diff --git a/logging/README.md b/logging/README.md
index 4423709..68e9c0f 100644
--- a/logging/README.md
+++ b/logging/README.md
@@ -31,7 +31,16 @@ and 601.
 ## Host files
 
 The Git-backed compose file intentionally bind-mounts stable host paths.
-Before deployment, the repository files must be copied to:
+Before deployment, stage and verify every tracked runtime file with:
+
+```bash
+sudo logging/stage-host-files.sh
+sudo logging/stage-host-files.sh --check
+```
+
+The script copies only non-secret configuration and dashboard files. Portainer
+still supplies `GRAFANA_ADMIN_PASSWORD` and `ZABBIX_API_TOKEN` out of band.
+The resulting layout is:
 
 ```text
 /mnt/containers/logging/
@@ -128,9 +137,9 @@ Agent 2 `Hostname`; Grafana selects the **Visible name** shown below.
 
 Import `zabbix-template-telemt-active.yaml`, link **Telemt proxy by active
 agent** to all four hosts, and ensure each host is in the `Linux servers`
-group. All four send active checks to `185.108.4.158`. Client 02 should have no
-DEPOT passive-agent interface; its existing local Zabbix server continues to
-perform the host's passive Linux checks independently.
+group. All four send active checks to `185.108.4.158` and have source-restricted
+passive Agent 2 interfaces on TCP `10050`. Client 02's existing local Zabbix
+server continues to perform its original passive Linux checks independently.
 
 The matching host-side collector is in `zabbix-agent/`. It enters only the
 Telemt container network namespace for the control API, discards links and
diff --git a/logging/stage-host-files.sh b/logging/stage-host-files.sh
new file mode 100755
index 0000000..79bda5d
--- /dev/null
+++ b/logging/stage-host-files.sh
@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+mode="stage"
+if [[ "${1:-}" == "--check" ]]; then
+  mode="check"
+  shift
+fi
+
+target_root="${1:-/mnt/containers/logging}"
+source_root="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+mappings=(
+  "docker-compose.yaml:docker-compose.yaml"
+  "alloy-config.alloy:alloy-config/config.alloy"
+  "loki-config.yaml:loki-config/config.yaml"
+  "syslog-ng.conf:syslog-ng-config/syslog-ng.conf"
+  "grafana-provisioning/dashboards/dashboards.yaml:grafana-config/provisioning/dashboards/dashboards.yaml"
+  "grafana-provisioning/datasources/loki.yaml:grafana-config/provisioning/datasources/loki.yaml"
+  "grafana-provisioning/datasources/zabbix.yaml:grafana-config/provisioning/datasources/zabbix.yaml"
+  "grafana-dashboards/mikrotik-loki-logs.json:grafana-config/dashboards/mikrotik-loki-logs.json"
+  "grafana-dashboards/telemt-proxy-fleet.json:grafana-config/dashboards/telemt-proxy-fleet.json"
+)
+
+if [[ "${mode}" == "stage" ]]; then
+  install -d -m 0755 \
+    "${target_root}/alloy-config" \
+    "${target_root}/loki-config" \
+    "${target_root}/syslog-ng-config" \
+    "${target_root}/grafana-config/provisioning/dashboards" \
+    "${target_root}/grafana-config/provisioning/datasources" \
+    "${target_root}/grafana-config/dashboards"
+
+  install -d -o 0 -g 0 -m 0755 "${target_root}/alloy-data"
+  install -d -o 472 -g 0 -m 0755 "${target_root}/grafana-data"
+  install -d -o 10001 -g 10001 -m 0755 "${target_root}/loki-data"
+fi
+
+failed=0
+for mapping in "${mappings[@]}"; do
+  source_file="${source_root}/${mapping%%:*}"
+  target_file="${target_root}/${mapping#*:}"
+
+  if [[ "${mode}" == "stage" ]]; then
+    install -o root -g root -m 0644 "${source_file}" "${target_file}"
+  fi
+
+  if cmp -s "${source_file}" "${target_file}"; then
+    printf 'OK  %s\n' "${target_file}"
+  else
+    printf 'DIFF  %s\n' "${target_file}" >&2
+    failed=1
+  fi
+done
+
+exit "${failed}"