diff --git a/README.md b/README.md
index 9f64550..b5cf773 100755
--- a/README.md
+++ b/README.md
@@ -169,6 +169,9 @@ diff-suppressed. Dex configuration is stored by the official chart in a Kubernet
 **Secret**, never in the theme ConfigMap. Helm stores release values, including
 inline credentials, in its release Secrets: protect these with RBAC, encryption
 at rest and encrypted backups. This role does not generate or rotate passwords.
+The root filesystem stays read-only; a 16 MiB memory-backed `emptyDir` mounted
+at `/tmp` provides Dex's required temporary config-file writes without making
+the container filesystem writable.
 
 Client `secretEnv` can refer to a key in `dex_env_secret_name`. LDAP connectors
 support `$ENV_NAME` references, such as `bindPW: $DEX_LDAP_BIND_PASSWORD`. The
diff --git a/templates/values.yml.j2 b/templates/values.yml.j2
index c08cba5..f64cd62 100755
--- a/templates/values.yml.j2
+++ b/templates/values.yml.j2
@@ -83,7 +83,11 @@ config:
 {% for connector in dex_additional_connectors %}
     - {{ connector | to_json }}
 {% endfor %}
-volumes:{% if not dex_theme_enabled and not dex_ca_secret_name and not dex_extra_volumes %} []{% endif %}
+volumes:
+  - name: dex-tmp
+    emptyDir:
+      medium: Memory
+      sizeLimit: 16Mi
 
 {% if dex_theme_enabled %}
   - name: theme
@@ -98,7 +102,9 @@ volumes:{% if not dex_theme_enabled and not dex_ca_secret_name and not dex_extra
 {% for volume in dex_extra_volumes %}
   - {{ volume | to_json }}
 {% endfor %}
-volumeMounts:{% if not dex_theme_enabled and not dex_ca_secret_name and not dex_extra_volume_mounts %} []{% endif %}
+volumeMounts:
+  - name: dex-tmp
+    mountPath: /tmp
 
 {% if dex_theme_enabled %}
   - name: theme