diff --git a/Dockerfile b/Dockerfile
index 186cd1d..9bb9d59 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -5,7 +5,12 @@ WORKDIR /app
 COPY requirements.txt .
 
 RUN pip install --no-cache-dir -r requirements.txt && \
-    apt-get update && apt-get install -y --no-install-recommends curl gosu && \
+    # Drop pip/setuptools from the runtime image: not needed to run the app, and
+    # setuptools vendors jaraco.context which trips vulnerability scanners.
+    pip uninstall -y pip setuptools && \
+    # curl is for the HEALTHCHECK. gosu is intentionally omitted — entrypoint.sh
+    # uses setpriv (util-linux) to avoid pulling in a Go binary.
+    apt-get update && apt-get install -y --no-install-recommends curl && \
     rm -rf /var/lib/apt/lists/*
 
 # Labels
diff --git a/entrypoint.sh b/entrypoint.sh
index 7d35d2b..3807292 100644
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -6,4 +6,7 @@ set -e
 mkdir -p /app/data
 chown -R proxui:proxui /app/data
 
-exec gosu proxui "$@"
+# Drop from root to the proxui user with setpriv (util-linux, already in the
+# base image) instead of gosu, which is a static Go binary that drags Go stdlib
+# CVEs into vulnerability scans despite not using those code paths.
+exec setpriv --reuid proxui --regid proxui --init-groups "$@"