diff --git a/Dockerfile b/Dockerfile
index be438c0ba..b40ca3a79 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -63,6 +63,11 @@ COPY --from=build /rails /rails
 COPY --from=beamer /home/beamer/bin/beamer.so /rails/bin/lib/beamer.so
 COPY --from=beamer /usr/local/bin/beamer /rails/bin/beamer
 
+# Run and own only the runtime files as a non-root user for security
+RUN useradd rails --create-home --shell /bin/bash && \
+    chown -R rails:rails db log storage tmp
+USER rails:rails
+
 # Entrypoint prepares the database.
 ENTRYPOINT ["/rails/bin/docker-entrypoint"]