diff --git a/Dockerfile b/Dockerfile
index 3860358..1142681 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -39,10 +39,19 @@ COPY --from=build-fe /app/frontend/dist server/public
 
 # Data volume for SQLite
 RUN mkdir -p /app/server/data
+
+# Non-root user
+RUN groupadd --system botfights && useradd --system --gid botfights botfights \
+    && chown -R botfights:botfights /app
+USER botfights
+
 VOLUME /app/server/data
 
 ENV NODE_ENV=production
 ENV PORT=9100
 EXPOSE 9100
 
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+  CMD node -e "fetch('http://localhost:9100/api/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"
+
 CMD ["node", "--max-old-space-size=256", "server/dist/index.js"]