Spotless sortPom would then reject (`<foo/>`) -
-                 a violation the plugin introduces itself, not present in the committed source.
-                 `arguments` is passed to both the prepare (preparationGoals) and perform
+            <!-- The maven-release-plugin rewrites every pom to set the release/next-dev
+                 version, and its JDOM writer normalizes empty elements to `<foo />` (with a
+                 space), which Spotless sortPom would then reject (`<foo/>`) - a violation the
+                 plugin introduces itself, not present in the committed source. Both
+                 preparationGoals (after the release-version rewrite) and completionGoals
+                 (after the next-dev-version rewrite) run `spotless:apply` *before* the
+                 rewritten poms are committed, so the poms committed to main are always
+                 correctly formatted - not just skipped-and-left-broken, which previously left
+                 misformatted poms on main that failed spotless:check (ratchetFrom=origin/main)
+                 on the next PR touching any pom.xml. `spotless:apply` runs first so the
+                 plugin's own `<foo />` violations are fixed before `install`'s bound
+                 spotless:check phase would otherwise fail the build; `-Dspotless.check.skip`
+                 is kept as a safety net for the perform (goals) forked build. `arguments` is
+                 passed to both the prepare (preparationGoals/completionGoals) and perform
                  (goals) forked Maven builds. -->
             <arguments>-Dspotless.check.skip=true</arguments>
-            <preparationGoals>clean install</preparationGoals>
+            <preparationGoals>spotless:apply clean install</preparationGoals>
+            <completionGoals>spotless:apply</completionGoals>
             <tagNameFormat>@{project.version}</tagNameFormat>
           </configuration>
         </plugin>
diff --git a/server/pom.xml b/server/pom.xml
index 8ea39e80f..d64caadeb 100644
--- a/server/pom.xml
+++ b/server/pom.xml
@@ -189,6 +189,15 @@
               CVEs reported by users' image scanners. Multi-arch (linux/amd64 + linux/arm64).
             -->
             <builder>bellsoft/buildpacks.builder:musl</builder>
+            <!--
+              Use the locally built custom run image (server/src/main/docker/run-image/Dockerfile)
+              which pre-creates a `cnb`-owned /s3mockroot so a mounted named volume is writable by
+              the non-root user (see https://github.com/adobe/S3Mock/issues/3139). The concrete
+              runImage tag is set per build-image execution below (it is architecture specific).
+              IF_NOT_PRESENT keeps the buildpack from trying to pull our local-only run image from a
+              registry, while still pulling the builder on a clean machine when it is absent.
+            -->
+            <pullPolicy>IF_NOT_PRESENT</pullPolicy>
             <env>
               <BP_JVM_VERSION>${java.version}</BP_JVM_VERSION>
               <!-- Run jdeps + jlink to produce a minimal custom JRE (only required modules). -->
@@ -272,6 +281,33 @@
               </execution>
             </executions>
           </plugin>
+          <plugin>
+            <groupId>org.codehaus.mojo</groupId>
+            <artifactId>exec-maven-plugin</artifactId>
+            <executions>
+              <!--
+                Build the custom run image (host architecture) before build-image runs, so the
+                buildpack can resolve it locally via the IF_NOT_PRESENT pull policy. It pre-creates
+                a `cnb`-owned /s3mockroot so named volumes are writable by the non-root user.
+              -->
+              <execution>
+                <id>build-run-image</id>
+                <goals>
+                  <goal>exec</goal>
+                </goals>
+                <phase>prepare-package</phase>
+                <configuration>
+                  <executable>docker</executable>
+                  <arguments>
+                    <argument>build</argument>
+                    <argument>--tag</argument>
+                    <argument>${docker.run.image.name}:musl</argument>
+                    <argument>${project.basedir}/src/main/docker/run-image</argument>
+                  </arguments>
+                </configuration>
+              </execution>
+            </executions>
+          </plugin>
           <plugin>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-maven-plugin</artifactId>
@@ -285,6 +321,7 @@
                 <configuration>
                   <image>
                     <name>${docker.image.name}:${project.version}</name>
+                    <runImage>${docker.run.image.name}:musl</runImage>
                     <!-- Version tag names: major, minor, latest (patch is the image name above). -->
                     <tags>
                       <tag>${docker.image.name}:${parsedVersion.majorVersion}</tag>
@@ -303,6 +340,12 @@
       Release-only profile: builds both linux/amd64 and linux/arm64 images (arm64 via QEMU
       emulation on an amd64 runner), publishes each to a temporary per-architecture tag on
       Docker Hub, then merges them into a single multi-architecture manifest for the final tags.
