diff --git a/Dockerfile b/Dockerfile
index 4e42320..e2821d9 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -6,6 +6,10 @@ RUN pip install --no-cache-dir "uvicorn[standard]==0.30.1"
 
 WORKDIR /reference
 
+# Make sure we have a temporary directory in the container, although ideally one should
+# be mounted in so it's not stored on the overlay FS.
+RUN mkdir -p tmp
+
 COPY pyproject.toml .
 COPY poetry.lock .
 
@@ -18,6 +22,7 @@ RUN poetry config virtualenvs.create false && \
 # Manually copy only what's relevant
 # (Don't use .dockerignore, which allows us to have development containers too)
 COPY bento_reference_service bento_reference_service
+COPY entrypoint.bash .
 COPY run.bash .
 COPY LICENSE .
 COPY README.md .
@@ -25,4 +30,5 @@ COPY README.md .
 # Install the module itself, locally (similar to `pip install -e .`)
 RUN poetry install --without dev
 
+ENTRYPOINT [ "bash", "./entrypoint.bash" ]
 CMD [ "bash", "./run.bash" ]
diff --git a/entrypoint.bash b/entrypoint.bash
new file mode 100644
index 0000000..73b40f2
--- /dev/null
+++ b/entrypoint.bash
@@ -0,0 +1,14 @@
+#!/bin/bash
+
+source /create_service_user.bash
+
+# Set up Git configuration if needed (useful for development images / containers)
+gosu bento_user /bin/bash -c '/set_gitconfig.bash'
+
+# Addition to base entrypoint: fix default production temporary folder permissions
+if [[ -d '/reference/tmp' ]]; then
+  chown -R bento_user:bento_user '/reference/tmp'
+fi
+
+# Drop into bento_user from root and execute the CMD specified for the image
+exec gosu bento_user "$@"