diff --git a/apps/nas-samba/docker-compose.json b/apps/nas-samba/docker-compose.json
index e88d65a..079792b 100644
--- a/apps/nas-samba/docker-compose.json
+++ b/apps/nas-samba/docker-compose.json
@@ -14,7 +14,8 @@
       ],
       "volumes": [
         { "hostPath": "${NAS_PATH:-/nas}", "containerPath": "/nas" },
-        { "hostPath": "${APP_DATA_DIR}/data/config", "containerPath": "/config" }
+        { "hostPath": "${APP_DATA_DIR}/data/config", "containerPath": "/config" },
+        { "hostPath": "${APP_DATA_DIR}/data/samba", "containerPath": "/var/lib/samba" }
       ],
       "environment": [
         { "key": "SMB_PASSWORD", "value": "${SMB_PASSWORD}" },
diff --git a/apps/nas-samba/source/app/server.js b/apps/nas-samba/source/app/server.js
index cc53696..88e6fd4 100644
--- a/apps/nas-samba/source/app/server.js
+++ b/apps/nas-samba/source/app/server.js
@@ -1675,12 +1675,24 @@ function main() {
     // Seed admin
     seedAdmin();
 
-    // Ensure existing users have home directories (migration support)
+    // Re-create Linux users and ensure Samba accounts on every startup
     const existingUsers = sqlDb.prepare('SELECT username FROM users').all();
     for (const u of existingUsers) {
       const homeDir = path.join(HOME_BASE, u.username);
-      if (!fs.existsSync(homeDir)) {
-        fs.mkdirSync(homeDir, { recursive: true });
+      fs.mkdirSync(homeDir, { recursive: true });
+      try {
+        execSync(`id -u "${u.username}" >/dev/null 2>&1 || useradd -M -s /usr/sbin/nologin "${u.username}"`);
+        execSync(`chown "${u.username}":nogroup "${homeDir}"`);
+        // Set Samba password only if user not already in TDB (first run or migration)
+        try {
+          execSync(`pdbedit -u "${u.username}" >/dev/null 2>&1`);
+        } catch (_e) {
+          const escaped = ADMIN_PASSWORD.replace(/'/g, "'\\''");
+          execSync(`printf '%s\\n%s\\n' '${escaped}' '${escaped}' | smbpasswd -a -s "${u.username}"`);
+          console.log(`Samba account created for ${u.username} (using SMB_PASSWORD)`);
+        }
+      } catch (err) {
+        console.error(`Failed to ensure system user ${u.username}:`, err.message);
       }
     }