diff --git a/Dockerfile b/Dockerfile
index ac89cd6..5076c6f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -7,6 +7,7 @@ ENV PYTHONDONTWRITEBYTECODE 1
 ENV PYTHONUNBUFFERED 1
 ENV PYTHONPATH /app
 ENV UV_CACHE_DIR /app/.cache/uv
+ENV UV_VENV_DIRECTORY /app/.venv
 
 # Set work directory
 WORKDIR /app
@@ -26,11 +27,14 @@ RUN apt-get update && apt-get install -y \
 
 COPY --from=uv /usr/local/bin/uv /usr/local/bin/uv
 
-# Create cache directory with proper permissions
-RUN mkdir -p /app/.cache/uv && chmod -R 777 /app/.cache
+# Create directories with proper permissions
+RUN mkdir -p /app/.cache/uv && \
+    mkdir -p /app/.venv && \
+    chmod -R 777 /app/.cache && \
+    chmod -R 777 /app/.venv
 
 RUN which uv \
-    && uv sync --no-dev
+    && uv pip install --system --no-cache --no-deps -e .
 
 # Copy project
 COPY . .
@@ -48,11 +52,30 @@ RUN mkdir -p /app/data && chmod 777 /app/data
 
 FROM python:3.12-slim
 
+ENV PYTHONDONTWRITEBYTECODE 1
+ENV PYTHONUNBUFFERED 1
+ENV PYTHONPATH /app
+ENV UV_CACHE_DIR /app/.cache/uv
+ENV UV_VENV_DIRECTORY /app/.venv
+
 COPY --from=uv /usr/local/bin/uv /usr/local/bin/uv
 COPY --from=dev /app /app
 
 WORKDIR /app
+
+# Ensure proper permissions in the final stage
+RUN chmod -R 777 /app/.cache && \
+    chmod -R 777 /app/.venv && \
+    chmod -R 777 /app/data
+
+# Create a non-root user
+RUN useradd -m -u 1000 appuser && \
+    chown -R appuser:appuser /app
+
+USER appuser
+
 # Expose port 8000
 EXPOSE 8000
+
 # Run the application
 CMD ["uv", "run", "gunicorn", "--chdir", "/app", "core.wsgi:application", "--bind", "0.0.0.0:8000"]