diff --git a/docker-compose.ci.yml b/docker-compose.ci.yml
index 108d3a7..b06d8ba 100644
--- a/docker-compose.ci.yml
+++ b/docker-compose.ci.yml
@@ -4,8 +4,7 @@ services:
       args:
         - USE_SJTUG=false
     volumes:
-      - "./lug/config.local.yaml:/config.local.yaml:ro"
-    command: -c /config.local.yaml
+      - "./lug/config.local.yaml:/config/0-base.yaml:ro"
   caddy:
     build:
       args:
diff --git a/docker-compose.siyuan.yml b/docker-compose.siyuan.yml
index df4e1d1..a75131f 100644
--- a/docker-compose.siyuan.yml
+++ b/docker-compose.siyuan.yml
@@ -12,7 +12,8 @@ services:
     container_name: siyuan-lug
     volumes:
       - "/mnt/data32T:/srv/data32T"
-      - "./config.siyuan.yaml:/config.yaml:ro"
+      - "./config.siyuan.yaml:/config/0-base.yaml:ro"
+      - "./secrets/secrets.siyuan.yaml:/config/99-secrets.yaml:ro"
     environment:
       MIRROR_CLONE_SITE: "mirror.sjtu.edu.cn"
     mem_limit: 30G
diff --git a/docker-compose.zhiyuan.yml b/docker-compose.zhiyuan.yml
index 969eb32..ceca4b1 100644
--- a/docker-compose.zhiyuan.yml
+++ b/docker-compose.zhiyuan.yml
@@ -11,7 +11,8 @@ services:
     container_name: zhiyuan-lug
     volumes:
       - "/mnt/data12T:/mnt"
-      - "./config.zhiyuan.yaml:/config.yaml:ro"
+      - "./config.zhiyuan.yaml:/config/0-base.yaml:ro"
+      - "./secrets/secrets.zhiyuan.yaml:/config/99-secrets.yaml:ro"
     environment:
       MIRROR_CLONE_SITE: "mirrors.sjtug.sjtu.edu.cn"
     mem_limit: 10G
diff --git a/lug/Dockerfile b/lug/Dockerfile
index ef5f72a..4c12155 100644
--- a/lug/Dockerfile
+++ b/lug/Dockerfile
@@ -95,4 +95,6 @@ RUN mkdir rsync_sjtug && cd rsync_sjtug && /app/build-script/from-cache.sh \
     tmp.tar.gz \
         && tar -xvf tmp.tar.gz && rm tmp.tar.gz
 
-ENTRYPOINT ["./lug"]
+COPY entrypoint.sh ./entrypoint.sh
+
+ENTRYPOINT ["./entrypoint.sh"]
diff --git a/lug/entrypoint.sh b/lug/entrypoint.sh
new file mode 100644
index 0000000..14f7d93
--- /dev/null
+++ b/lug/entrypoint.sh
@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+
+yq ea '. as $item ireduce ({}; . * $item )' /config/*.yaml | sed 's/!!merge //g' > config.merged.yaml
+
+./lug -c config.merged.yaml