diff --git a/cmd/backup.go b/cmd/backup.go
index 812f6f4..a489331 100644
--- a/cmd/backup.go
+++ b/cmd/backup.go
@@ -58,7 +58,7 @@ func (bk backup) Run(context wisski_distillery.Context) error {
 	})
 
 	if err != nil {
-		return errBackupFailed.Wrap(err)
+		return errBackupFailed.WrapError(err)
 	}
 	return nil
 }
diff --git a/cmd/rebuild.go b/cmd/rebuild.go
index cf2336f..6a6566d 100644
--- a/cmd/rebuild.go
+++ b/cmd/rebuild.go
@@ -83,15 +83,7 @@ func (rb rebuild) Run(context wisski_distillery.Context) (err error) {
 			}
 		}
 
-		smanager := instance.SystemManager()
-
-		if err := smanager.Apply(context.Context, writer, sys, true); err != nil {
-			return err
-		}
-		if err := smanager.RebuildSettings(context.Context, writer); err != nil {
-			return err
-		}
-		return nil
+		return instance.SystemManager().Apply(context.Context, writer, sys)
 	}, wissKIs, status.SmartMessage(func(item *wisski.WissKI) string {
 		return fmt.Sprintf("rebuild %q", item.Slug)
 	}))
diff --git a/internal/dis/component/server/admin/socket/actions/rebuild.go b/internal/dis/component/server/admin/socket/actions/rebuild.go
index 9a22c6c..93dade5 100644
--- a/internal/dis/component/server/admin/socket/actions/rebuild.go
+++ b/internal/dis/component/server/admin/socket/actions/rebuild.go
@@ -30,19 +30,11 @@ func (*Rebuild) Action() InstanceAction {
 }
 
 func (r *Rebuild) Act(ctx context.Context, instance *wisski.WissKI, in io.Reader, out io.Writer, params ...string) error {
-	// read the flags of the instance to be provisioned
+	// read the flags of the instance to be rebuilt
 	var system models.System
 	if err := json.Unmarshal([]byte(params[0]), &system); err != nil {
 		return err
 	}
 
-	smanager := instance.SystemManager()
-
-	if err := smanager.Apply(ctx, out, system, true); err != nil {
-		return err
-	}
-	if err := smanager.RebuildSettings(ctx, out); err != nil {
-		return err
-	}
-	return nil
+	return instance.SystemManager().Apply(ctx, out, system)
 }
diff --git a/internal/dis/component/stack.go b/internal/dis/component/stack.go
index 4d80b17..e112c18 100644
--- a/internal/dis/component/stack.go
+++ b/internal/dis/component/stack.go
@@ -13,6 +13,7 @@ import (
 	"github.com/FAU-CDI/wisski-distillery/pkg/execx"
 	"github.com/FAU-CDI/wisski-distillery/pkg/unpack"
 	"github.com/pkg/errors"
+	"github.com/tkw1536/pkglib/fsx"
 	"github.com/tkw1536/pkglib/fsx/umaskfree"
 	"github.com/tkw1536/pkglib/stream"
 	"gopkg.in/yaml.v3"
@@ -188,8 +189,9 @@ type StackWithResources struct {
 	MakeDirsPerm fs.FileMode // permission for dirctories, defaults to [environment.DefaultDirCreate]
 	MakeDirs     []string    // directories to ensure that exist
 
-	TouchFilesPerm fs.FileMode // permission for new files to touch, defaults to [environment.DefaultFileCreate]
-	TouchFiles     []string    // Files to 'touch', i.e. ensure that exist; guaranteed to be run after MakeDirs
+	TouchFilesPerm fs.FileMode       // permission for new files to touch or create, defaults to [environment.DefaultFileCreate]
+	TouchFiles     []string          // Files to 'touch', i.e. ensure that exist; guaranteed to be run after MakeDirs
+	CreateFiles    map[string]string // Files to 'create' but not update after they are setup; guaranteed to be run after MakeDirs
 }
 
 // InstallationContext is a context to install data in
@@ -270,7 +272,7 @@ func (is StackWithResources) Install(ctx context.Context, progress io.Writer, co
 		}
 	}
 
