diff --git a/Dockerfile b/Dockerfile
index 329ba3a..a1024e3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -31,12 +31,12 @@ COPY --from=builder /app/target/release/sub-aligator /usr/local/bin/sub-aligator
 COPY --from=builder /app/migrations /app/migrations
 COPY --from=builder /app/static /app/static
 COPY --from=builder /app/templates /app/templates
-
-USER app
+COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+RUN chmod +x /usr/local/bin/docker-entrypoint.sh
 
 EXPOSE 8080
 
 HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
     CMD curl -fsS http://localhost:8080/healthz >/dev/null || exit 1
 
-CMD ["/usr/local/bin/sub-aligator"]
+ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh
new file mode 100644
index 0000000..083ab64
--- /dev/null
+++ b/docker-entrypoint.sh
@@ -0,0 +1,9 @@
+#!/bin/sh
+set -e
+
+# Ensure persistent directories exist and are writable by the app user.
+mkdir -p /app/data /app/exports /app/backups
+chown -R app:app /app/data /app/exports /app/backups
+
+# Drop root privileges and run the application as the app user.
+exec runuser -u app -- /usr/local/bin/sub-aligator "$@"