diff --git a/CreateMatrix/Dockerfile.cs b/CreateMatrix/Dockerfile.cs
index 2035c55..57a23a6 100644
--- a/CreateMatrix/Dockerfile.cs
+++ b/CreateMatrix/Dockerfile.cs
@@ -316,11 +316,11 @@ RUN apt-get update \
                 # Only allow sudo no password access to the root-tool
                 RUN echo "${COMPANY_NAME} ALL = NOPASSWD: /opt/${COMPANY_NAME}/mediaserver/bin/root-tool" > /etc/sudoers.d/${COMPANY_NAME}
 
-                # Tell mediaserver it is running under Docker so it reports its OS variant correctly
-                # https://github.com/networkoptix/nxvms-docker/commit/54bbd16
-                RUN echo "currentOsVariantOverride=docker" >> /opt/${COMPANY_NAME}/mediaserver/etc/mediaserver.conf
-
                 """;
+            // Note: for non-LSIO, currentOsVariantOverride=docker is injected at runtime by
+            // Docker/entrypoint.sh, because the recommended non-LSIO setup bind-mounts
+            // /opt/${COMPANY_NAME}/mediaserver/etc from the host, which would hide any
+            // build-time edit. Both variants now use runtime injection for the same reason.
         }
 
         return install;
diff --git a/Docker/DWSpectrum.Dockerfile b/Docker/DWSpectrum.Dockerfile
index a3b72c1..52d66c8 100644
--- a/Docker/DWSpectrum.Dockerfile
+++ b/Docker/DWSpectrum.Dockerfile
@@ -101,10 +101,6 @@ RUN apt-get update \
 # Only allow sudo no password access to the root-tool
 RUN echo "${COMPANY_NAME} ALL = NOPASSWD: /opt/${COMPANY_NAME}/mediaserver/bin/root-tool" > /etc/sudoers.d/${COMPANY_NAME}
 
-# Tell mediaserver it is running under Docker so it reports its OS variant correctly
-# https://github.com/networkoptix/nxvms-docker/commit/54bbd16
-RUN echo "currentOsVariantOverride=docker" >> /opt/${COMPANY_NAME}/mediaserver/etc/mediaserver.conf
-
 # Copy the entrypoint.sh launch script
 # entrypoint.sh will run the mediaserver and root-tool
 COPY entrypoint.sh /opt/entrypoint.sh
diff --git a/Docker/NxGo.Dockerfile b/Docker/NxGo.Dockerfile
index e637fb4..c77be6a 100644
--- a/Docker/NxGo.Dockerfile
+++ b/Docker/NxGo.Dockerfile
@@ -101,10 +101,6 @@ RUN apt-get update \
 # Only allow sudo no password access to the root-tool
 RUN echo "${COMPANY_NAME} ALL = NOPASSWD: /opt/${COMPANY_NAME}/mediaserver/bin/root-tool" > /etc/sudoers.d/${COMPANY_NAME}
 
-# Tell mediaserver it is running under Docker so it reports its OS variant correctly
-# https://github.com/networkoptix/nxvms-docker/commit/54bbd16
-RUN echo "currentOsVariantOverride=docker" >> /opt/${COMPANY_NAME}/mediaserver/etc/mediaserver.conf
-
 # Copy the entrypoint.sh launch script
 # entrypoint.sh will run the mediaserver and root-tool
 COPY entrypoint.sh /opt/entrypoint.sh
diff --git a/Docker/NxMeta.Dockerfile b/Docker/NxMeta.Dockerfile
index b52ae32..d827fa6 100644
--- a/Docker/NxMeta.Dockerfile
+++ b/Docker/NxMeta.Dockerfile
@@ -101,10 +101,6 @@ RUN apt-get update \
 # Only allow sudo no password access to the root-tool
 RUN echo "${COMPANY_NAME} ALL = NOPASSWD: /opt/${COMPANY_NAME}/mediaserver/bin/root-tool" > /etc/sudoers.d/${COMPANY_NAME}
 
