diff --git a/services/control-plane/Dockerfile b/services/control-plane/Dockerfile
index a98383a..581d7ad 100644
--- a/services/control-plane/Dockerfile
+++ b/services/control-plane/Dockerfile
@@ -20,4 +20,5 @@ ENV RUNTIME_PATH=/opt/homelab
 ENV PYTHONUNBUFFERED=1
 
 # Default command (will be overridden in docker-compose)
+USER homelab
 CMD ["python", "src/operator_ui.py"]
diff --git a/services/control-plane/docker-compose.yml b/services/control-plane/docker-compose.yml
index 7234bfa..4bea06f 100644
--- a/services/control-plane/docker-compose.yml
+++ b/services/control-plane/docker-compose.yml
@@ -56,6 +56,9 @@ services:
   executor:
     build: .
     container_name: control-plane-executor
+    user: "1000:1000"
+    group_add:
+      - "999"
     command: python src/executor.py
     volumes:
       - /opt/homelab:/opt/homelab