diff --git a/images/fedora-intune/defender.yaml b/images/fedora-intune/defender.yaml
index 9c7d37b..73561d3 100644
--- a/images/fedora-intune/defender.yaml
+++ b/images/fedora-intune/defender.yaml
@@ -34,7 +34,10 @@ add-files:
   # reference: https://learn.microsoft.com/defender-endpoint/linux-preferences
   # Not set here: network protection (Insiders channels only) and tamper
   # protection (audit-only preview on Linux).
-  - ["mdatp_managed.json", "/etc/opt/microsoft/mdatp/managed/mdatp_managed.json"]
+  - ["mdatp_managed.json", "/usr/share/mdatp-managed/mdatp_managed.json"]
+  # Installed into /etc/opt/microsoft/mdatp/managed/ whenever Defender starts;
+  # see the drop-in.
+  - ["mdatp-managed-config.conf", "/usr/lib/systemd/system/mdatp.service.d/20-managed-config.conf"]
 
 postprocess:
   - |
@@ -52,6 +55,6 @@ postprocess:
     done
     semodule -n -i "${pp}"
     # Fail the build on a typo rather than ship a config Defender can't read.
-    python3 -m json.tool /etc/opt/microsoft/mdatp/managed/mdatp_managed.json > /dev/null
+    python3 -m json.tool /usr/share/mdatp-managed/mdatp_managed.json > /dev/null
     rpm -q --qf '%{POSTIN}' mdatp > /usr/libexec/mdatp-postinst
     chmod 0755 /usr/libexec/mdatp-firstboot /usr/libexec/mdatp-postinst
diff --git a/images/fedora-intune/files/mdatp-managed-config.conf b/images/fedora-intune/files/mdatp-managed-config.conf
new file mode 100644
index 0000000..48364b7
--- /dev/null
+++ b/images/fedora-intune/files/mdatp-managed-config.conf
@@ -0,0 +1,7 @@
+# Install the image's enforced Defender settings each time Defender starts.
+# The image can't ship them in /etc directly: mdatp-firstboot creates
+# /etc/opt/microsoft/mdatp on the device, so on updates that directory counts
+# as local and ostree's /etc merge never adds new files under it. Copying on
+# every start also picks up changes from newer images and undoes local edits.
+[Service]
+ExecStartPre=+/usr/bin/install -D -Z -m 0644 /usr/share/mdatp-managed/mdatp_managed.json /etc/opt/microsoft/mdatp/managed/mdatp_managed.json