diff --git a/Dockerfile b/Dockerfile
index 730665d..796f43b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,10 +4,13 @@ LABEL org.opencontainers.image.description="Self-contained vSeeBox inventory and
 WORKDIR /app
 COPY package.json server.mjs ./
 COPY public ./public
-RUN mkdir -p /data && chown -R node:node /app /data
-ENV PORT=3000 DATA_DIR=/data NODE_ENV=production
-USER node
+COPY vboxstock-entrypoint.sh /usr/local/bin/vboxstock-entrypoint
+RUN apk add --no-cache su-exec \
+    && chmod +x /usr/local/bin/vboxstock-entrypoint \
+    && mkdir -p /data
+ENV PORT=3000 DATA_DIR=/data NODE_ENV=production PUID=99 PGID=100
 EXPOSE 3000
 VOLUME ["/data"]
 HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 CMD wget -q -O /dev/null http://127.0.0.1:3000/api/health || exit 1
+ENTRYPOINT ["/usr/local/bin/vboxstock-entrypoint"]
 CMD ["node", "server.mjs"]
diff --git a/README.md b/README.md
index c6a522b..8081d45 100644
--- a/README.md
+++ b/README.md
@@ -76,13 +76,15 @@ docker run -d \
   --restart unless-stopped \
   -p 3000:3000 \
   -e TZ=America/New_York \
+  -e PUID=99 \
+  -e PGID=100 \
   -v /your/persistent/path:/data \
   ghcr.io/mfwadejr/vboxstock:latest
 ```
 
 Open `http://YOUR-SERVER-IP:3000`, sign in with the initial credentials above, and change the password when prompted.
 
-The host path mounted at `/data` is essential. Removing the container is safe when this mount remains intact; running without a persistent mount means the database can be lost when the container is replaced.
+The host path mounted at `/data` is essential. Removing the container is safe when this mount remains intact; running without a persistent mount means the database can be lost when the container is replaced. `PUID` and `PGID` determine which host user and group own the mounted data. The defaults are Unraid's `nobody:users` IDs, `99:100`.
 
 ## Docker Compose
 
@@ -110,8 +112,10 @@ Use the included `vboxstock-unraid.xml` template or create a container with thes
 | Container data path | `/data` |
 | Suggested Unraid host path | `/mnt/user/appdata/vboxstock` |
 | Network mode | `bridge` |
+| PUID | `99` |
+| PGID | `100` |
 
-Open the container's WebUI after installation. Updates can be applied with **Force Update** or through the CA Auto Update Applications plugin.
+Open the container's WebUI after installation. Updates can be applied with **Force Update** or through the CA Auto Update Applications plugin. At startup, the container creates `/data/backups`, applies the configured `PUID` and `PGID` ownership to `/data`, and then runs the application with those IDs.
 
 ## Data and backups
 
@@ -120,6 +124,8 @@ vBoxStock uses SQLite and does not require MySQL, PostgreSQL, Redis, or another
 - `/data/vboxstock.db` — active application database
 - `/data/backups/` — locally retained database snapshots
 
+`/data` is the path inside the container. When `/mnt/user/appdata/vboxstock` is mapped directly to `/data`, the Unraid host folder contains `vboxstock.db` and `backups/`; it does not contain another nested folder named `data`.
+
 The Admin page can create a transactionally consistent snapshot, download it to another device, restore a local snapshot, or upload and restore a downloaded copy. A pre-restore snapshot is created automatically before the active database is replaced.
 
 Backups contain customer information and password hashes. Store downloaded copies securely. Restoring a database also restores the user accounts contained in that backup and signs out every active session. An older backup without user accounts starts the first-login `admin` / `admin` setup flow.
@@ -143,6 +149,7 @@ docker exec -e RESET_ADMIN_PASSWORD=NewPassword123 -it vboxstock node server.mjs
 - Image: `ghcr.io/mfwadejr/vboxstock:latest`
 - Application port: `3000/tcp`
 - Persistent volume: `/data`
+- Runtime ownership: configurable with `PUID` and `PGID` (`99:100` by default)
 - Health check: `GET /api/health`
 - Runtime: Node.js 22
 - Database: SQLite
diff --git a/docker-compose.yml b/docker-compose.yml
index 65ceaa6..6509dc0 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -9,3 +9,5 @@ services:
       - ./data:/data
     environment:
       - TZ=America/New_York
+      - PUID=99
+      - PGID=100
diff --git a/package.json b/package.json
index 5732503..1b29e04 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "vboxstock",
-  "version": "3.0.0",
+  "version": "3.0.1",
   "private": true,
   "type": "module",
   "engines": { "node": ">=22.13.0" },
diff --git a/vboxstock-unraid.xml b/vboxstock-unraid.xml
index 65b2ddf..837cbd2 100644
--- a/vboxstock-unraid.xml
+++ b/vboxstock-unraid.xml
@@ -6,5 +6,7 @@
   <Category>Tools:</Category><WebUI>http://[IP]:[PORT:3000]/</WebUI><TemplateURL></TemplateURL><Icon></Icon>
   <Config Name="Web UI Port" Target="3000" Default="3000" Mode="tcp" Description="vBoxStock web interface" Type="Port" Display="always" Required="true" Mask="false">3000</Config>
   <Config Name="App Data" Target="/data" Default="/mnt/user/appdata/vboxstock" Mode="rw" Description="SQLite database and durable application data" Type="Path" Display="always" Required="true" Mask="false">/mnt/user/appdata/vboxstock</Config>
+  <Config Name="User ID" Target="PUID" Default="99" Mode="" Description="Host user ID used to own and write application data. Unraid default is 99 (nobody)." Type="Variable" Display="advanced" Required="true" Mask="false">99</Config>
+  <Config Name="Group ID" Target="PGID" Default="100" Mode="" Description="Host group ID used to own and write application data. Unraid default is 100 (users)." Type="Variable" Display="advanced" Required="true" Mask="false">100</Config>
   <Config Name="Timezone" Target="TZ" Default="America/New_York" Mode="" Description="Container timezone" Type="Variable" Display="advanced" Required="false" Mask="false">America/New_York</Config>
 </Container>