diff --git a/docker-compose.e2e.yml b/docker-compose.e2e.yml
index 8135487..6dc3cec 100644
--- a/docker-compose.e2e.yml
+++ b/docker-compose.e2e.yml
@@ -63,6 +63,10 @@ services:
     build:
       context: .
       dockerfile: Dockerfile
+    # The image runs as the non-root `app` user, but the e2e entrypoint needs
+    # root to read Caddy's root-owned CA and install it into the trust store. It
+    # drops back to `app` before launching the server.
+    user: root
     entrypoint: ["/bin/sh", "/e2e-entrypoint.sh"]
     environment:
       DATABASE_URL: postgres://happyview:happyview@postgres:5432/happyview_test