diff --git a/Dockerfile b/Dockerfile
index 0e22ff2..cb998b9 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -83,14 +83,15 @@ RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /neoirc-cli ./cmd/neoir
 # stage's chain and nothing else.
 # alpine:3.21, 2026-02-26
 FROM alpine@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709
-RUN apk add --no-cache ca-certificates \
-    && addgroup -S neoirc && adduser -S neoirc -G neoirc \
-    && mkdir -p /var/lib/neoirc \
-    && chown neoirc:neoirc /var/lib/neoirc
+# su-exec 0.2-r3, 2026-11-10
+RUN apk add --no-cache ca-certificates su-exec=0.2-r3 \
+    && addgroup -S neoirc && adduser -S neoirc -G neoirc
 COPY --from=builder /neoircd /usr/local/bin/neoircd
+COPY deploy/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
 
-USER neoirc
+# No USER: the entrypoint starts as root to give /var/lib/neoirc to neoirc,
+# then runs neoircd as neoirc.
 EXPOSE 8080 6667
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
     CMD wget -qO- http://localhost:8080/.well-known/healthcheck.json || exit 1
-ENTRYPOINT ["neoircd"]
+ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
diff --git a/README.md b/README.md
index d05ce68..d0ba29a 100644
--- a/README.md
+++ b/README.md
@@ -1781,13 +1781,17 @@ NEOIRC_HASHCASH_BITS=20
 the linter first and stops when either fails. The image:
 
 - is Alpine with the `neoircd` binary and CA certificates;
-- runs as the user `neoirc`;
+- runs `neoircd` as the user `neoirc`;
 - exposes ports 8080 and 6667;
 - keeps its database in `/var/lib/neoirc`;
 - has a `HEALTHCHECK` that calls `/.well-known/healthcheck.json` every 30
   seconds.
 
-Run it with a volume for the database and the settings as environment variables:
+The image prepares `/var/lib/neoirc` itself on every start. It creates the
+directory, gives it to `neoirc` and then runs `neoircd` as `neoirc`.
+
+Run it with a named volume for the database and the settings as environment
+variables:
 
 ```bash
 docker run -d --name neoirc \
@@ -1798,6 +1802,17 @@ docker run -d --name neoirc \
   neoirc
 ```
 
+A host directory works the same way in place of the named volume:
+
+```bash
+docker run -d --name neoirc \
+  -p 8080:8080 -p 6667:6667 \
+  -v /srv/neoirc:/var/lib/neoirc \
+  -e SERVER_NAME="My Server" \
+  -e MOTD="Welcome!" \
+  neoirc
+```
+
 ### Reverse proxy
 
 Run the server behind a reverse proxy that terminates TLS. The server itself
diff --git a/deploy/docker-entrypoint.sh b/deploy/docker-entrypoint.sh
new file mode 100755
index 0000000..616076c
--- /dev/null
+++ b/deploy/docker-entrypoint.sh
@@ -0,0 +1,10 @@
+#!/bin/sh
+# deploy/docker-entrypoint.sh: the image's ENTRYPOINT, run as root. A host
+# directory mounted at /var/lib/neoirc keeps the host's owner, so this gives
+# it to neoirc before running neoircd as neoirc.
+set -eu
+
+mkdir -p /var/lib/neoirc
+chown -R neoirc:neoirc /var/lib/neoirc
+chmod 0700 /var/lib/neoirc
+exec su-exec neoirc neoircd "$@"