diff --git a/Dockerfile b/Dockerfile
index 1490176..e163ef5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,11 @@
 FROM python:3.11-slim
 
-RUN apt-get update && apt-get install -y --no-install-recommends iputils-ping && rm -rf /var/lib/apt/lists/*
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends iputils-ping \
+    && rm -rf /var/lib/apt/lists/*
+
+# Upgrade pip to suppress the version notice
+RUN pip install --upgrade pip
 
 WORKDIR /app
 
@@ -10,10 +15,12 @@ RUN pip install --no-cache-dir .
 
 COPY alembic.ini .
 
-# Runtime directories
-RUN mkdir -p /data/playbook_cache /data/plugins
+# Runtime directories — owned by app user
+RUN useradd -m -u 1000 app \
+    && mkdir -p /data/playbook_cache /data/plugins \
+    && chown -R app:app /data /app
 
-ENV FABLEDNETMON_CONFIG=/config/config.yaml
+USER app
 
 EXPOSE 5000