diff --git a/.claude/settings.local.json b/.claude/settings.local.json
index c930de3..47ca751 100644
--- a/.claude/settings.local.json
+++ b/.claude/settings.local.json
@@ -9,7 +9,8 @@
       "Bash(PYTHONPATH=. uv run *)",
       "Bash(python *)",
       "Bash(DATABASE_URL=\"sqlite+aiosqlite:////tmp/claude-1000/-home-iroddis-dev-armament-fitguide/41e5e14d-88fe-45e7-ba3a-be5a2cbde2cd/scratchpad/mig_test.db\" uv run alembic upgrade head)",
-      "Bash(sqlite3 /tmp/claude-1000/-home-iroddis-dev-armament-fitguide/41e5e14d-88fe-45e7-ba3a-be5a2cbde2cd/scratchpad/mig_test.db '.schema users')"
+      "Bash(sqlite3 /tmp/claude-1000/-home-iroddis-dev-armament-fitguide/41e5e14d-88fe-45e7-ba3a-be5a2cbde2cd/scratchpad/mig_test.db '.schema users')",
+      "Bash(docker build *)"
     ]
   }
 }
diff --git a/Dockerfile b/Dockerfile
index 456747e..20c16dd 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -18,8 +18,9 @@ RUN uv sync --no-dev
 
 # Copy the application.
 COPY . .
+RUN chmod +x entrypoint.sh
 
 EXPOSE 8000
 
-# Default: run the API server. docker-compose overrides this to also seed.
-CMD ["uv", "run", "uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]
+# Seeds perms/roles/superuser (idempotent, no-op if already present), then runs the API server.
+ENTRYPOINT ["./entrypoint.sh"]
diff --git a/docker-compose.yml b/docker-compose.yml
index a1677be..438f890 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -28,10 +28,6 @@ services:
     depends_on:
       db:
         condition: service_healthy
-    # Seed default roles/permissions/superuser, then start the server.
-    command: >
-      sh -c "uv run python -m scripts.seed &&
-             uv run uvicorn app.main:app --host 0.0.0.0 --port 8000"
 
 volumes:
   pgdata:
diff --git a/entrypoint.sh b/entrypoint.sh
new file mode 100644
index 0000000..022e9ea
--- /dev/null
+++ b/entrypoint.sh
@@ -0,0 +1,7 @@
+#!/bin/sh
+set -e
+
+# Idempotent: creates perms/roles/superuser only if missing.
+uv run python -m scripts.seed
+
+exec uv run uvicorn app.main:app --host 0.0.0.0 --port 8000