diff --git a/flutter/Dockerfile b/flutter/Dockerfile
index 40c1470b..a369e788 100644
--- a/flutter/Dockerfile
+++ b/flutter/Dockerfile
@@ -3,10 +3,13 @@ FROM ghcr.io/cirruslabs/flutter:stable AS builder
 
 WORKDIR /app
 
-COPY pubspec.yaml pubspec.lock* ./
+RUN useradd -m -u 10001 flutteruser
+
+COPY --chown=flutteruser:flutteruser pubspec.yaml pubspec.lock* ./
+USER flutteruser
 RUN flutter pub get
 
-COPY . .
+COPY --chown=flutteruser:flutteruser . .
 
 # Inject API base URL at build time via --dart-define.
 # Default to same-origin /api to avoid mixed-content in HTTPS deployments.