diff --git a/app.py b/app.py
index 73a8544..8c18d23 100644
--- a/app.py
+++ b/app.py
@@ -8,11 +8,12 @@ from fastapi.responses import JSONResponse
 from contextlib import asynccontextmanager
 
 log = logging.getLogger("butler")
+VAULT_REFRESH_MINUTES = int(os.environ.get("VAULT_REFRESH_MINUTES", "30"))
 
 API_DIR = os.environ.get("API_KEY_DIR", "/data/api")
 BUTLER_TOKEN = os.environ.get("BUTLER_TOKEN", "")
 BW_PASSWORD = os.environ.get("BW_PASSWORD", "")
-VAULT_REFRESH_MINUTES = int(os.environ.get("VAULT_REFRESH_MINUTES", "30"))
+VAULT_CACHE_DIR = os.environ.get("VAULT_CACHE_DIR", "/data/vault-cache")
 
 # --- Vault sync ---
 
@@ -59,10 +60,10 @@ def _sync_vault():
                 new_cache[name] = notes.strip()
         _vault_cache = new_cache
         # Write to disk as cache (fallback if vault unreachable later)
-        os.makedirs(f"{API_DIR}/.vault-cache", exist_ok=True)
+        os.makedirs(VAULT_CACHE_DIR, exist_ok=True)
         for name, value in new_cache.items():
             safe = name.lower().replace(" ", "-")
-            with open(f"{API_DIR}/.vault-cache/{safe}", "w") as f:
+            with open(f"{VAULT_CACHE_DIR}/{safe}", "w") as f:
                 f.write(value)
         log.info(f"Vault sync: {len(new_cache)} items cached")
         return True
@@ -73,7 +74,7 @@ def _sync_vault():
 def _load_disk_cache():
     """Load cached vault items from disk (fallback)."""
     global _vault_cache
-    cache_dir = f"{API_DIR}/.vault-cache"
+    cache_dir = VAULT_CACHE_DIR
     if not os.path.isdir(cache_dir):
         return
     for f in os.listdir(cache_dir):
diff --git a/compose.yaml b/compose.yaml
index d35135c..5c0c3af 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -7,9 +7,10 @@ services:
       - "8888:8888"
     volumes:
       - /app-config/kiro/api:/data/api:ro
-      - vault-cache:/data/api/.vault-cache
+      - vault-cache:/data/vault-cache
     environment:
       - API_KEY_DIR=/data/api
+      - VAULT_CACHE_DIR=/data/vault-cache
       - BUTLER_TOKEN=${BUTLER_TOKEN}
       - BW_PASSWORD=${BW_PASSWORD}
       - VAULT_REFRESH_MINUTES=30