diff --git a/imageroot/crowdsec.service b/imageroot/crowdsec.service
index 75680df..fd10e00 100644
--- a/imageroot/crowdsec.service
+++ b/imageroot/crowdsec.service
@@ -38,7 +38,7 @@ ExecStart=/usr/bin/podman run \
     --volume  ./crowdsec_config:/etc/crowdsec:Z \
     --volume %N-data:/var/lib/crowdsec/data:Z \
     --volume ${CROWDSEC_JOURNAL}:/run/log/journal \
-    --volume ./tainted/nextcloud-logs.yaml:/etc/crowdsec/hub/parsers/s01-parse/crowdsecurity/nextcloud-logs.yaml:Z \
+    --volume ../tainted/nextcloud-logs.yaml:/etc/crowdsec/hub/parsers/s01-parse/crowdsecurity/nextcloud-logs.yaml:Z \
     ${CROWDSEC_IMAGE}
 ExecStop=/usr/bin/podman stop --ignore --cidfile %t/%N.cid -t 10
 ExecStopPost=/usr/bin/podman rm --ignore -f --cidfile %t/%N.cid
diff --git a/imageroot/state/tainted/nextcloud-logs.yaml b/imageroot/tainted/nextcloud-logs.yaml
similarity index 100%
rename from imageroot/state/tainted/nextcloud-logs.yaml
rename to imageroot/tainted/nextcloud-logs.yaml