+
+      Duplicates the build-helper-maven-plugin/exec-maven-plugin declarations from
+      build-docker-image above rather than sharing them: the two profiles are mutually
+      exclusive at release time (the root pom's release goals pass
+      "-P!build-docker-image -Ppush-docker-image"), and this profile's executions build/push
+      both architectures instead of just the host one.
     -->
     <profile>
       <id>push-docker-image</id>
@@ -328,6 +371,54 @@
             <groupId>org.codehaus.mojo</groupId>
             <artifactId>exec-maven-plugin</artifactId>
             <executions>
+              <!--
+                Build the custom run image for each architecture before build-image runs, so the
+                buildpack resolves it locally (IF_NOT_PRESENT) instead of pulling from a registry.
+                A local Docker image tag holds a single architecture, so amd64 and arm64 get
+                distinct tags referenced by the matching build-image execution below. arm64 is
+                emulated via QEMU (buildx) on the amd64 release runner. The run image only adds a
+                `cnb`-owned /s3mockroot so mounted named volumes are writable by the non-root user.
+              -->
+              <execution>
+                <id>build-run-image-amd64</id>
+                <goals>
+                  <goal>exec</goal>
+                </goals>
+                <phase>prepare-package</phase>
+                <configuration>
+                  <executable>docker</executable>
+                  <arguments>
+                    <argument>buildx</argument>
+                    <argument>build</argument>
+                    <argument>--platform</argument>
+                    <argument>linux/amd64</argument>
+                    <argument>--load</argument>
+                    <argument>--tag</argument>
+                    <argument>${docker.run.image.name}:musl-amd64</argument>
+                    <argument>${project.basedir}/src/main/docker/run-image</argument>
+                  </arguments>
+                </configuration>
+              </execution>
+              <execution>
+                <id>build-run-image-arm64</id>
+                <goals>
+                  <goal>exec</goal>
+                </goals>
+                <phase>prepare-package</phase>
+                <configuration>
+                  <executable>docker</executable>
+                  <arguments>
+                    <argument>buildx</argument>
+                    <argument>build</argument>
+                    <argument>--platform</argument>
+                    <argument>linux/arm64</argument>
+                    <argument>--load</argument>
+                    <argument>--tag</argument>
+                    <argument>${docker.run.image.name}:musl-arm64</argument>
+                    <argument>${project.basedir}/src/main/docker/run-image</argument>
+                  </arguments>
+                </configuration>
+              </execution>
               <!--
                 Merge the two per-architecture images into a single multi-arch manifest for the
                 final tags. Runs after both images have been published (package phase).
@@ -382,6 +473,7 @@
                 <configuration>
                   <image>
                     <name>${docker.image.name}:${project.version}-amd64</name>
+                    <runImage>${docker.run.image.name}:musl-amd64</runImage>
                     <imagePlatform>linux/amd64</imagePlatform>
                     <publish>true</publish>
                   </image>
@@ -396,6 +488,7 @@
                 <configuration>
                   <image>
                     <name>${docker.image.name}:${project.version}-arm64</name>
+                    <runImage>${docker.run.image.name}:musl-arm64</runImage>
                     <imagePlatform>linux/arm64</imagePlatform>
                     <publish>true</publish>
                   </image>
diff --git a/server/src/main/docker/run-image/Dockerfile b/server/src/main/docker/run-image/Dockerfile
new file mode 100644
index 000000000..663f8ea3b
--- /dev/null
+++ b/server/src/main/docker/run-image/Dockerfile
@@ -0,0 +1,47 @@
+#
+#  Copyright 2017-2026 Adobe.