-	// make sure that certain files exist
+	// touch files that should be created empty
 	for _, name := range is.TouchFiles {
 		// find the destination!
 		dst := filepath.Join(is.Dir, name)
@@ -280,6 +282,26 @@ func (is StackWithResources) Install(ctx context.Context, progress io.Writer, co
 			return err
 		}
 	}
+	// make sure that certain files exist
+	for name, content := range is.CreateFiles {
+		// find the destination!
+		dst := filepath.Join(is.Dir, name)
+
+		exists, err := fsx.Exists(dst)
+		if err != nil {
+			return err
+		}
+
+		// create the file if it doesn't exist
+		if !exists {
+			fmt.Fprintf(progress, "[create]   %s\n", dst)
+			if err := umaskfree.WriteFile(dst, []byte(content), umaskfree.DefaultFilePerm); err != nil {
+				return err
+			}
+		} else {
+			fmt.Fprintf(progress, "[skip]   %s\n", dst)
+		}
+	}
 
 	// check that the stack can be loaded
 	{
diff --git a/internal/wisski/ingredient/barrel/barrel.go b/internal/wisski/ingredient/barrel/barrel.go
index f7ffc0b..c95a3c1 100644
--- a/internal/wisski/ingredient/barrel/barrel.go
+++ b/internal/wisski/ingredient/barrel/barrel.go
@@ -22,4 +22,7 @@ const (
 	OntologyDirectory = SitesDirectory + "/default/files/ontology"
 	SitesDirectory    = WebDirectory + "/sites"
 	WissKIDirectory   = WebDirectory + "/modules/contrib/wisski"
+
+	LocalSettingsPath  = "/settings/local.php"
+	GlobalSettingsPath = "/settings/global.php"
 )
diff --git a/internal/wisski/ingredient/barrel/barrel/docker-compose.yml b/internal/wisski/ingredient/barrel/barrel/docker-compose.yml
index bc94b85..cacecdb 100644
--- a/internal/wisski/ingredient/barrel/barrel/docker-compose.yml
+++ b/internal/wisski/ingredient/barrel/barrel/docker-compose.yml
@@ -1,3 +1,4 @@
+# THIS FILE IS GENERATED AUTOMATICALLY. DO NOT EDIT.
 version: "3.7"
 
 services:
@@ -43,6 +44,7 @@ services:
       - ${DATA_PATH}/data:/var/www/data:rw
       - ${DATA_PATH}/home:/var/www:rw
       - ${DATA_PATH}/hostkeys:/ssh/hostkeys:rw
+      - ${LOCAL_SETTINGS_PATH}:${LOCAL_SETTINGS_MOUNT}:ro
 
 networks:
   default:
diff --git a/internal/wisski/ingredient/barrel/local.settings.php b/internal/wisski/ingredient/barrel/local.settings.php
new file mode 100644
index 0000000..3dc292d
--- /dev/null
+++ b/internal/wisski/ingredient/barrel/local.settings.php
@@ -0,0 +1,16 @@
+<?php
+
+// Use this file to manually tweak setttings of this instance in an update-agnostic way.
+// This file will not be updated by future distillery updates.
+//
+// The settings.php file contains settings in the following order:
+//
+// - settings generated by the drupal installer
+// - global distillery settings files
+// - distillery generated configuration files
+// - this file
+//
+// Because of caching, changes may require an instance restart to take effect.
+
+// // e.g. to turn on verbose logging, uncomment the following line:
+// $config["system.logging"]["error_level"] = "verbose";
diff --git a/internal/wisski/ingredient/barrel/manager/provision.go b/internal/wisski/ingredient/barrel/manager/provision.go
index bb803f7..095c566 100644
--- a/internal/wisski/ingredient/barrel/manager/provision.go
+++ b/internal/wisski/ingredient/barrel/manager/provision.go
@@ -23,7 +23,7 @@ import (
 // Provision applies defaults to flags, to ensure some values are set
 func (manager *Manager) Provision(ctx context.Context, progress io.Writer, system models.System, flags Profile) error {
 	// Force building and applying the system!
-	if err := manager.dependencies.SystemManager.Apply(ctx, progress, system, false); err != nil {
+	if err := manager.dependencies.SystemManager.ApplyInitial(ctx, progress, system); err != nil {
 		return err
 	}
 
