diff --git a/composer.json b/composer.json
index 6b506b0..d6253b6 100644
--- a/composer.json
+++ b/composer.json
@@ -1,7 +1,7 @@
 {
     "name": "dashboard/ticketing",
     "description": "Help desk ticketing snap-in for the Dashboard platform",
-    "version": "1.0.1",
+    "version": "1.0.2",
     "type": "library",
     "require": {
         "php": "^8.2",
diff --git a/config/ticketing.php b/config/ticketing.php
new file mode 100644
index 0000000..1e01733
--- /dev/null
+++ b/config/ticketing.php
@@ -0,0 +1,15 @@
+<?php
+
+return [
+
+    /*
+     * The filesystem disk ticket attachments are stored on. Read at runtime via
+     * config('ticketing.storage_disk') — NOT env() — so it survives config:cache
+     * in production. Before this file existed the controllers read
+     * env('TICKETING_STORAGE_DISK') directly, which returns null once the config
+     * is cached, silently forcing every attachment onto the 'local' disk and
+     * orphaning anything an operator had pointed elsewhere (secrets spec S3).
+     */
+    'storage_disk' => env('TICKETING_STORAGE_DISK', 'local'),
+
+];
diff --git a/src/Http/Controllers/TicketAttachmentController.php b/src/Http/Controllers/TicketAttachmentController.php
index 2a6fc82..929d408 100644
--- a/src/Http/Controllers/TicketAttachmentController.php
+++ b/src/Http/Controllers/TicketAttachmentController.php
@@ -49,7 +49,7 @@ class TicketAttachmentController extends Controller
         ]);
 
         $file = $request->file('file');
-        $disk = config('ticketing.storage_disk', env('TICKETING_STORAGE_DISK', 'local'));
+        $disk = config('ticketing.storage_disk', 'local');
         $path = $file->store('ticketing/attachments/' . $ticket->id, $disk);
 
         TicketAttachment::create([
@@ -71,7 +71,7 @@ class TicketAttachmentController extends Controller
             abort(403);
         }
 
-        $disk = config('ticketing.storage_disk', env('TICKETING_STORAGE_DISK', 'local'));
+        $disk = config('ticketing.storage_disk', 'local');
         return Storage::disk($disk)->download($attachment->path, $attachment->filename);
     }
 }
diff --git a/src/Http/Controllers/TicketController.php b/src/Http/Controllers/TicketController.php
index b50ba95..58518be 100644
--- a/src/Http/Controllers/TicketController.php
+++ b/src/Http/Controllers/TicketController.php
@@ -322,7 +322,7 @@ class TicketController extends Controller
         ]);
 
         if ($request->hasFile('attachments')) {
-            $disk = config('ticketing.storage_disk', env('TICKETING_STORAGE_DISK', 'local'));
+            $disk = config('ticketing.storage_disk', 'local');
             foreach ($request->file('attachments') as $file) {
                 if (!$file->isValid()) continue;
                 $path = $file->store('ticketing/attachments/' . $ticket->id, $disk);
diff --git a/src/TicketingServiceProvider.php b/src/TicketingServiceProvider.php
index 97d68a8..b3d8987 100644
--- a/src/TicketingServiceProvider.php
+++ b/src/TicketingServiceProvider.php
@@ -6,7 +6,13 @@ use Illuminate\Support\ServiceProvider;
 
 class TicketingServiceProvider extends ServiceProvider
 {
-    public function register(): void {}
+    public function register(): void
+    {
+        // Merge so config('ticketing.*') resolves even when the host app has not
+        // published a copy — and, crucially, so the value is captured by
+        // config:cache instead of being read from env() at runtime (S3).
+        $this->mergeConfigFrom(__DIR__.'/../config/ticketing.php', 'ticketing');
+    }
 
     public function boot(): void
     {