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#          http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+#
+
+# Custom Cloud Native Buildpacks run image for the S3Mock OCI image.
+#
+# It extends the same BellSoft Alpaquita Linux (musl) hardened run image that the
+# `bellsoft/buildpacks.builder:musl` builder uses by default, and only adds an empty
+# `/s3mockroot` directory owned by the non-root `cnb` user that the image runs as.
+#
+# Why this exists (see https://github.com/adobe/S3Mock/issues/3139):
+# Buildpacks-built images run as the non-root `cnb` user. When a Docker *named volume* is
+# mounted onto a directory that already exists in the image, Docker initialises the fresh
+# volume with that directory's ownership. By pre-creating `/s3mockroot` owned by `cnb`, a named
+# volume mounted at `/s3mockroot` is writable by S3Mock without having to run the container as
+# root — so `COM_ADOBE_TESTING_S3MOCK_STORE_ROOT=/s3mockroot` persists data across restarts.
+#
+# The FROM tag is kept in sync with the builder's run image by Dependabot.
+FROM bellsoft/buildpacks.hardened-run:musl
+
+# CNB_USER_ID / CNB_GROUP_ID are provided by the run image (both 1000, the `cnb` user).
+USER root
+RUN mkdir -p /s3mockroot && chown "${CNB_USER_ID}:${CNB_GROUP_ID}" /s3mockroot
+
+# Restore the non-root user the buildpack lifecycle and the launched app run as.
+USER ${CNB_USER_ID}:${CNB_GROUP_ID}
+
+# The default Paketo/Buildpacks launch working directory is /workspace, whereas the pre-5.2
+# root-based image had no explicit WORKDIR (defaulting to /). A *relative*
+# COM_ADOBE_TESTING_S3MOCK_STORE_ROOT therefore silently resolved to a different absolute path
+# after the 5.2 migration (e.g. "s3root" -> /workspace/s3root instead of /s3root): the app still
+# started and served requests successfully, writing into a directory a mounted volume never
+# touched, so persisted data was silently lost on container recreation. Restoring "/" as the
+# working directory keeps relative store roots resolving exactly as they did before 5.2.
+WORKDIR /
diff --git a/server/src/main/kotlin/com/adobe/testing/s3mock/s3/store/StoreConfiguration.kt b/server/src/main/kotlin/com/adobe/testing/s3mock/s3/store/StoreConfiguration.kt
index 652c88ae3..3b1b8522b 100644
--- a/server/src/main/kotlin/com/adobe/testing/s3mock/s3/store/StoreConfiguration.kt
+++ b/server/src/main/kotlin/com/adobe/testing/s3mock/s3/store/StoreConfiguration.kt
@@ -13,7 +13,6 @@
  *  See the License for the specific language governing permissions and
  *  limitations under the License.
  */
-
 package com.adobe.testing.s3mock.s3.store
 
 import com.adobe.testing.s3mock.s3.dto.ObjectOwnership
@@ -136,23 +135,38 @@ class StoreConfiguration {
         }
       } else {
         val dir = File(rootPath)
-        if (dir.exists()) {
-          LOG.info(
-            "Using existing folder \"{}\" as root folder. Will retain files on exit: {}",
-            dir.absolutePath,
-            properties.retainFilesOnExit,
-          )
-        } else {
-          check(dir.mkdir()) {
+        if (!dir.exists()) {
+          // mkdirs() creates any missing parent directories (mkdir() only creates the leaf and
+          // fails for nested paths). It also returns false if another process already created
+          // the directory in the meantime, so tolerate that race instead of failing spuriously.
+          check(dir.mkdirs() || dir.isDirectory) {
             ("Root folder could not be created. Path: ${dir.absolutePath}")
           }
         }
+        check(dir.isDirectory) {
+          "Root folder \"${dir.absolutePath}\" exists but is not a directory."