@@ -130,7 +130,7 @@ func (provision *Manager) bootstrap(ctx context.Context, progress io.Writer, fla
 	// Rebuild the settings file
 	logging.LogMessage(progress, "Rebuilding Settings")
 	{
-		if err := provision.dependencies.SystemManager.RebuildSettings(ctx, progress); err != nil {
+		if err := provision.dependencies.SystemManager.BuildSettings(ctx, progress); err != nil {
 			return err
 		}
 	}
diff --git a/internal/wisski/ingredient/barrel/stack.go b/internal/wisski/ingredient/barrel/stack.go
index 15cb83c..7243990 100644
--- a/internal/wisski/ingredient/barrel/stack.go
+++ b/internal/wisski/ingredient/barrel/stack.go
@@ -4,12 +4,19 @@ import (
 	"embed"
 	"path/filepath"
 
+	_ "embed"
+
 	"github.com/FAU-CDI/wisski-distillery/internal/dis/component"
 )
 
 //go:embed all:barrel
 var barrelResources embed.FS
 
+const localSettingsName = "settings.local.php"
+
+//go:embed local.settings.php
+var localSettingsTemplate string
+
 // Barrel returns a stack representing the running WissKI Instance
 func (barrel *Barrel) Stack() component.StackWithResources {
 	return component.StackWithResources{
@@ -20,6 +27,10 @@ func (barrel *Barrel) Stack() component.StackWithResources {
 		Resources:   barrelResources,
 		ContextPath: filepath.Join("barrel"),
 
+		CreateFiles: map[string]string{
+			localSettingsName: localSettingsTemplate,
+		},
+
 		EnvContext: map[string]string{
 			"DOCKER_NETWORK_NAME": barrel.Malt.Config.Docker.Network(),
 
@@ -31,6 +42,9 @@ func (barrel *Barrel) Stack() component.StackWithResources {
 			"DATA_PATH":   filepath.Join(barrel.FilesystemBase, "data"),
 			"RUNTIME_DIR": barrel.Malt.Config.Paths.RuntimeDir(),
 
+			"LOCAL_SETTINGS_PATH":  filepath.Join(barrel.FilesystemBase, localSettingsName),
+			"LOCAL_SETTINGS_MOUNT": LocalSettingsPath,
+
 			"BARREL_BASE_IMAGE":       barrel.GetDockerBaseImage(),
 			"IIP_SERVER_ENABLED":      barrel.GetIIPServerEnabled(),
 			"OPCACHE_MODE":            barrel.OpCacheMode(),
diff --git a/internal/wisski/ingredient/barrel/system/settings.go b/internal/wisski/ingredient/barrel/system/settings.go
index 123b820..de8a68f 100644
--- a/internal/wisski/ingredient/barrel/system/settings.go
+++ b/internal/wisski/ingredient/barrel/system/settings.go
@@ -7,8 +7,9 @@ import (
 	"github.com/FAU-CDI/wisski-distillery/pkg/logging"
 )
 
-// RebuildSettings (re-)configures settings.php for the provided running instance
-func (smanager *SystemManager) RebuildSettings(ctx context.Context, progress io.Writer) (err error) {
+// BuildSettings sets up global settings.php configuration settings.php for the provided running instance
+// This doesn't need to be called manually.
+func (smanager *SystemManager) BuildSettings(ctx context.Context, progress io.Writer) (err error) {
 	logging.LogMessage(progress, "Updating TRUSTED_HOST_PATTERNS in settings.php")
 	{
 		if err := smanager.dependencies.Settings.SetTrustedDomain(ctx, nil, smanager.Domain()); err != nil {
diff --git a/internal/wisski/ingredient/barrel/system/system.go b/internal/wisski/ingredient/barrel/system/system.go
index a930909..86e4410 100644
--- a/internal/wisski/ingredient/barrel/system/system.go
+++ b/internal/wisski/ingredient/barrel/system/system.go
@@ -21,19 +21,33 @@ type SystemManager struct {
 	}
 }
 
