diff --git a/agent/Dockerfile b/agent/Dockerfile
index 70e05a0..93e32a4 100644
--- a/agent/Dockerfile
+++ b/agent/Dockerfile
@@ -8,11 +8,17 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     && rm -rf /var/lib/apt/lists/*
 
 RUN npm install -g @anthropic-ai/claude-code
+RUN useradd --create-home --shell /bin/bash agent && mkdir -p /workspace
 
 WORKDIR /app
 COPY package*.json ./
 RUN npm install --omit=dev
 COPY src ./src
+RUN chown -R agent:agent /app /workspace
+
+# Claude Code refuses to run with bypassPermissions as root — headless/unattended
+# operation needs a non-root user.
+USER agent
 
 RUN git config --global user.email "claude-agent@apps.williamturner.eu" \
     && git config --global user.name "claude-agent" \