diff --git a/Dockerfile b/Dockerfile
index 30aace9..ba114e2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -130,9 +130,12 @@ ENV PATH=${PATH}:/nix/var/nix/profiles/default/bin
 COPY --from=runsvinit /usr/local/bin/runsvinit /usr/local/bin/runsvinit
 COPY --from=builder /usr/local/bin/smallwebwaf /usr/local/bin/smallwebwaf
 
+# 65532 is above the uids Ubuntu keeps for system users, which end at
+# 999; useradd warns about it unless --key raises that end for this call.
 RUN groupadd --system --gid 65532 smallwebwaf \
-    && useradd --system --uid 65532 --gid smallwebwaf --no-create-home \
-        --shell /usr/sbin/nologin smallwebwaf
+    && useradd --system --key SYS_UID_MAX=65532 --uid 65532 \
+        --gid smallwebwaf --no-create-home --shell /usr/sbin/nologin \
+        smallwebwaf
 
 # runsvinit starts runit's runsvdir on /etc/service, where Ubuntu's sv
 # looks too.