diff --git a/Dockerfile b/Dockerfile
index d2e9ad1..8f02c95 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,21 +15,21 @@ RUN apk add --no-cache ca-certificates unzip wget \
 
 FROM alpine:3.20
 
-RUN apk add --no-cache ca-certificates \
- && adduser -D -H -u 10001 pb
+RUN apk add --no-cache ca-certificates
 
 COPY --from=fetch /pb/pocketbase /usr/local/bin/pocketbase
 
 # Schema-as-code: migrations are baked in and auto-applied on serve.
 COPY pb_migrations /pb_migrations
 
-# Persist DB, uploaded files, and any admin-created migrations here. Create it
-# owned by the runtime user so a fresh named volume inherits writable perms.
-RUN mkdir -p /pb_data && chown pb /pb_data
+# Persist DB, uploaded files, and any admin-created migrations here. Runs as root
+# so it can always write the volume Coolify attaches — Coolify's persistent mount
+# is root-owned, and a non-root user hitting it fails with SQLite "unable to open
+# database file (14)".
+RUN mkdir -p /pb_data
 VOLUME ["/pb_data"]
 
 EXPOSE 8090
-USER pb
 
 # Coolify terminates TLS at Traefik; PocketBase listens plain on 8090 behind it.
 ENTRYPOINT ["pocketbase"]