diff --git a/mcp-stack.compose.yml b/mcp-stack.compose.yml
index 7624c08..4dfcd57 100644
--- a/mcp-stack.compose.yml
+++ b/mcp-stack.compose.yml
@@ -132,6 +132,16 @@ services:
         source: ./egress-proxy.squid.conf
         target: /etc/squid/squid.conf
         read_only: true
+    # This is the one service without read_only: true, because squid needs somewhere to write
+    # access.log and cache.log - and unlike Docker's own logging driver above, squid never rotates
+    # those on its own. Bounded here at the container level, the same as /tmp elsewhere in this
+    # file: capped and lost on restart beats unbounded and kept.
+    #
+    # uid/gid=13 is squid's own "proxy" user inside this image, which it drops to before it ever
+    # opens these files. Compose's long tmpfs syntax has no uid/gid field, so this needs the raw
+    # mount-options string the top-level tmpfs: list passes straight through to Docker.
+    tmpfs:
+      - /var/log/squid:rw,size=64m,uid=13,gid=13
     cap_drop: [ALL]
     cap_add: [SETUID, SETGID]
     security_opt: [no-new-privileges:true]