diff --git a/Makefile b/Makefile
index c50b72014..76b99ce0d 100644
--- a/Makefile
+++ b/Makefile
@@ -417,7 +417,7 @@ dev: ensure-langflow-data ensure-backend-volumes ## Start full stack with GPU su
 
 dev-cpu: ensure-langflow-data ensure-backend-volumes ## Start full stack with CPU only
 	@echo "$(YELLOW)Starting OpenRAG with CPU only...$(NC)"
-	$(COMPOSE_CMD) up -d
+	$(COMPOSE_CMD) up -d --build
 	@echo "$(PURPLE)Services started!$(NC)"
 	@echo "   $(CYAN)Backend:$(NC)    http://openrag-backend"
 	@echo "   $(CYAN)Frontend:$(NC)   http://localhost:3000"
diff --git a/docker-compose.yml b/docker-compose.yml
index 004e96f0a..d97a5dd7f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -11,6 +11,10 @@ services:
       - discovery.type=single-node
       - OPENSEARCH_INITIAL_ADMIN_PASSWORD=${OPENSEARCH_PASSWORD}
       - OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g
+    entrypoint:
+      - /bin/bash
+      - -c
+      - "/usr/share/opensearch/opensearch-docker-entrypoint.sh opensearch & /usr/share/opensearch/setup-security.sh; wait"
     # NOTE: do NOT add `extra_hosts: openrag-backend:host-gateway` here.
     # `extra_hosts` writes to /etc/hosts, which libc resolves BEFORE
     # docker DNS — so the alias overrides docker-compose service-name