diff --git a/Dockerfile b/Dockerfile
index 64ae7c5..aa8a672 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -26,9 +26,15 @@ FROM alpine:latest
 
 WORKDIR /app
 
+# Create non-root user
+RUN addgroup -S appgroup && adduser -S appuser -G appgroup
+
 # Copy binary from builder (templates are embedded via go:embed)
 COPY --from=builder /build/server .
 
+# Switch to non-root user
+USER appuser
+
 # Expose port
 EXPOSE 8080