diff --git a/roles/docker/defaults/main.yml b/roles/docker/defaults/main.yml
index f0e8088..457b302 100644
--- a/roles/docker/defaults/main.yml
+++ b/roles/docker/defaults/main.yml
@@ -201,7 +201,7 @@ services:
     domain: "write.{{ base_domain }}"
     volume_folder: "{{ volume_root_folder }}/writefreely"
     pre_deploy_tasks: true
-    version: latest
+    version: v0.15.0
     mariadb_version: "11.2"
     allowed_sender_domain: true
 
diff --git a/roles/docker/tasks/pre_deploy/writefreely.yml b/roles/docker/tasks/pre_deploy/writefreely.yml
index c72bfbc..a1f558b 100644
--- a/roles/docker/tasks/pre_deploy/writefreely.yml
+++ b/roles/docker/tasks/pre_deploy/writefreely.yml
@@ -3,6 +3,15 @@
 - name: Create subfolder for MariaDB data
   file:
     name: "{{ services.writefreely.volume_folder }}/db"
+    owner: "999"
+    group: "999"
+    state: directory
+
+- name: Create subfolder for encryption keys
+  file:
+    name: "{{ services.writefreely.volume_folder }}/keys"
+    owner: "2"
+    group: "2"
     state: directory
 
 - name: Upload config.ini
diff --git a/roles/docker/templates/compose-files/writefreely.yml.j2 b/roles/docker/templates/compose-files/writefreely.yml.j2
index 1801b70..204740e 100644
--- a/roles/docker/templates/compose-files/writefreely.yml.j2
+++ b/roles/docker/templates/compose-files/writefreely.yml.j2
@@ -3,21 +3,22 @@ version: "3.8"
 
 services:
   db:
-    image: "mariadb:{{ services.writefreely.mariadb_version }}"
+    image: mariadb:{{ services.writefreely.mariadb_version }}
     restart: unless-stopped
     volumes:
       - "./db:/var/lib/mysql"
     environment:
-      - MYSQL_DATABASE=writefreely
-      - MYSQL_ROOT_PASSWORD={{ writefreely_secrets.db_password }}
+      MYSQL_DATABASE: writefreely
+      MYSQL_ROOT_PASSWORD: {{ writefreely_secrets.db_password }}
 
   app:
-    image: "writeas/writefreely:{{ services.writefreely.version }}"
+    image: ghcr.io/writefreely/writefreely:{{ services.writefreely.version }}
     restart: unless-stopped
     networks:
       - default
       - external_services
     volumes:
+      - "./keys:/go/keys"
       - "./config.ini:/go/config.ini"
     environment:
       VIRTUAL_HOST: "{{ services.writefreely.domain }}"