diff --git a/deploy/rezervator.sh b/deploy/rezervator.sh
index 330e804..b345cef 100755
--- a/deploy/rezervator.sh
+++ b/deploy/rezervator.sh
@@ -210,6 +210,10 @@ server {
 NGINX
 }
 
+# Containers are always removed with --volumes: the image declares /app/config as a volume
+# and only a file is mounted into it, so every container gets an anonymous volume that would
+# otherwise stay behind. The named data volume of the customer is not affected by --volumes.
+
 # Starts the container of a customer. $1 = name, $2 = image, $3 = initial admin password (optional)
 run_container() {
     local name="$1" image="$2" admin_password="${3:-}"
@@ -582,7 +586,7 @@ cmd_restore() {
     image="$(docker inspect --format '{{.Image}}' "$container" 2>/dev/null || echo "$IMAGE")"
 
     info "Stopping $container"
-    docker rm --force "$container" >/dev/null 2>&1 || true
+    docker rm --force --volumes "$container" >/dev/null 2>&1 || true
     info "Restoring '$name' from backup $timestamp"
     restore_customer "$name" "$timestamp"
     run_container "$name" "$image"
@@ -616,7 +620,7 @@ cmd_upgrade() {
 
         info "Upgrading '$name'"
         timestamp="$(backup_customer "$name")"
-        docker rm --force "$container" >/dev/null 2>&1 || true
+        docker rm --force --volumes "$container" >/dev/null 2>&1 || true
         run_container "$name" "$IMAGE"
 
         if wait_healthy "$container"; then
@@ -626,7 +630,7 @@ cmd_upgrade() {
 
         echo "Upgrade of '$name' failed, last log lines of the new container:" >&2
         docker logs --tail 20 "$container" >&2 || true
-        docker rm --force "$container" >/dev/null 2>&1 || true
+        docker rm --force --volumes "$container" >/dev/null 2>&1 || true
 
         if [ -z "$old_image" ]; then
             die "'$name' had no container before, nothing to roll back to. Backup: $timestamp"
@@ -651,7 +655,7 @@ cmd_remove() {
     require_customer "$name"
 
     info "Removing container $(container_name "$name")"
-    docker rm --force "$(container_name "$name")" >/dev/null 2>&1 || true
+    docker rm --force --volumes "$(container_name "$name")" >/dev/null 2>&1 || true
 
     if [ "$purge" != "--purge" ]; then
         info "Database, data volume and config of '$name' were kept. Start it again with 'upgrade $name'."