diff --git a/Dockerfile b/Dockerfile
index 92be5d7..b958143 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -40,6 +40,10 @@ COPY --from=backend-builder /app/dist ./dist
 # Copy frontend build into public/ (backend will serve it as static files)
 COPY --from=frontend-builder /frontend/dist ./public
 
+# Run as non-root for defense in depth — node:alpine ships a "node" user (uid 1000)
+RUN chown -R node:node /app
+USER node
+
 EXPOSE 3579
 
 ENV NODE_ENV=production