diff --git a/roles/zomboid/tasks/main.yml b/roles/zomboid/tasks/main.yml
index 811c107..61bca4e 100644
--- a/roles/zomboid/tasks/main.yml
+++ b/roles/zomboid/tasks/main.yml
@@ -1,6 +1,7 @@
 ---
 # Project Zomboid dedicated server (danixu86 container, SteamCMD-based, B42-ready).
-# Players: zomboid.boxswapper.io:16261 (UDP) - direct connect or in-game browser (PUBLIC=true).
+# PRIVATE server: players direct-connect to zomboid.boxswapper.io:16261 (UDP) and enter the join
+# password (zomboid_password). Not listed in the in-game server browser (PUBLIC=false).
 # External prerequisites (NOT managed by this repo):
 #   - Cloudflare A record zomboid.boxswapper.io -> public IP (grey-cloud, like mc.boxswapper.io)
 #   - Router port forwards: UDP 16261-16276 + TCP 27015 (RCON) -> 10.10.0.46
@@ -11,6 +12,32 @@
     state: directory
     mode: '0755'
 
+# The image (cm2network/steamcmd:root base) owns files in /home/steam as the steam user, uid/gid 1000.
+# Pre-seeding dirs with that ownership lets the entry script and server write alongside our ini.
+- name: Create Project Zomboid server data dir
+  ansible.builtin.file:
+    path: /opt/apps/zomboid/data/Zomboid
+    state: directory
+    owner: '1000'
+    group: '1000'
+    mode: '0755'
+
+- name: Create Project Zomboid server config directory
+  ansible.builtin.file:
+    path: /opt/apps/zomboid/data/Zomboid/Server
+    state: directory
+    owner: '1000'
+    group: '1000'
+    mode: '0755'
+
+- name: Template Project Zomboid server ini from vars.yml
+  ansible.builtin.template:
+    src: zomboid.ini.j2
+    dest: "/opt/apps/zomboid/data/Zomboid/Server/{{ zomboid_servername }}.ini"
+    owner: '1000'
+    group: '1000'
+    mode: '0644'
+
 - name: Deploy Project Zomboid Server
   containers.podman.podman_container:
     image: "{{ zomboid_image }}"
@@ -38,6 +65,7 @@
       RCONPASSWORD: "{{ zomboid_rcon_password }}"
       SERVERNAME: "{{ zomboid_servername }}"
       DISPLAYNAME: "{{ zomboid_displayname }}"
+      PASSWORD: "{{ zomboid_password }}"
       PUBLIC: "{{ zomboid_public }}"
       MEMORY: "{{ zomboid_memory }}"
       SERVERPRESET: "{{ zomboid_preset }}"
diff --git a/roles/zomboid/templates/zomboid.ini.j2 b/roles/zomboid/templates/zomboid.ini.j2
new file mode 100644
index 0000000..4062e96
--- /dev/null
+++ b/roles/zomboid/templates/zomboid.ini.j2
@@ -0,0 +1,12 @@
+# Managed by Ansible (roles/zomboid/templates/zomboid.ini.j2) — local edits are overwritten on re-run.
+# Source of truth: zomboid_* variables in vars.yml.
+DefaultPort=16261
+UDPPort=16262
+Public={{ zomboid_public | lower }}
+PublicName={{ zomboid_displayname }}
+Password={{ zomboid_password }}
+MaxPlayers={{ zomboid_max_players }}
+PVP={{ zomboid_pvp | lower }}
+PauseEmpty={{ zomboid_pause_empty | lower }}
+RCONPassword={{ zomboid_rcon_password }}
+RCONPort=27015
\ No newline at end of file
diff --git a/vars.yml b/vars.yml
index e9b3e80..c1d1150 100755
--- a/vars.yml
+++ b/vars.yml
@@ -89,23 +89,33 @@ minecraft_plugins:
   - https://download.geysermc.org/v2/projects/floodgate/versions/latest/builds/latest/downloads/spigot
 
 ## Project Zomboid dedicated server (danixu86 container, SteamCMD-based, B42-ready)
-## Players connect to zomboid.boxswapper.io:16261 (UDP) — direct connect or in-game browser (zomboid_public: true).
+## PRIVATE server: not shown in the in-game server browser (zomboid_public: false) — friends must
+## direct-connect to zomboid.boxswapper.io:16261 and enter the join password (zomboid_password) once.
 ## External DNS (not managed here): Cloudflare A record zomboid.boxswapper.io -> public IP (grey-cloud,
 ## same as mc.boxswapper.io / vpn.boxswapper.io). Router MUST forward UDP 16261-16276 + TCP 27015 (RCON)
-## -> 10.10.0.46. Port range covers MaxPlayers=16 (game 16261 + query 16262 + per-slot ports); widen it
-## if you raise MaxPlayers in <zomboid_servername>.ini.
+## -> 10.10.0.46. Server ini is rendered from roles/zomboid/templates/zomboid.ini.j2 on deploy; the
+## published UDP range (16261-16276) covers zomboid_max_players=16 (game 16261 + query 16262 + per-slot ports).
 zomboid_host: zomboid.boxswapper.io
 zomboid_ip: 10.10.0.46
 zomboid_image: docker.io/danixu86/project-zomboid-dedicated-server:latest
 ## SERVERNAME becomes the config folder/file name — must NOT contain spaces or special characters.
 zomboid_servername: zomboid
-zomboid_displayname: "Welcome to our future,...retards"
+zomboid_displayname: "Boxswapper Zomboid Server"
 zomboid_admin_username: admin
-## CHANGE THESE before first deploy — ADMINPASSWORD is mandatory on first startup (server fails to boot without it)
-## and RCONPASSWORD gates the 27015/tcp admin console.
-zomboid_admin_password: bhb8zGdpqHvgEUTM
-zomboid_rcon_password: fs5vCfJq3ZMl3V01
-zomboid_public: "true"
+## CHANGE THESE before first deploy — ADMINPASSWORD is mandatory on first startup (server fails to boot without it),
+## RCONPASSWORD gates the 27015/tcp admin console, and zomboid_password is the join password players must enter
+## when connecting (leave empty to allow password-less joins).
+zomboid_admin_password: 9QmvIhCPOUcWeV9W
+zomboid_rcon_password: lnaScHaCnB2z8k7D
+zomboid_password: DOvNml9VCyeXlJx2
+zomboid_public: "false"
+## Server ini is rendered from roles/zomboid/templates/zomboid.ini.j2 on every deploy —
+## vars.yml is the source of truth for the ini, so edits to these vars re-apply on re-run.
+## MaxPlayers must fit the published/forwarded UDP range (16261-16276 = 16 slots); raise the range
+## in the role and router forwards if you bump it.
+zomboid_max_players: 16
+zomboid_pvp: "true"
+zomboid_pause_empty: "true"
 zomboid_memory: 8g
 zomboid_preset: apocalypse