diff --git a/app/Dockerfile b/app/Dockerfile
index ee89588..08607cb 100644
--- a/app/Dockerfile
+++ b/app/Dockerfile
@@ -2,5 +2,8 @@ FROM python:3.12-slim
 RUN pip install --no-cache-dir fastapi "uvicorn[standard]" python-multipart gspread
 WORKDIR /app
 COPY . /app
-RUN mkdir -p /app/static/img
+RUN mkdir -p /app/static/img && useradd -r -u 10001 app
+# Unprivileged: nothing here needs root, and the process is the one thing on
+# this box that takes unauthenticated input from the internet.
+USER 10001
 CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "8000"]
diff --git a/docker-compose.yml b/docker-compose.yml
index 59c2473..91d747e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -17,6 +17,13 @@ services:
     build:
       context: ./app
     container_name: scout-website
+    read_only: true
+    tmpfs:
+      - /tmp
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
     restart: unless-stopped
     logging:
       driver: json-file