diff --git a/Dockerfile b/Dockerfile
index 070596e..d040982 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -34,12 +34,17 @@ ENV NEXT_TELEMETRY_DISABLED=1
 RUN addgroup --system --gid 1001 nodejs
 RUN adduser --system --uid 1001 nextjs
 
+# su-exec for dropping privileges in entrypoint
+RUN apk add --no-cache su-exec
+
 COPY --from=builder /app/public ./public
 COPY --from=builder /app/content ./content
 COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
 COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
+COPY --chmod=755 docker-entrypoint.sh ./docker-entrypoint.sh
 
-USER nextjs
+# Content dir must be writable for admin saves (ownership fixed at runtime)
+RUN chown -R nextjs:nodejs /app/content
 
 EXPOSE 7211
 
@@ -49,4 +54,6 @@ ENV HOSTNAME="0.0.0.0"
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD wget --no-verbose --tries=1 --spider http://localhost:7211/api/health || exit 1
 
-CMD ["node", "server.js"]
+# Run as root initially so entrypoint can fix bind-mount permissions,
+# then drops to nextjs user via su-exec
+CMD ["./docker-entrypoint.sh"]
diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh
new file mode 100755
index 0000000..5690d4b
--- /dev/null
+++ b/docker-entrypoint.sh
@@ -0,0 +1,11 @@
+#!/bin/sh
+# Ensure the content directory is writable by the nextjs user (UID 1001).
+# This is needed when ./content is bind-mounted from the host.
+
+# Fix ownership of content directory so the app can save config
+if [ -d /app/content ]; then
+  chown -R nextjs:nodejs /app/content 2>/dev/null || true
+fi
+
+# Drop privileges and run the app as nextjs
+exec su-exec nextjs node server.js