diff --git a/.github/workflows/docksec.yml b/.github/workflows/docksec.yml
index 3b4a2d3..6682e31 100644
--- a/.github/workflows/docksec.yml
+++ b/.github/workflows/docksec.yml
@@ -5,10 +5,12 @@ on:
     branches: [master]
     paths:
       - 'Dockerfile'
+      - '**/Dockerfile'
       - '.github/workflows/docksec.yml'
   pull_request:
     paths:
       - 'Dockerfile'
+      - '**/Dockerfile'
       - '.github/workflows/docksec.yml'
   schedule:
     - cron: '0 6 * * 1'
diff --git a/Dockerfile b/Dockerfile
index 4bb22d4..77f6325 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,32 +1,33 @@
 ARG PYTHON_VERSION=3.10
 FROM python:${PYTHON_VERSION}-slim
 
-RUN apt-get update && apt-get install -y \
-    libsodium23 \
-    wget \
-    build-essential \
-    libffi-dev \
-    curl
+COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /uvx /bin/
+
+RUN useradd --create-home --uid 10001 app \
+    && mkdir /app \
+    && chown app:app /app
 
 WORKDIR /app
 
-ENV PIP_NO_CACHE_DIR=false \
-    PIP_DISABLE_PIP_VERSION_CHECK=on \
+ENV PIP_DISABLE_PIP_VERSION_CHECK=on \
     PIP_DEFAULT_TIMEOUT=10 \
     PYTHONUNBUFFERED=1 \
     PYTHONDONTWRITEBYTECODE=1
 
-# Install uv
-RUN pip install uv
+USER 10001
 
-COPY pyproject.toml uv.lock* README.md /app/
+COPY --chown=app:app pyproject.toml uv.lock* README.md /app/
 
 RUN uv sync --extra dev
 
 ENV PATH="/app/.venv/bin:$PATH"
 
-COPY djangoapi_guard/ /app/djangoapi_guard/
-COPY tests/ /app/tests/
-COPY examples/ /app/examples/
+COPY --chown=app:app djangoapi_guard/ /app/djangoapi_guard/
+COPY --chown=app:app tests/ /app/tests/
+COPY --chown=app:app examples/ /app/examples/
 
 RUN mkdir -p /app/data/ipinfo
+
+# Probes the app service on port 8000. Any HTTP answer counts as alive; a refused connection or a timeout fails.
+HEALTHCHECK --interval=10s --timeout=5s --start-period=20s --retries=3 \
+    CMD ["python", "-c", "import urllib.request, urllib.error\ntry:\n    urllib.request.urlopen('http://127.0.0.1:8000/', timeout=3)\nexcept urllib.error.HTTPError:\n    pass"]
diff --git a/compose.yml b/compose.yml
index 9121363..9cf0f4e 100644
--- a/compose.yml
+++ b/compose.yml
@@ -27,6 +27,8 @@ services:
           PYTHON_VERSION: ${PYTHON_VERSION:-3.10}
       image: djapi-guard-py${PYTHON_VERSION:-3.10}
       command: pytest -v --cov=.
+      healthcheck:
+        disable: true
       environment:
         - REDIS_URL=redis://redis:6379
         - REDIS_PREFIX=${REDIS_PREFIX:-"test:djangoapi_guard:"}
diff --git a/examples/advanced/Dockerfile b/examples/advanced/Dockerfile
index 10095ea..fd2a4ba 100644
--- a/examples/advanced/Dockerfile
+++ b/examples/advanced/Dockerfile
@@ -18,7 +18,7 @@ RUN uv venv .venv && \
 FROM python:3.12-slim
 
 RUN groupadd --system guard && \
-    useradd --system --gid guard --create-home guard
+    useradd --system --uid 10001 --gid guard --create-home guard
 
 WORKDIR /app
 
@@ -33,8 +33,12 @@ ENV PATH="/app/.venv/bin:$PATH" \
     PYTHONUNBUFFERED=1 \
     PYTHONDONTWRITEBYTECODE=1
 
-USER guard
+USER 10001
 
 EXPOSE 8000
 
+# Same probe as the compose services: /health must answer 2xx.
+HEALTHCHECK --interval=10s --timeout=5s --start-period=20s --retries=3 \
+    CMD ["python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health', timeout=3)"]
+
 CMD ["gunicorn", "-c", "gunicorn.conf.py", "advanced_project.wsgi:application"]
diff --git a/examples/simple/Dockerfile b/examples/simple/Dockerfile
index 1ba3da5..293daa0 100644
--- a/examples/simple/Dockerfile
+++ b/examples/simple/Dockerfile
@@ -1,17 +1,22 @@
 FROM python:3.12-slim
 
-RUN apt-get update && apt-get install -y \
-    build-essential \
-    libffi-dev \
-    && rm -rf /var/lib/apt/lists/*
+RUN useradd --create-home --uid 10001 app \
+    && mkdir /app \
+    && chown app:app /app
 
 WORKDIR /app
 
 COPY requirements.txt /app/
 RUN pip install --no-cache-dir -r requirements.txt
 
-COPY . /app/
+USER 10001
+
+COPY --chown=app:app . /app/
 
 EXPOSE 8000
 
+# Probes port 8000. Any HTTP answer counts as alive; a refused connection or a timeout fails.
+HEALTHCHECK --interval=10s --timeout=5s --start-period=20s --retries=3 \
+    CMD ["python", "-c", "import urllib.request, urllib.error\ntry:\n    urllib.request.urlopen('http://127.0.0.1:8000/', timeout=3)\nexcept urllib.error.HTTPError:\n    pass"]
+
 CMD ["gunicorn", "example_project.wsgi:application", "--bind", "0.0.0.0:8000", "--reload"]