diff --git a/.env.example b/.env.example
index 91ff78f..f128de7 100644
--- a/.env.example
+++ b/.env.example
@@ -10,13 +10,9 @@ CP_HOST_AGENT_ADDR=localhost:50051
 
 # Host Agent
 AGENT_LISTEN_ADDR=:50051
-AGENT_KERNEL_PATH=/var/lib/wrenn/kernels/vmlinux
-AGENT_IMAGES_PATH=/var/lib/wrenn/images
-AGENT_SANDBOXES_PATH=/var/lib/wrenn/sandboxes
-AGENT_SNAPSHOTS_PATH=/var/lib/wrenn/snapshots
+AGENT_FILES_ROOTDIR=/var/lib/wrenn
 AGENT_HOST_INTERFACE=eth0
 AGENT_CP_URL=http://localhost:8000
-AGENT_TOKEN_FILE=/var/lib/wrenn/host-token
 
 # Lago (billing — external service)
 LAGO_API_URL=http://localhost:3000
diff --git a/README.md b/README.md
index df69e8d..3ea670c 100644
--- a/README.md
+++ b/README.md
@@ -35,6 +35,9 @@ mkdir -p /var/lib/wrenn/images
 # Sandbox working directory
 mkdir -p /var/lib/wrenn/sandboxes
 
+# Snapshots directory
+mkdir -p /var/lib/wrenn/snapshots
+
 # Enable IP forwarding
 sysctl -w net.ipv4.ip_forward=1
 ```
@@ -53,9 +56,7 @@ CP_HOST_AGENT_ADDR=http://localhost:50051
 
 # Host agent
 AGENT_LISTEN_ADDR=:50051
-AGENT_KERNEL_PATH=/var/lib/wrenn/kernels/vmlinux
-AGENT_IMAGES_PATH=/var/lib/wrenn/images
-AGENT_SANDBOXES_PATH=/var/lib/wrenn/sandboxes
+AGENT_FILES_ROOTDIR=/var/lib/wrenn
 ```
 
 ### Run
@@ -91,7 +92,7 @@ Hosts must be registered with the control plane before they can serve sandboxes.
         --register <token-from-step-1> \
         --address 10.0.1.5:50051
    ```
-   On first startup the agent sends its specs (arch, CPU, memory, disk) to the control plane, receives a long-lived host JWT, and saves it to `AGENT_TOKEN_FILE` (default `/var/lib/wrenn/host-token`).
+   On first startup the agent sends its specs (arch, CPU, memory, disk) to the control plane, receives a long-lived host JWT, and saves it to `$AGENT_FILES_ROOTDIR/host-token`.
 
 3. **Subsequent startups** don't need `--register` — the agent loads the saved JWT automatically:
    ```bash
diff --git a/cmd/host-agent/main.go b/cmd/host-agent/main.go
index 825bc60..c426a81 100644
--- a/cmd/host-agent/main.go
+++ b/cmd/host-agent/main.go
@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"os"
 	"os/signal"
+	"path/filepath"
 	"syscall"
 	"time"
 
@@ -39,18 +40,15 @@ func main() {
 	devicemapper.CleanupStaleDevices()
 
 	listenAddr := envOrDefault("AGENT_LISTEN_ADDR", ":50051")
-	kernelPath := envOrDefault("AGENT_KERNEL_PATH", "/var/lib/wrenn/kernels/vmlinux")
-	imagesPath := envOrDefault("AGENT_IMAGES_PATH", "/var/lib/wrenn/images")
-	sandboxesPath := envOrDefault("AGENT_SANDBOXES_PATH", "/var/lib/wrenn/sandboxes")
-	snapshotsPath := envOrDefault("AGENT_SNAPSHOTS_PATH", "/var/lib/wrenn/snapshots")
+	rootDir := envOrDefault("AGENT_FILES_ROOTDIR", "/var/lib/wrenn")
 	cpURL := os.Getenv("AGENT_CP_URL")
-	tokenFile := envOrDefault("AGENT_TOKEN_FILE", "/var/lib/wrenn/host-token")
+	tokenFile := filepath.Join(rootDir, "host-token")
 
 	cfg := sandbox.Config{
-		KernelPath:   kernelPath,
-		ImagesDir:    imagesPath,
-		SandboxesDir: sandboxesPath,
-		SnapshotsDir: snapshotsPath,
+		KernelPath:   filepath.Join(rootDir, "kernels", "vmlinux"),
+		ImagesDir:    filepath.Join(rootDir, "images"),
+		SandboxesDir: filepath.Join(rootDir, "sandboxes"),
+		SnapshotsDir: filepath.Join(rootDir, "snapshots"),
 	}
 
 	mgr := sandbox.New(cfg)
diff --git a/scripts/rootfs-from-container.sh b/scripts/rootfs-from-container.sh
index bd669f9..d44b38a 100755
--- a/scripts/rootfs-from-container.sh
+++ b/scripts/rootfs-from-container.sh
@@ -10,10 +10,10 @@
 #
 # Arguments:
 #   container   — Docker container name or ID to export
-#   image_name  — Directory name under AGENT_IMAGES_PATH (e.g. "waitlist")
+#   image_name  — Directory name under images dir (e.g. "waitlist")
 #
 # Output:
-#   ${AGENT_IMAGES_PATH}/<image_name>/rootfs.ext4
+#   ${AGENT_FILES_ROOTDIR}/images/<image_name>/rootfs.ext4
 #
 # Requires: docker, mkfs.ext4, resize2fs, e2fsck, make (for building envd)
 # Sudo is used only for mount/umount/copy-into-image operations.
@@ -22,7 +22,8 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 PROJECT_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
-AGENT_IMAGES_PATH="${AGENT_IMAGES_PATH:-/var/lib/wrenn/images}"
+AGENT_FILES_ROOTDIR="${AGENT_FILES_ROOTDIR:-/var/lib/wrenn}"
+AGENT_IMAGES_PATH="${AGENT_FILES_ROOTDIR}/images"
 
 if [ $# -lt 2 ]; then
     echo "Usage: $0 <container> <image_name>"