diff --git a/Dockerfile b/Dockerfile
index f41759013..8b3346acc 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -50,10 +50,14 @@ RUN apk upgrade --no-cache && \
     rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npx && \
     addgroup --system --gid 1001 nodejs && \
     adduser --system --uid 1001 nextjs
+# The app stays root's and read-only for the runtime user, so a bug that
+# lets it write a file can't replace server.js or a bundle and run code on
+# the next start. It writes only to Next's cache and the data dirs.
 COPY --from=builder /app/public ./public
-COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
-COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
-RUN mkdir -p /app/data/settings /app/data/admin /app/data/admin-state /app/data/telemetry && chown -R nextjs:nodejs /app/data
+COPY --from=builder /app/.next/standalone ./
+COPY --from=builder /app/.next/static ./.next/static
+RUN mkdir -p /app/.next/cache /app/data/settings /app/data/admin /app/data/admin-state /app/data/telemetry && \
+    chown -R nextjs:nodejs /app/.next/cache /app/data
 USER nextjs
 EXPOSE 3000
 ENV PORT=3000