diff --git a/deploy/production/compose.yaml b/deploy/production/compose.yaml
index 989e44c..a30ed73 100644
--- a/deploy/production/compose.yaml
+++ b/deploy/production/compose.yaml
@@ -27,6 +27,9 @@ services:
 
   server:
     image: "${RVBOX_SERVER_IMAGE:?set RVBOX_SERVER_IMAGE to a pinned rvbox-server image}"
+    # The init container is the only root process. Its exact 65532 ownership
+    # setup lets the long-lived server run without host/container root power.
+    user: "65532:65532"
     restart: unless-stopped
     command: ["--config", "/etc/rvbox/server.toml"]
     read_only: true
diff --git a/test/windowsnative/native_fixture_test.go b/test/windowsnative/native_fixture_test.go
index b48edab..881b6c9 100644
--- a/test/windowsnative/native_fixture_test.go
+++ b/test/windowsnative/native_fixture_test.go
@@ -91,6 +91,7 @@ func TestProductionComposeAssets_HP_OPS_01(t *testing.T) {
 		"RVBOX_SERVER_CONFIG:-./server.toml",
 		"RVBOX_HTTPS_BIND:-0.0.0.0",
 		"nginx@sha256:65645c7bb6a0661892a8b03b89d0743208a18dd2f3f17a54ef4b76fb8e2f2a10",
+		"user: \"65532:65532\"",
 		"nofile:", "soft: 65536", "hard: 65536",
 		"condition: service_completed_successfully",
 		"condition: service_healthy",