diff --git a/Dockerfile b/Dockerfile
index e40de86..bf26eb6 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -14,4 +14,6 @@ RUN cargo build --target x86_64-unknown-linux-musl --release --locked
 FROM gcr.io/distroless/static:latest
 COPY --from=builder /build/target/x86_64-unknown-linux-musl/release/valfisk /valfisk
 
+USER nonroot
+
 CMD ["/valfisk"]