diff --git a/CHANGELOG.md b/CHANGELOG.md
index e7cfd8d00..da8827bbd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,8 @@ Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+- [PR-401](https://github.com/itk-dev/os2loop/pull/401)
+  Added private files setup
 - [PR-400](https://github.com/itk-dev/os2loop/pull/400)
   Updated OpenID Connect "prompt" config
 
diff --git a/docker-compose.server.prod.subsite.yml b/docker-compose.server.prod.subsite.yml
index c892be85f..5e2e3bf9b 100644
--- a/docker-compose.server.prod.subsite.yml
+++ b/docker-compose.server.prod.subsite.yml
@@ -2,6 +2,7 @@ services:
   phpfpm:
     volumes:
       - ../../shared/${SUB_SITE_FOLDER}:/app/web/sites/${SUB_SITE_FOLDER}
+      - ../../shared/private-files:/app/private-files
       - ../../shared/sites.php:/app/web/sites/sites.php
 
   nginx:
diff --git a/docker-compose.server.prod.yml b/docker-compose.server.prod.yml
index edea7b121..2f72b00f5 100644
--- a/docker-compose.server.prod.yml
+++ b/docker-compose.server.prod.yml
@@ -3,6 +3,7 @@ services:
     volumes:
       - ../../shared/settings.local.php:/app/web/sites/default/settings.local.php
       - ../../shared/files:/app/web/sites/default/files
+      - ../../shared/private-files:/app/private-files
 
   nginx:
     volumes:
diff --git a/web/sites/default/settings.php b/web/sites/default/settings.php
index 664dfb262..91365b852 100644
--- a/web/sites/default/settings.php
+++ b/web/sites/default/settings.php
@@ -780,6 +780,8 @@
 
 $settings['skip_permissions_hardening'] = TRUE;
 
+$settings['file_private_path'] = DRUPAL_ROOT . '/../private-files';
+
 /**
  * Load local development override configuration, if available.
  *