diff --git a/backend/Dockerfile b/backend/Dockerfile
index 366b351..4e41364 100644
--- a/backend/Dockerfile
+++ b/backend/Dockerfile
@@ -8,8 +8,11 @@ RUN dotnet publish backend/src/BigRegister.Api -c Release -o /app
 
 FROM mcr.microsoft.com/dotnet/aspnet:10.0
 WORKDIR /app
-COPY --from=build /app .
+COPY --chown=$APP_UID:$APP_UID --from=build /app .
 # LetterHtml.Render (WP-25) walks up from AppContext.BaseDirectory looking for a sibling
 # public/letter.css (the FE⇄BE letter contract) — this keeps that lookup working here too.
-COPY public ./public
+COPY --chown=$APP_UID:$APP_UID public ./public
+# $APP_UID (uid/gid 1654, "app") is baked into this base image for exactly this purpose —
+# non-root, and chown'd above so it can still create/write bigregister.db (WP-22) at /app.
+USER $APP_UID
 ENTRYPOINT ["dotnet", "BigRegister.Api.dll"]