-// Apply applies a specific system version to this barrel.
-// If start is true, also starts the container.
-func (smanager *SystemManager) Apply(ctx context.Context, progress io.Writer, system models.System, start bool) (err error) {
-	// setup the new docker image
-	smanager.Instance.System = system
+// Apply applies the given system configuration to this instance and (re-)starts the system.
+func (smanager *SystemManager) Apply(ctx context.Context, progress io.Writer, system models.System) (err error) {
+	if err := smanager.apply(ctx, progress, system, true); err != nil {
+		return err
+	}
 
-	// save in bookkeeping
+	if err := smanager.BuildSettings(ctx, progress); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// ApplyInitial builds the base image, but does not start it
+func (smanager *SystemManager) ApplyInitial(ctx context.Context, progress io.Writer, system models.System) error {
+	return smanager.apply(ctx, progress, system, false)
+}
+
+// apply stores the new configuration and builds the base image
+// start inidicates if the image should be started afterwards
+func (smanager *SystemManager) apply(ctx context.Context, progress io.Writer, system models.System, start bool) error {
+	// store the new system configuration
+	smanager.Instance.System = system
 	if err := smanager.dependencies.Bookkeeping.Save(ctx); err != nil {
 		return err
 	}
 
-	// TODO: Apply Content-Security-Policy!
-
-	// and rebuild
+	// build and start the barrel
 	return smanager.dependencies.Barrel.Build(ctx, progress, start)
 }
diff --git a/internal/wisski/ingredient/php/extras/settings.go b/internal/wisski/ingredient/php/extras/settings.go
index 41ef4ad..a8b56c7 100644
--- a/internal/wisski/ingredient/php/extras/settings.go
+++ b/internal/wisski/ingredient/php/extras/settings.go
@@ -7,6 +7,7 @@ import (
 
 	"github.com/FAU-CDI/wisski-distillery/internal/phpx"
 	"github.com/FAU-CDI/wisski-distillery/internal/wisski/ingredient"
+	"github.com/FAU-CDI/wisski-distillery/internal/wisski/ingredient/barrel"
 	"github.com/FAU-CDI/wisski-distillery/internal/wisski/ingredient/php"
 )
 
@@ -41,6 +42,8 @@ var (
 	errFailedInstallDistillerySettings = errors.New("failed to install distillery settings")
 )
 
+// SetTrustedDomain configures the trusted domain setting for the given instance.
+// Note that this removes any installed distillery settings.
 func (settings *Settings) SetTrustedDomain(ctx context.Context, server *phpx.Server, domain string) error {
 	var ok bool
 
@@ -51,14 +54,12 @@ func (settings *Settings) SetTrustedDomain(ctx context.Context, server *phpx.Ser
 	return err
 }
 
-// GlobalSettingsPath is the global path to distillery settings
-const GlobalSettingsPath = "/distillery_settings.php"
-
 func (settings *Settings) InstallDistillerySettings(ctx context.Context, server *phpx.Server) error {
 	var ok bool
 
 	err := settings.dependencies.PHP.ExecScript(ctx, server, &ok, settingsPHP, "install_settings_include", []string{
-		GlobalSettingsPath,
+		barrel.LocalSettingsPath,
+		barrel.GlobalSettingsPath,
 	})
 	if err == nil && !ok {
 		err = errFailedInstallDistillerySettings
diff --git a/internal/wisski/ingredient/php/extras/settings.php b/internal/wisski/ingredient/php/extras/settings.php
index 3a66455..1228d3f 100644
--- a/internal/wisski/ingredient/php/extras/settings.php
+++ b/internal/wisski/ingredient/php/extras/settings.php
@@ -43,7 +43,6 @@ function set_setting(string $name, mixed $value): bool {
         return FALSE;
     }
 
-
     // reset the file mode
     return chmod($filename, $old);
 }
@@ -80,7 +79,7 @@ function install_settings_include(array $paths): bool {
         // add code to include the file if it exists
         $code = $code . 'if (file_exists(' . $the_path . ')) { include_once ' . $the_path . '; }' . "\n";
     }
-    $code = $code . "// </distillery-settings-include>";
+    $code = $code . "// </distillery-settings-include>\n";
 
     // and store the settings
     try {