diff --git a/docker-compose.localdev.yml b/docker-compose.localdev.yml
index 48b06ff..0822086 100644
--- a/docker-compose.localdev.yml
+++ b/docker-compose.localdev.yml
@@ -58,6 +58,8 @@ services:
       # Downloaded media lives on the host so you can inspect the generated Plex tree.
       # Gitignored. The worker writes here; the API reads it to serve local downloads.
       - ./downloads:/downloads
+      # Plex media, read-only (see the plex_media volume note below). Maps to plex_path_map.
+      - plex_media:/plex-media:ro
     restart: unless-stopped
 
   # Dedicated download worker: same image, runs the yt-dlp job loop instead of the API.
@@ -87,6 +89,7 @@ services:
       - apparmor:unconfined
     volumes:
       - ./downloads:/downloads
+      - plex_media:/plex-media:ro
     restart: unless-stopped
 
   # PO-token provider: mints YouTube Proof-of-Origin tokens on demand so the worker bypasses
@@ -101,3 +104,16 @@ services:
 
 volumes:
   pgdata:
+  # OPTIONAL (Plex integration dev testing): the Plex media, mounted READ-ONLY from the SMB share
+  # so the container can play the physical file locally (this dev box isn't the Plex host). Uses a
+  # dedicated read-only samba user via PLEX_SMB_USER/PLEX_SMB_PASS in .env. Only referenced when the
+  # Plex module is enabled; harmless otherwise (Docker mounts it lazily on first container use). On
+  # prod (LXC on the Plex host) this is a plain host bind-mount instead — no SMB.
+  plex_media:
+    driver: local
+    driver_opts:
+      type: cifs
+      # Host/share + credentials come from .env (gitignored) so no site-specific values live in
+      # the tracked compose: PLEX_SMB_HOST, PLEX_SMB_SHARE, PLEX_SMB_USER, PLEX_SMB_PASS.
+      device: "//${PLEX_SMB_HOST:-localhost}/${PLEX_SMB_SHARE:-data}"
+      o: "username=${PLEX_SMB_USER:-},password=${PLEX_SMB_PASS:-},ro,vers=3.0,uid=1000,gid=1000,file_mode=0444,dir_mode=0555"