+        }
         dir
       }
 
+    check(root.canWrite() && root.canExecute()) {
+      "Root folder \"${root.absolutePath}\" is not writable/traversable by the current user " +
+        "(\"${System.getProperty("user.name")}\"). Grant that user write and execute permission on the " +
+        "directory (and its parents). If running the S3Mock Docker image: mount a named Docker volume at " +
+        "/s3mockroot and set COM_ADOBE_TESTING_S3MOCK_STORE_ROOT=/s3mockroot - the image runs as the " +
+        "non-root 'cnb' user and pre-creates that directory, so Docker makes a named volume mounted there " +
+        "writable; a bind-mounted host directory instead keeps its host ownership and must be writable by " +
+        "that user."
+    }
+
+    // Log both the configured value and its resolved absolute path: a *relative* store root
+    // resolves against the process's current working directory, which is easy to misconfigure
+    // (e.g. against a mounted volume) without any error - see
+    // https://github.com/adobe/S3Mock/issues/3139.
     LOG.info(
-      "Successfully created \"{}\" as root folder. Will retain files on exit: {}",
+      "Using \"{}\" (configured as \"{}\") as root folder. Will retain files on exit: {}",
       root.absolutePath,
+      rootPath ?: "<default temp-dir>",
       properties.retainFilesOnExit,
     )
     return root
diff --git a/server/src/main/kotlin/com/adobe/testing/s3mock/s3/store/StoreProperties.kt b/server/src/main/kotlin/com/adobe/testing/s3mock/s3/store/StoreProperties.kt
index df3c88e42..55497b6b3 100644
--- a/server/src/main/kotlin/com/adobe/testing/s3mock/s3/store/StoreProperties.kt
+++ b/server/src/main/kotlin/com/adobe/testing/s3mock/s3/store/StoreProperties.kt
@@ -13,7 +13,6 @@
  *  See the License for the specific language governing permissions and
  *  limitations under the License.
  */
-
 package com.adobe.testing.s3mock.s3.store
 
 import org.springframework.boot.context.properties.ConfigurationProperties
@@ -25,7 +24,11 @@ data class StoreProperties(
 // True if files should be retained when S3Mock exits gracefully.
   // False to let S3Mock delete all files when S3Mock exits gracefully.
   @param:DefaultValue("false") val retainFilesOnExit: Boolean,
-  // The root directory to use. If omitted a default temp-dir will be used.
+  // The root directory to use for file storage. If omitted a default temp-dir will be used.
+  // May be set directly as a JVM/Spring property or via the COM_ADOBE_TESTING_S3MOCK_STORE_ROOT
+  // env var (e.g. in the Docker image or Testcontainers). Can be an arbitrary absolute or relative
+  // path, as long as it is writable by the user the process runs as; a relative path resolves
+  // against the process's working directory, same as any other relative path passed to the JVM.
   @param:DefaultValue("") val root: String,
   @param:DefaultValue("") val validKmsKeys: Set<String>,
   // A comma separated list of buckets that are to be created at startup.
diff --git a/server/src/test/kotlin/com/adobe/testing/s3mock/s3/store/StoreConfigurationTest.kt b/server/src/test/kotlin/com/adobe/testing/s3mock/s3/store/StoreConfigurationTest.kt
index c09ba893d..0db6c561c 100644
--- a/server/src/test/kotlin/com/adobe/testing/s3mock/s3/store/StoreConfigurationTest.kt
+++ b/server/src/test/kotlin/com/adobe/testing/s3mock/s3/store/StoreConfigurationTest.kt
@@ -13,12 +13,13 @@
  *  See the License for the specific language governing permissions and
  *  limitations under the License.
