I think I might be on to something… It would appear that the systemd service for dovecot is set to
ProtectSystem=full
which in turn according to the docs I’m reading systemd says that setting will result in the /etc hierarchy being mounted as read only for the service. To me that’s the core issue. I’m not sure the correct path forward perhaps @JoshData can provide guidance.