diff --git a/.dockerignore b/.dockerignore
index d44412a..180beb7 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -32,4 +32,3 @@ README.md
 icons/
 templates/
 ca_profile.xml
-patch-hermes-simplex.sh
diff --git a/.hadolint.yaml b/.hadolint.yaml
new file mode 100644
index 0000000..bf873d0
--- /dev/null
+++ b/.hadolint.yaml
@@ -0,0 +1,3 @@
+ignored:
+  - DL3008   # Pin versions in apt-get install (pinned via base image SHA)
+  - DL3059   # Multiple consecutive RUN instructions (keeps layers cacheable)
diff --git a/Dockerfile b/Dockerfile
index 868854a..a6ced9c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -17,13 +17,16 @@ RUN apt-get update && \
     rm -rf /var/lib/apt/lists/*
 
 # Install gosu — Ubuntu equivalent of Alpine's su-exec (static Go binary)
+# SHA256 verification: download checksum file, filter for gosu-amd64,
+# rewrite the path to match the actual binary location, then verify.
 RUN set -eux; \
     curl -fsSLo /usr/local/bin/gosu \
       "https://github.com/tianon/gosu/releases/download/1.17/gosu-amd64"; \
     curl -fsSLo /tmp/gosu.SHA256SUMS \
       "https://github.com/tianon/gosu/releases/download/1.17/SHA256SUMS"; \
-    grep 'gosu-amd64$' /tmp/gosu.SHA256SUMS | sed 's|  gosu-amd64$|  /usr/local/bin/gosu|' | sha256sum -c -; \
-    rm -f /tmp/gosu.SHA256SUMS; \
+    grep 'gosu-amd64$' /tmp/gosu.SHA256SUMS | sed 's|  gosu-amd64$|  /usr/local/bin/gosu|' > /tmp/gosu-checksum.txt; \
+    sha256sum -c /tmp/gosu-checksum.txt; \
+    rm -f /tmp/gosu.SHA256SUMS /tmp/gosu-checksum.txt; \
     chmod +x /usr/local/bin/gosu
 
 # Create generic user — UID/GID are overridden at runtime via PUID/PGID
diff --git a/entrypoint.sh b/entrypoint.sh
index f697f28..3b2f99f 100644
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -10,12 +10,26 @@ PUID="${PUID:-99}"
 PGID="${PGID:-100}"
 echo "[entrypoint] Using PUID=$PUID PGID=$PGID"
 
-# Recreate the 'simplex' user/group with the runtime-requested IDs
-if getent group simplex >/dev/null 2>&1; then groupdel simplex 2>/dev/null || true; fi
-if getent passwd simplex >/dev/null 2>&1; then userdel simplex 2>/dev/null || true; fi
-groupadd --system --gid "$PGID" simplex 2>/dev/null || \
-  groupadd --system simplex 2>/dev/null
-useradd --system --no-log-init -g simplex -u "$PUID" --create-home simplex
+# Ensure the 'simplex' user/group matches the runtime-requested IDs.
+# Only recreate if the existing user has a different UID/GID.
+if getent passwd simplex >/dev/null 2>&1; then
+    EXISTING_UID=$(id -u simplex 2>/dev/null)
+    EXISTING_GID=$(id -g simplex 2>/dev/null)
+    if [ "$EXISTING_UID" = "$PUID" ] && [ "$EXISTING_GID" = "$PGID" ]; then
+        echo "[entrypoint] simplex user already has PUID=$PUID PGID=$PGID — no change needed"
+    else
+        echo "[entrypoint] Recreating simplex user (UID $EXISTING_UID → $PUID, GID $EXISTING_GID → $PGID)..."
+        if getent group simplex >/dev/null 2>&1; then groupdel simplex 2>/dev/null || true; fi
+        if getent passwd simplex >/dev/null 2>&1; then userdel simplex 2>/dev/null || true; fi
+        groupadd --system --gid "$PGID" simplex 2>/dev/null || \
+          groupadd --system simplex 2>/dev/null
+        useradd --system --no-log-init -g simplex -u "$PUID" --create-home simplex
+    fi
+else
+    groupadd --system --gid "$PGID" simplex 2>/dev/null || \
+      groupadd --system simplex 2>/dev/null
+    useradd --system --no-log-init -g simplex -u "$PUID" --create-home simplex
+fi
 
 # ── Graceful shutdown handler ──────────────────────────────────────
 shutdown() {