  */
-
 package com.adobe.testing.s3mock.s3.store
 
 import com.adobe.testing.s3mock.s3.dto.ObjectOwnership
 import com.adobe.testing.s3mock.s3.model.BucketMetadata
 import org.assertj.core.api.Assertions.assertThat
+import org.assertj.core.api.Assertions.assertThatThrownBy
+import org.junit.jupiter.api.Assumptions.assumeFalse
 import org.junit.jupiter.api.Test
 import org.junit.jupiter.api.io.TempDir
 import tools.jackson.databind.DeserializationFeature
@@ -127,6 +128,81 @@ internal class StoreConfigurationTest {
     assertThat(tempDir.listDirectoryEntries()).isEmpty()
   }
 
+  @Test
+  fun rootFolder_usesExistingWritableDirectory(
+    @TempDir tempDir: Path,
+  ) {
+    val existing = tempDir.resolve("existingRoot")
+    assertThat(existing.toFile().mkdir()).isTrue()
+
+    val properties = StoreProperties(false, existing.toAbsolutePath().toString(), setOf(), listOf(), "us-east-1")
+    val root = StoreConfiguration().rootFolder(properties)
+
+    assertThat(root).isEqualTo(existing.toFile())
+    assertThat(root.canWrite()).isTrue()
+  }
+
+  @Test
+  fun rootFolder_createsMissingDirectory(
+    @TempDir tempDir: Path,
+  ) {
+    val missing = tempDir.resolve("createdRoot")
+
+    val properties = StoreProperties(false, missing.toAbsolutePath().toString(), setOf(), listOf(), "us-east-1")
+    val root = StoreConfiguration().rootFolder(properties)
+
+    assertThat(root).isEqualTo(missing.toFile())
+    assertThat(root).exists()
+  }
+
+  @Test
+  fun rootFolder_createsNestedMissingDirectories(
+    @TempDir tempDir: Path,
+  ) {
+    val nested = tempDir.resolve("missing/nested/root")
+
+    val properties = StoreProperties(false, nested.toAbsolutePath().toString(), setOf(), listOf(), "us-east-1")
+    val root = StoreConfiguration().rootFolder(properties)
+
+    assertThat(root).isEqualTo(nested.toFile())
+    assertThat(root).isDirectory()
+  }
+
+  @Test
+  fun rootFolder_failsFastWhenRootIsARegularFile(
+    @TempDir tempDir: Path,
+  ) {
+    val existingFile = tempDir.resolve("notADirectory")
+    assertThat(existingFile.toFile().createNewFile()).isTrue()
+
+    val properties = StoreProperties(false, existingFile.toAbsolutePath().toString(), setOf(), listOf(), "us-east-1")
+
+    assertThatThrownBy { StoreConfiguration().rootFolder(properties) }
+      .isInstanceOf(IllegalStateException::class.java)
+      .hasMessageContaining("is not a directory")
+  }
+
+  @Test
+  fun rootFolder_failsFastWhenRootIsNotWritable(
+    @TempDir tempDir: Path,
+  ) {
+    val readOnly = tempDir.resolve("readOnlyRoot")
+    assertThat(readOnly.toFile().mkdir()).isTrue()
+    assertThat(readOnly.toFile().setWritable(false, false)).isTrue()
+    assumeFalse(readOnly.toFile().canWrite(), "Unable to make temp dir read-only (running as root?)")
+    try {
+      val properties = StoreProperties(false, readOnly.toAbsolutePath().toString(), setOf(), listOf(), "us-east-1")
+
+      assertThatThrownBy { StoreConfiguration().rootFolder(properties) }
+        .isInstanceOf(IllegalStateException::class.java)
+        .hasMessageContaining(readOnly.toFile().absolutePath)
+        .hasMessageContaining("not writable")
+        .hasMessageContaining("named Docker volume")
+    } finally {
+      readOnly.toFile().setWritable(true, false)
+    }
+  }
+
   companion object {
     private const val BUCKET_META_FILE = "bucketMetadata.json"
     private val OBJECT_MAPPER: ObjectMapper =
diff --git a/testsupport/AGENTS.md b/testsupport/AGENTS.md
index ea1a76513..db9dc2acc 100644
--- a/testsupport/AGENTS.md
+++ b/testsupport/AGENTS.md
@@ -55,7 +55,7 @@ val s3Mock = S3MockContainer("latest")
 // Access via s3Mock.httpEndpoint or s3Mock.httpsEndpoint
 ```
 
-Configuration methods: `withInitialBuckets()`, `withValidKmsKeys()`, `withRetainFilesOnExit()`, `withRoot()`, `withRegion()`, `withVectors()`, `withDebug()`, `withSpringProfiles()`.
