diff --git a/389-ds-container.changes b/389-ds-container.changes
index 31b8151..01f7a2d 100644
--- a/389-ds-container.changes
+++ b/389-ds-container.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Thu Mar 30 15:12:51 UTC 2023 - Dirk Mueller <dmueller@suse.com>
+
+- put VOLUME statements last
+
 -------------------------------------------------------------------
 Fri Mar  3 07:24:36 UTC 2023 - Dan Čermák <dcermak@suse.com>
 
diff --git a/Dockerfile b/Dockerfile
index e1b9e9a..b75d183 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -24,7 +24,6 @@ LABEL com.suse.release-stage="released"
 
 RUN set -euo pipefail; zypper -n in --no-recommends 389-ds timezone openssl nss_synth; zypper -n clean; rm -rf /var/log/*
 CMD ["/usr/lib/dirsrv/dscontainer", "-r"]
-VOLUME /data
 EXPOSE 3389 3636
 
 COPY nsswitch.conf /etc/nsswitch.conf
@@ -39,3 +38,5 @@ RUN set -euo pipefail; mkdir -p /data/config; \
 
 HEALTHCHECK --start-period=5m --timeout=5s --interval=5s --retries=2 \
     CMD /usr/lib/dirsrv/dscontainer -H
+
+VOLUME /data