diff --git a/backend/Dockerfile b/backend/Dockerfile
index 63f1fb6..eab332b 100644
--- a/backend/Dockerfile
+++ b/backend/Dockerfile
@@ -20,11 +20,12 @@ RUN chmod +x gradlew && ./gradlew :backend:bootJar --no-daemon -x test
 
 # 3. Runtime: not root; data in /app/data (volume)
 FROM eclipse-temurin:21-jre-alpine
-RUN apk add --no-cache curl && addgroup -S mail && adduser -S -G mail mail \
-    && mkdir -p /app/data/attachments /app/data/dkim-keys && chown -R mail:mail /app/data
+# own user: "mail" already exists in Alpine (uid 8, group 12) — addgroup mail fails
+RUN apk add --no-cache curl && addgroup -S -g 10001 app && adduser -S -u 10001 -G app app \
+    && mkdir -p /app/data/attachments /app/data/dkim-keys && chown -R app:app /app/data
 WORKDIR /app
 COPY --from=build /app/backend/build/libs/*.jar app.jar
-USER mail
+USER app
 ENV MAIL_ATTACHMENTS_DIR=/app/data/attachments DKIM_KEYS_DIR=/app/data/dkim-keys
 EXPOSE 8080 3025
 HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
diff --git a/docker-compose.jambotron.yml b/docker-compose.jambotron.yml
index 7be8a75..73faa89 100644
--- a/docker-compose.jambotron.yml
+++ b/docker-compose.jambotron.yml
@@ -17,7 +17,7 @@ services:
         for name in DB_PASSWORD JWT_SECRET; do
           [ -s /secrets/$$name ] || head -c 48 /dev/urandom | base64 | tr -dc 'A-Za-z0-9' > /secrets/$$name
         done
-        # postgres reads it as uid 70, the app as "mail" — readable inside these containers only
+        # postgres reads it as uid 70, the app as uid 10001 — readable inside these containers only
         chmod 644 /secrets/DB_PASSWORD /secrets/JWT_SECRET
     volumes:
       - secrets:/secrets