diff --git a/Dockerfile b/Dockerfile
index 9e93f08..4230740 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -31,9 +31,9 @@ RUN upx -v -9 build/openfsd
 # Final distroless image
 FROM gcr.io/distroless/static-debian12
 
+USER nonroot:nonroot
+
 WORKDIR /app
 COPY --from=build --chown=nonroot:nonroot /go/src/openfsd/build /app
 
-USER nonroot:nonroot
-
 ENTRYPOINT ["/app/openfsd"]