diff --git a/Dockerfile b/Dockerfile
index a81ee427c..8398b661a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -19,15 +19,15 @@ RUN apk add --no-cache gettext tar bzip2 curl openjdk21 \
 # --- Runtime stages per architecture ---
 
 FROM debian:bookworm-slim AS runtime-amd64
-RUN apt-get update && apt-get install -y --no-install-recommends openjdk-17-jre-headless fonts-dejavu iproute2 \
+RUN apt-get update && apt-get install -y --no-install-recommends openjdk-17-jre-headless fonts-dejavu iproute2 gosu \
     && apt-get clean && rm -rf /var/lib/apt/lists/*
 
 FROM debian:bookworm-slim AS runtime-arm64
-RUN apt-get update && apt-get install -y --no-install-recommends openjdk-17-jre-headless fonts-dejavu iproute2\
+RUN apt-get update && apt-get install -y --no-install-recommends openjdk-17-jre-headless fonts-dejavu iproute2 gosu \
     && apt-get clean && rm -rf /var/lib/apt/lists/*
 
 FROM debian:bookworm-slim AS runtime-arm
-RUN apt-get update && apt-get install -y --no-install-recommends openjdk-17-jre-headless fonts-dejavu iproute2 \
+RUN apt-get update && apt-get install -y --no-install-recommends openjdk-17-jre-headless fonts-dejavu iproute2 gosu \
     && apt-get clean && rm -rf /var/lib/apt/lists/*
 
 # Select runtime based on target architecture
diff --git a/docker/rootfs/startapp.sh b/docker/rootfs/startapp.sh
index 143e3fc4e..587490e65 100644
--- a/docker/rootfs/startapp.sh
+++ b/docker/rootfs/startapp.sh
@@ -78,5 +78,5 @@ JAVAOPTS="-Djava.net.preferIPv4Stack=false -Djava.library.path=${I2P}:${I2P}/lib
 mkdir -p "$HOME/.i2p" && chown -R i2p:i2p "$HOME/.i2p"
 
 # Execute the Java application with the constructed classpath and options
-# The `exec` command replaces the shell with the Java process, ensuring that it receives signals directly and can shut down gracefully.
-exec runuser -u i2p -- java -cp "${CLASSPATH}" ${JAVAOPTS} ${JAVA17OPTS} net.i2p.router.RouterLaunch
+# gosu handles signal forwarding and privilege dropping
+gosu i2p java -cp "${CLASSPATH}" ${JAVAOPTS} ${JAVA17OPTS} net.i2p.router.RouterLaunch