+Configuration methods: `withInitialBuckets()`, `withValidKmsKeys()`, `withRetainFilesOnExit()`, `withRoot()`, `withRegion()`, `withVectors()`, `withDebug()`, `withSpringProfiles()`, `withNamedVolume()`, `withVolumeAsRoot()`.
 
 ## TestNG Listener
 
diff --git a/testsupport/testcontainers/AGENTS.md b/testsupport/testcontainers/AGENTS.md
index 4020ebbaf..ab9edb623 100644
--- a/testsupport/testcontainers/AGENTS.md
+++ b/testsupport/testcontainers/AGENTS.md
@@ -43,7 +43,9 @@ Both representations refer to the same underlying `StoreProperties` / `Controlle
 
 ## Footguns
 
-**`withVolumeAsRoot(root)`**: Docker must have read/write permission on the host path. Because the S3Mock image is built by Cloud Native Buildpacks and runs as the non-root `cnb` user, this method forces the container to run as `root` so it can write into the bind-mounted host directory regardless of the host directory's UID ownership (otherwise, on Linux, every write fails with HTTP 500). Verify Docker Desktop sharing settings before using this — if Docker cannot access the path at all, the container starts but writes are silently discarded.
+**`withNamedVolume(volumeName)`** (preferred for persistence): mounts a Docker *named volume* at `/s3mockroot` and points the store root there, staying **non-root**. The OCI image pre-creates `/s3mockroot` owned by the `cnb` user, and Docker initialises a fresh named volume with that directory's ownership, so the non-root process can write to it. Combine with `withRetainFilesOnExit(true)`. The caller owns the volume lifecycle (Docker auto-creates it; remove it in an `@AfterAll`).
+
+**`withVolumeAsRoot(root)`**: Docker must have read/write permission on the host path. Because the S3Mock image is built by Cloud Native Buildpacks and runs as the non-root `cnb` user, this method forces the container to run as `root` so it can write into the bind-mounted host directory regardless of the host directory's UID ownership (otherwise, on Linux, every write fails with HTTP 500). This is only needed for a **bind mount** (host directory), which keeps its host ownership; for a named volume prefer `withNamedVolume`. Verify Docker Desktop sharing settings before using this — if Docker cannot access the path at all, the container starts but writes are silently discarded.
 
 **`httpsEndpoint` requires trust-all-certificates**: `S3MockContainer` uses a self-signed SSL certificate. Any AWS SDK client connecting to `httpsEndpoint` must disable certificate validation (see usage example above). Forgetting this produces a `SSLHandshakeException` that looks like a connectivity issue.
 
diff --git a/testsupport/testcontainers/src/main/kotlin/com/adobe/testing/s3mock/testcontainers/S3MockContainer.kt b/testsupport/testcontainers/src/main/kotlin/com/adobe/testing/s3mock/testcontainers/S3MockContainer.kt
index f2f5590d9..21ee59e86 100644
--- a/testsupport/testcontainers/src/main/kotlin/com/adobe/testing/s3mock/testcontainers/S3MockContainer.kt
+++ b/testsupport/testcontainers/src/main/kotlin/com/adobe/testing/s3mock/testcontainers/S3MockContainer.kt
@@ -15,6 +15,9 @@
  */
 package com.adobe.testing.s3mock.testcontainers
 
+import com.github.dockerjava.api.model.Bind
+import com.github.dockerjava.api.model.HostConfig
+import com.github.dockerjava.api.model.Volume
 import org.testcontainers.containers.BindMode
 import org.testcontainers.containers.GenericContainer
 import org.testcontainers.containers.wait.strategy.Wait
@@ -89,6 +92,31 @@ class S3MockContainer(
 
   fun withInitialBuckets(initialBuckets: String): S3MockContainer = withEnv(PROP_INITIAL_BUCKETS, initialBuckets)
 
+  /**
+   * Mount a Docker *named volume* as the S3Mock store root ([STORE_ROOT_MOUNT_PATH]) so data
+   * persists across container restarts **without** running the container as root.
