diff --git a/backend/Dockerfile b/backend/Dockerfile
index d245f9a..888e429 100644
--- a/backend/Dockerfile
+++ b/backend/Dockerfile
@@ -30,10 +30,9 @@ RUN groupadd -r agent && useradd -r -g agent -d /app -s /bin/bash agent && \
 # Generate OCI Terraform resource reference at build time
 RUN python gen_tf_reference.py || echo "WARN: tf reference generation skipped (terraform init may need network)"
 
-# Entrypoint: fix /data ownership then exec as agent user
-RUN printf '#!/bin/bash\nchown -R agent:agent /data 2>/dev/null || true\nexec gosu agent "$@"\n' > /entrypoint.sh && \
-    chmod +x /entrypoint.sh && \
-    apt-get update && apt-get install -y --no-install-recommends gosu && rm -rf /var/lib/apt/lists/*
+# Entrypoint: fix /data ownership then drop to agent user (no gosu needed)
+RUN printf '#!/bin/bash\nchown -R agent:agent /data 2>/dev/null || true\nexec runuser -u agent -- "$@"\n' > /entrypoint.sh && \
+    chmod +x /entrypoint.sh
 
 VOLUME /data
 ENTRYPOINT ["/entrypoint.sh"]