diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 6199c45..81090b2 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -12,7 +12,6 @@
             "extensions": [
                 "vscjava.vscode-java-pack",
                 "eamodio.gitlens",
-                "GitHub.copilot",
                 "anthropic.claude-code"
             ]
         }
@@ -32,8 +31,19 @@
         "--name",
         "rtldev-middleware-java-sdk"
     ],
+    // The bind below names a *file*, and Docker creates a missing bind source itself,
+    // as a directory — on the host, where it outlives the container. Without this
+    // touch, post-create.sh's symlink would point at a directory and zsh could not
+    // write a line of history. Runs on the host before the container is created, so
+    // it cannot live in post-create.sh. (RSRMID-3052)
+    "initializeCommand": "touch ${localEnv:HOME}/.zsh_history",
+    // Only the history file, never the host home. This used to mount ${localEnv:HOME}
+    // at /WSL_USER to reach that one file, which handed the container read-write reach
+    // over the host's SSH keys, credentials and every other repository on the machine.
+    // post-create.sh symlinks ~/.zsh_history to this path; this repository is not on
+    // the devbase Feature, so that script is what makes history persist here.
     "mounts": [
-        "source=${localEnv:HOME}${localEnv:USERPROFILE},target=/WSL_USER,type=bind,consistency=cached"
+        "source=${localEnv:HOME}/.zsh_history,target=/WSL_USER/.zsh_history,type=bind,consistency=cached"
     ],
     "remoteUser": "vscode"
 }
\ No newline at end of file