+   *
+   * The S3Mock OCI image pre-creates [STORE_ROOT_MOUNT_PATH] owned by the non-root `cnb` user it
+   * runs as. Docker initialises a fresh named volume with that directory's ownership, so the
+   * non-root process can write into the mounted volume — unlike a bind mount, which keeps its host
+   * ownership and therefore requires [withVolumeAsRoot]. Combine with [withRetainFilesOnExit] to
+   * keep the data after the container shuts down.
+   *
+   * Docker creates the named volume on demand if it does not exist yet. The caller owns its
+   * lifecycle (e.g. removing it afterwards).
+   *
+   * @param volumeName name of the Docker named volume to mount
+   */
+  fun withNamedVolume(volumeName: String): S3MockContainer {
+    withEnv(PROP_ROOT_DIRECTORY, STORE_ROOT_MOUNT_PATH)
+    return withCreateContainerCmdModifier { cmd ->
+      val hostConfig = cmd.hostConfig ?: HostConfig.newHostConfig()
+      val existing = hostConfig.binds ?: emptyArray()
+      hostConfig.withBinds(*existing, Bind(volumeName, Volume(STORE_ROOT_MOUNT_PATH)))
+      cmd.withHostConfig(hostConfig)
+    }
+  }
+
   /**
    * Mount a volume from the host system for the S3Mock to use as the "root".
    * Docker must be able to read / write into this directory (!)
@@ -99,12 +127,14 @@ class S3MockContainer(
    * and every write fails with an HTTP 500. Running as `root` sidesteps the host/container UID
    * mismatch and restores the writable behaviour of the previous root-based image.
    *
+   * For a Docker *named volume* prefer [withNamedVolume], which stays non-root.
+   *
    * @param root absolute path in host system
    */
   fun withVolumeAsRoot(root: String): S3MockContainer {
-    withEnv(PROP_ROOT_DIRECTORY, "/s3mockroot")
+    withEnv(PROP_ROOT_DIRECTORY, STORE_ROOT_MOUNT_PATH)
     withCreateContainerCmdModifier { it.withUser("0:0") }
-    return withFileSystemBind(root, "/s3mockroot", BindMode.READ_WRITE)
+    return withFileSystemBind(root, STORE_ROOT_MOUNT_PATH, BindMode.READ_WRITE)
   }
 
   /**
@@ -147,6 +177,12 @@ class S3MockContainer(
     private const val S3MOCK_DEFAULT_VECTORS_HTTPS_PORT = 9193
     private val DEFAULT_IMAGE_NAME: DockerImageName = DockerImageName.parse(IMAGE_NAME)
 
+    /**
+     * Store-root mount point pre-created (owned by the non-root `cnb` user) in the S3Mock OCI image.
+     * Used by [withNamedVolume] and [withVolumeAsRoot] as the in-container store-root path.
