diff --git a/apps/copyparty/README.md b/apps/copyparty/README.md
index c0d822a..76cc969 100644
--- a/apps/copyparty/README.md
+++ b/apps/copyparty/README.md
@@ -10,7 +10,10 @@ policy for a latest chart that trails its application. Remove it when the chart
 catches up; keep its official image repository unchanged.
 
 Anonymous users receive only `r` (read/list/download) permission. No account
-has upload, move, delete or admin permission. The non-root container also mounts
+has upload, move, delete or admin permission. The supported HTML-head hook
+hides upload controls and the upload-shaped local-file hash search panel;
+normal filename/path search remains available. This CSS is presentation only;
+permissions and the filesystem mount enforce read-only access. The non-root container also mounts
 `/komposthaufen` recursively read-only. Symlinks cannot escape the exported
 volume. HTML is served as text and embedded directory prologues are disabled.
 The Traefik-owned route keeps its name but moves from `default` to `copyparty`
diff --git a/apps/copyparty/values.yaml b/apps/copyparty/values.yaml
index 800c063..3e5e7a0 100644
--- a/apps/copyparty/values.yaml
+++ b/apps/copyparty/values.yaml
@@ -37,11 +37,12 @@ app:
   env:
   - name: XDG_CONFIG_HOME
     value: /state
-  args: []
+  args: ["-c", "/cfg/config.conf"]
 configMap:
   data:
     config.conf: |
       [global]
+        name: Komposthaufen
         p: 3923
         http-only
         rp-loc: /komposthaufen
@@ -59,10 +60,20 @@ configMap:
         no-logues
         no-readme
         no-html
+        no-ups-page
+        no-up-list
+        html-head: @/cfg/readonly-ui.html
       [/]
         /komposthaufen
         accs:
           r: *
+    readonly-ui.html: |
+      <style>
+      #ops a[data-dest="up2k"], #ops a[data-dest="bup"],
+      #ops a[data-dest="mkdir"], #ops a[data-dest="new_md"],
+      #ops a[data-dest="unpost"], #op_up2k, #op_bup, #op_mkdir,
+      #op_new_md, #op_unpost { display: none !important; }
+      </style>
 volumeConfig:
   appData:
     volumeMount: