diff --git a/flake.lock b/flake.lock
index bc99d9c..f38b9e4 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1348,11 +1348,11 @@
         "rust-rapidsnark": "rust-rapidsnark"
       },
       "locked": {
-        "lastModified": 1781875838,
-        "narHash": "sha256-G/LgP08JF+RcjBCr0t6P/ceKSnZvWr2FFoCZxRYhVs4=",
+        "lastModified": 1781900321,
+        "narHash": "sha256-zwEhLNqhAL9otUk8cJIygw22YZrAeV0q7RDnne3kmHI=",
         "ref": "erhant/fix-indexer-ffi",
-        "rev": "32f03fa03c74afe55b6631f8500f36ca9dae79e8",
-        "revCount": 2769,
+        "rev": "49d540e64d74bd4517a0f9c42f16f0c9140f7299",
+        "revCount": 2771,
         "type": "git",
         "url": "https://github.com/logos-blockchain/logos-execution-zone"
       },
diff --git a/src/lez_indexer_module_impl.cpp b/src/lez_indexer_module_impl.cpp
index 5e0033e..965ba6f 100644
--- a/src/lez_indexer_module_impl.cpp
+++ b/src/lez_indexer_module_impl.cpp
@@ -34,8 +34,11 @@ LezIndexerModuleImpl::~LezIndexerModuleImpl() {
 
 int64_t LezIndexerModuleImpl::start_indexer(const std::string& config_path) {
     if (!indexer_service_ffi) {
-        // Null runtime: the FFI creates and owns its own tokio runtime.
-        InitializedIndexerServiceFFIResult res = ::start_indexer(nullptr, config_path.c_str());
+        // Null runtime: the FFI creates and owns its own tokio runtime. Storage
+        // goes under this module's instance persistence path (host-owned, stable
+        // per Basecamp --user-dir) so RocksDB never lands in the process CWD.
+        InitializedIndexerServiceFFIResult res =
+            ::start_indexer(nullptr, config_path.c_str(), instancePersistencePath().c_str());
         if (is_error(&res.error)) {
             warn("start_indexer", "indexer FFI error");
             return static_cast<int64_t>(res.error);
diff --git a/src/lez_indexer_module_impl.h b/src/lez_indexer_module_impl.h
index 8850e5b..272e4b4 100644
--- a/src/lez_indexer_module_impl.h
+++ b/src/lez_indexer_module_impl.h
@@ -27,9 +27,10 @@ public:
     ~LezIndexerModuleImpl();
 
     /// Boot ingestion against the indexer config at `config_path` (must be an
-    /// ABSOLUTE path — the module runs in a logos_host subprocess). Idempotent:
-    /// a second call while already running is a no-op. Returns 0 on success,
-    /// else the FFI OperationStatus code.
+    /// ABSOLUTE path — the module runs in a logos_host subprocess). RocksDB state
+    /// is stored under this module's instance persistence path (host-owned),
+    /// independent of the config. Idempotent: a second call while already running
+    /// is a no-op. Returns 0 on success, else the FFI OperationStatus code.
     /// int64_t (not int): the universal codegen marshals int64_t/std::string/bool
     /// as scalar wire types; a plain `int` return is treated as a JSON payload.
     int64_t start_indexer(const std::string& config_path);