diff --git a/Dockerfile b/Dockerfile
index 98adf43..d513f1e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,23 +1,30 @@
-FROM eclipse-temurin:21-alpine as jre-build
+FROM eclipse-temurin:21-alpine AS jre-build
 
-RUN $JAVA_HOME/bin/jlink \
+RUN "$JAVA_HOME"/bin/jlink \
          --add-modules java.logging,java.xml,java.sql \
          --strip-debug \
          --no-man-pages \
          --no-header-files \
          --output /javaruntime
 
-FROM alpine:latest
+FROM alpine:3.20
 ENV JAVA_HOME=/opt/java/openjdk
 ENV PATH "${JAVA_HOME}/bin:${PATH}"
+
+RUN addgroup -S -g 1001 zpa-cli && adduser -S -D -u 1001 -G zpa-cli zpa-cli
+
 COPY --from=jre-build /javaruntime $JAVA_HOME
 
 ADD build/distributions/zpa-cli-*.tar /opt/
 
-RUN mv /opt/zpa-cli-*/ /opt/zpa-cli/
+RUN set -eux; \
+    mv /opt/zpa-cli-*/ /opt/zpa-cli/; \
+    chown -R zpa-cli:zpa-cli /opt
 
 ENV PATH=/opt/zpa-cli/bin:$PATH
 
+USER zpa-cli
+
 WORKDIR /src
 
 ENTRYPOINT ["zpa-cli"]