diff --git a/Dockerfile b/Dockerfile
index 934b8bf..5c767dc 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -107,6 +107,10 @@ ENV PORT=8080
 
 EXPOSE 8080
 
+# The player is stateless and binds an unprivileged port, so it has no reason
+# to run as root. mDNS/SSDP discovery uses unprivileged multicast.
+USER nobody
+
 ENTRYPOINT ["/app/soundtouch-player"]
 
 # soundtouch-web image: transitional alias of soundtouch-player. Built from the
@@ -124,4 +128,6 @@ ENV PORT=8080
 
 EXPOSE 8080
 
+USER nobody
+
 ENTRYPOINT ["/app/soundtouch-web"]