+     */
+    private const val STORE_ROOT_MOUNT_PATH = "/s3mockroot"
+
     private const val PROP_SPRING_PROFILES_ACTIVE = "SPRING_PROFILES_ACTIVE"
     private const val PROFILE_VECTORS = "vectors"
     private const val PROFILE_DEBUG = "debug"
diff --git a/testsupport/testcontainers/src/test/kotlin/com/adobe/testing/s3mock/testcontainers/S3MockContainerRestartOnNamedVolumeTest.kt b/testsupport/testcontainers/src/test/kotlin/com/adobe/testing/s3mock/testcontainers/S3MockContainerRestartOnNamedVolumeTest.kt
new file mode 100644
index 000000000..8b54218c3
--- /dev/null
+++ b/testsupport/testcontainers/src/test/kotlin/com/adobe/testing/s3mock/testcontainers/S3MockContainerRestartOnNamedVolumeTest.kt
@@ -0,0 +1,100 @@
+/*
+ *  Copyright 2017-2026 Adobe.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *          http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ */
+package com.adobe.testing.s3mock.testcontainers
+
+import org.assertj.core.api.Assertions.assertThat
+import org.junit.jupiter.api.AfterAll
+import org.junit.jupiter.api.Test
+import org.testcontainers.DockerClientFactory
+import software.amazon.awssdk.auth.credentials.AwsBasicCredentials
+import software.amazon.awssdk.auth.credentials.StaticCredentialsProvider
+import software.amazon.awssdk.core.sync.RequestBody
+import software.amazon.awssdk.regions.Region
+import software.amazon.awssdk.services.s3.S3Client
+import software.amazon.awssdk.services.s3.S3Configuration
+import java.net.URI
+import java.util.UUID
+
+/**
+ * Verifies that data written by a non-root S3Mock container survives a full container restart when
+ * the store root is backed by a Docker named volume mounted at `/s3mockroot`.
+ *
+ * This is the regression test for https://github.com/adobe/S3Mock/issues/3139: after the migration
+ * to the Cloud Native Buildpacks image (which runs as the non-root `cnb` user), a named volume was
+ * no longer writable. The OCI image now pre-creates a `cnb`-owned `/s3mockroot`, so Docker gives a
+ * named volume mounted there the same ownership and the non-root process can persist to it — without
+ * running the container as root (contrast [S3MockContainerRestartOnRootfolderTest], which uses a
+ * bind mount and must run as root).
+ */
+internal class S3MockContainerRestartOnNamedVolumeTest {
+  @Test
+  fun objectSurvivesContainerRestartOnNamedVolume() {
+    val bucketName = "named-volume-bucket"
+    val key = "persisted.txt"
+    val content = "persisted across a container restart"
+
+    // First container: write an object to the named-volume-backed store root as the non-root user.
+    newContainer().use { container ->
+      val s3Client = createS3ClientV2(container.httpEndpoint)
+      s3Client.createBucket { it.bucket(bucketName) }
+      s3Client.putObject(
+        { it.bucket(bucketName).key(key) },
+        RequestBody.fromString(content),
+      )
+    }
+
+    // Second container: mount the same named volume and assert the object is still there.
+    newContainer().use { container ->
+      val s3Client = createS3ClientV2(container.httpEndpoint)
+      val response = s3Client.getObjectAsBytes { it.bucket(bucketName).key(key) }
+      assertThat(response.asUtf8String()).isEqualTo(content)
+    }
+  }
+
+  private fun newContainer(): S3MockContainer =
+    S3MockContainer(S3MOCK_VERSION)
+      .withRetainFilesOnExit(true)
+      .withNamedVolume(VOLUME_NAME)
+      .apply { start() }
+
+  private fun createS3ClientV2(endpoint: String): S3Client =
+    S3Client
+      .builder()
+      .region(Region.of("us-east-1"))
+      .credentialsProvider(
+        StaticCredentialsProvider.create(AwsBasicCredentials.create("foo", "bar")),
+      ).serviceConfiguration(S3Configuration.builder().pathStyleAccessEnabled(true).build())
+      .endpointOverride(URI.create(endpoint))
+      .build()
+
+  companion object {
+    // we set the system property when running in maven, use "latest" for unit tests in the IDE
+    private val S3MOCK_VERSION: String = System.getProperty("s3mock.version", "latest")
+    private val VOLUME_NAME: String = "s3mock-named-volume-test-${UUID.randomUUID()}"
+
+    @JvmStatic
+    @AfterAll
+    fun removeNamedVolume() {
+      runCatching {
+        DockerClientFactory
+          .instance()
+          .client()
+          .removeVolumeCmd(VOLUME_NAME)
+          .exec()
+      }
+    }
+  }
+}