diff --git a/scripts/e2e-entrypoint.sh b/scripts/e2e-entrypoint.sh
--- a/scripts/e2e-entrypoint.sh
+++ b/scripts/e2e-entrypoint.sh
@@ -6,10 +6,10 @@
 # proxied through Caddy (e.g. the PDS OAuth endpoints).
 #
 # Reading Caddy's CA (its pki/ tree is root-owned, mode 0700 to protect the CA
-# key) and installing it into the system trust store both require root. The
-# image now runs as the non-root `app` user, so the e2e compose overrides the
-# container user back to root for this bootstrap; we install the CA as root and
-# then drop to `app` to run the server, keeping the non-root runtime under test.
+# key) and installing it into the system trust store both require root, so the
+# e2e compose runs this container as root. The production image also runs as
+# root (see the Dockerfile note on the reverted non-root user), so after the CA
+# bootstrap we run the server directly — matching production, no privilege drop.
 CA_CERT=/caddy-data/caddy/pki/authorities/local/root.crt
 if [ -d /caddy-data ]; then
   echo "Waiting for Caddy CA certificate..."
@@ -19,9 +19,4 @@
   echo "Caddy CA certificate installed."
 fi
 
-# Drop back to the unprivileged app user (uid 10001) to run the server when we
-# started as root; run directly otherwise (already unprivileged).
-if [ "$(id -u)" = "0" ]; then
-  exec runuser -u app -- /entrypoint.sh "$@"
-fi
 exec /entrypoint.sh "$@"