diff --git a/paths.py b/paths.py
index af629a5..aeb195d 100644
--- a/paths.py
+++ b/paths.py
@@ -12,8 +12,16 @@ keep doing so; these are only the defaults.
 import os
 
 REPO_DIR = os.path.dirname(os.path.abspath(__file__))
-DATA_DIR = os.path.join(REPO_DIR, "data")
-LOGS_DIR = os.path.join(REPO_DIR, "logs")
+# Runtime state dirs default under the repo root, but MUST be overridable: after
+# the repo split the code lives at the image root (/app), so the Python package
+# `data/` and the runtime data dir `<root>/data` collide at the same path. When
+# a persistent volume is mounted at that path (as the deploy compose does for
+# the parquet cache / notifier.lock / geonames) it shadows and erases the
+# `data/*.py` modules, so `import data.climate` fails at boot. Point
+# THERMOGRAPH_DATA_DIR (and _LOGS_DIR) at a path OUTSIDE the code tree in the
+# container to keep the volume clear of the package.
+DATA_DIR = os.environ.get("THERMOGRAPH_DATA_DIR") or os.path.join(REPO_DIR, "data")
+LOGS_DIR = os.environ.get("THERMOGRAPH_LOGS_DIR") or os.path.join(REPO_DIR, "logs")
 
 # Bundled reference data shipped alongside the code (generated by gen_cities /
 # gen_flavor), not runtime state — hence at the repo root, not data/.