diff --git a/Dockerfile b/Dockerfile
index 27dc2771..78764b6b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -45,7 +45,7 @@ RUN npm ci --omit=dev --ignore-scripts && \
 
 # Final image
 FROM node:25-slim
-RUN apt-get update && apt-get install -y wget openssl ca-certificates gosu && rm -rf /var/lib/apt/lists/* && \
+RUN apt-get update && apt-get install -y wget openssl ca-certificates && rm -rf /var/lib/apt/lists/* && \
     groupadd -r app && useradd -r -g app -m -d /home/app app
 WORKDIR /app
 COPY --from=builder /app/dist ./dist
@@ -69,4 +69,5 @@ ENV DATABASE_URL=file:/app/database/hemmelig.db
 HEALTHCHECK --interval=30s --timeout=10s --start-period=10s --retries=3 \
     CMD wget --no-verbose --tries=1 --spider http://localhost:3000/api/health/ready || exit 1
 
+USER app
 ENTRYPOINT ["/app/docker-entrypoint.sh"]
diff --git a/scripts/docker-entrypoint.sh b/scripts/docker-entrypoint.sh
index cbbda968..cabc890d 100644
--- a/scripts/docker-entrypoint.sh
+++ b/scripts/docker-entrypoint.sh
@@ -1,8 +1,6 @@
 #!/bin/sh
 set -e
 
-# Fix permissions on mounted volumes (runs as root)
-chown -R app:app /app/database /app/uploads 2>/dev/null || true
-
-# Run migrations and start app as app user
-exec gosu app sh -c 'npx prisma migrate deploy && exec npx tsx server.ts'
+# Run migrations and start app
+npx prisma migrate deploy
+exec npx tsx server.ts