diff --git a/Dockerfile b/Dockerfile
index fa300f5..cc32eb1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,6 +4,7 @@ FROM python:3.12-slim-bookworm
 RUN apt-get update && apt-get install -y --no-install-recommends \
     ffmpeg \
     curl \
+    gosu \
     && rm -rf /var/lib/apt/lists/*
 
 # Install yt-dlp (standalone binary, always up-to-date)
@@ -18,7 +19,7 @@ RUN pip install --no-cache-dir -r requirements.txt
 
 COPY . .
 
-RUN mkdir -p /app/tmp
+RUN mkdir -p /app/tmp /app/data
 
 ENV APP_HOST=0.0.0.0
 ENV APP_PORT=8000
@@ -26,5 +27,9 @@ ENV TMP_DIR=/app/tmp
 
 EXPOSE 8000
 
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+ENTRYPOINT ["/entrypoint.sh"]
 # Single worker to stay within Pi 3's memory budget
 CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000", "--workers", "1"]
diff --git a/docker-compose.yml b/docker-compose.yml
index 42da646..ff44bc7 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -7,6 +7,17 @@ services:
     env_file:
       - path: .env
         required: false
+    environment:
+      - OPENAI_API_KEY
+      - USDA_API_KEY
+      - TANDOOR_BASE_URL
+      - TANDOOR_API_TOKEN
+      - TMP_DIR
+      - APP_HOST
+      - APP_PORT
+      - FFMPEG_LOCATION
+      - APP_UID
+      - APP_GID
     ports:
       - "88:8000"
     volumes:
diff --git a/entrypoint.sh b/entrypoint.sh
new file mode 100644
index 0000000..c229a81
--- /dev/null
+++ b/entrypoint.sh
@@ -0,0 +1,11 @@
+#!/bin/sh
+set -e
+
+APP_UID=${APP_UID:-1000}
+APP_GID=${APP_GID:-1000}
+
+# Fix ownership of mounted volumes so the app user can write to them
+chown "${APP_UID}:${APP_GID}" /app/tmp /app/data /app/data/images
+
+# Drop from root to app user and run the actual command
+exec gosu "${APP_UID}:${APP_GID}" "$@"