diff --git a/Dockerfile b/Dockerfile
index 97eb622..d248482 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -12,12 +12,15 @@ COPY recorder.conf /etc/default/recorder.conf
 COPY recorder-health.sh /usr/local/sbin/recorder-health.sh
 
 ENV VERSION=$recorder_version
+ENV EUID=9999
 
 RUN apk add --no-cache --virtual .build-deps \
         curl-dev libconfig-dev make \
-        gcc musl-dev mosquitto-dev wget \
+        gcc musl-dev mosquitto-dev shadow wget \
     && apk add --no-cache \
         libcurl libconfig-dev mosquitto-dev lmdb-dev libsodium-dev lua5.2-dev \
+    && groupadd -g $EUID appuser \
+    && useradd -r -u $EUID -s "/bin/sh" -g appuser appuser \
     && mkdir -p /usr/local/source \
     && cd /usr/local/source \
     && wget https://github.com/owntracks/recorder/archive/$VERSION.tar.gz \
diff --git a/entrypoint.sh b/entrypoint.sh
index 68ccc87..eec6147 100644
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -1,5 +1,12 @@
 #!/bin/sh
 
+# If running as root (first invocation), fix mountpoint permissions
+# and re-run this script as appuser.
+if [[ $(id -u) -eq 0 ]]; then
+  chown -R appuser:appuser /store /config
+  exec su -c "$0" appuser
+fi
+
 # Load Default recorder.conf if not available
 if [ ! -f /config/recorder.conf ]; then
 	  cp /etc/default/recorder.conf /config/recorder.conf