-# Tell mediaserver it is running under Docker so it reports its OS variant correctly
-# https://github.com/networkoptix/nxvms-docker/commit/54bbd16
-RUN echo "currentOsVariantOverride=docker" >> /opt/${COMPANY_NAME}/mediaserver/etc/mediaserver.conf
-
 # Copy the entrypoint.sh launch script
 # entrypoint.sh will run the mediaserver and root-tool
 COPY entrypoint.sh /opt/entrypoint.sh
diff --git a/Docker/NxWitness.Dockerfile b/Docker/NxWitness.Dockerfile
index deba664..f46374b 100644
--- a/Docker/NxWitness.Dockerfile
+++ b/Docker/NxWitness.Dockerfile
@@ -101,10 +101,6 @@ RUN apt-get update \
 # Only allow sudo no password access to the root-tool
 RUN echo "${COMPANY_NAME} ALL = NOPASSWD: /opt/${COMPANY_NAME}/mediaserver/bin/root-tool" > /etc/sudoers.d/${COMPANY_NAME}
 
-# Tell mediaserver it is running under Docker so it reports its OS variant correctly
-# https://github.com/networkoptix/nxvms-docker/commit/54bbd16
-RUN echo "currentOsVariantOverride=docker" >> /opt/${COMPANY_NAME}/mediaserver/etc/mediaserver.conf
-
 # Copy the entrypoint.sh launch script
 # entrypoint.sh will run the mediaserver and root-tool
 COPY entrypoint.sh /opt/entrypoint.sh
diff --git a/Docker/WisenetWAVE.Dockerfile b/Docker/WisenetWAVE.Dockerfile
index ce2006d..5c6c7bb 100644
--- a/Docker/WisenetWAVE.Dockerfile
+++ b/Docker/WisenetWAVE.Dockerfile
@@ -101,10 +101,6 @@ RUN apt-get update \
 # Only allow sudo no password access to the root-tool
 RUN echo "${COMPANY_NAME} ALL = NOPASSWD: /opt/${COMPANY_NAME}/mediaserver/bin/root-tool" > /etc/sudoers.d/${COMPANY_NAME}
 
-# Tell mediaserver it is running under Docker so it reports its OS variant correctly
-# https://github.com/networkoptix/nxvms-docker/commit/54bbd16
-RUN echo "currentOsVariantOverride=docker" >> /opt/${COMPANY_NAME}/mediaserver/etc/mediaserver.conf
-
 # Copy the entrypoint.sh launch script
 # entrypoint.sh will run the mediaserver and root-tool
 COPY entrypoint.sh /opt/entrypoint.sh
diff --git a/Docker/entrypoint.sh b/Docker/entrypoint.sh
index 90825e3..c3dea33 100755
--- a/Docker/entrypoint.sh
+++ b/Docker/entrypoint.sh
@@ -4,6 +4,18 @@
 echo "Launching root-tool"
 sudo /opt/${COMPANY_NAME}/mediaserver/bin/root-tool &
 
+# Tell mediaserver it is running under Docker so it reports its OS variant correctly
+# https://github.com/networkoptix/nxvms-docker/commit/54bbd16
+# Inject at runtime rather than build time because the recommended non-LSIO setup
+# bind-mounts /opt/${COMPANY_NAME}/mediaserver/etc from the host, which hides any
+# build-time edit. Idempotent so subsequent starts don't duplicate the line.
+MEDIASERVER_CONF="/opt/${COMPANY_NAME}/mediaserver/etc/mediaserver.conf"
+if ! grep -q "^currentOsVariantOverride=docker" "${MEDIASERVER_CONF}" 2>/dev/null
+then
+    echo "Adding currentOsVariantOverride=docker to ${MEDIASERVER_CONF}"
+    echo "currentOsVariantOverride=docker" >> "${MEDIASERVER_CONF}"
+fi
+
 # Launch the mediaserver using exec so it receives shutdown commands
 echo "Launching mediaserver"
 exec /opt/${COMPANY_NAME}/mediaserver/bin/mediaserver -e