diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4aa5f9ef..373ee19c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Fixed
+- **Blank page on HTTP deployments (CSP `upgrade-insecure-requests`):** Helmet's default CSP included `upgrade-insecure-requests`, which causes browsers to silently upgrade all HTTP sub-resource fetches (JS, CSS, images) to HTTPS. On a plain-HTTP self-hosted deployment this produces a completely blank page with `ERR_SSL_PROTOCOL_ERROR`. The directive is now explicitly omitted from the CSP.
+- **HSTS permanently breaking HTTP access:** Helmet's default `Strict-Transport-Security` header was being sent over HTTP, instructing browsers to refuse non-HTTPS connections for 1 year. HSTS is now disabled and must only be re-enabled by users who terminate HTTPS at a reverse proxy in front of Sencho.
+- **Docker socket EACCES root:root edge case:** Entrypoint now handles the case where the Docker socket is owned by root:root (GID 0) in addition to the standard root:docker case. Diagnostic `[entrypoint]` log lines are emitted at startup to make group detection visible in `docker logs`.
 - **Docker volume permissions on startup:** A new `docker-entrypoint.sh` script now runs as root at container start, fixes ownership of the `$DATA_DIR` volume (only files with wrong user or group), then drops to the non-root `sencho` user via `su-exec` before starting Node. This eliminates the `SQLITE_READONLY` crash experienced when a host-mounted data volume was previously created by root or a different UID. Uses the same privilege-drop pattern as the official PostgreSQL, Redis, and MariaDB Docker images. Node becomes PID 1, ensuring SIGTERM/SIGINT are handled correctly for graceful shutdown.
 
 ### Added
diff --git a/backend/src/index.ts b/backend/src/index.ts
index dcc7e27b..46a0c095 100644
--- a/backend/src/index.ts
+++ b/backend/src/index.ts
@@ -65,9 +65,32 @@ const getCookieOptions = (req: Request) => ({
 // Middleware
 
 // Security headers (X-Frame-Options, X-Content-Type-Options, etc.)
-// crossOriginEmbedderPolicy is disabled because the Monaco editor uses workers
-// that don't set the required COEP headers.
-app.use(helmet({ crossOriginEmbedderPolicy: false }));
+// crossOriginEmbedderPolicy: disabled — Monaco editor workers lack COEP headers.
+// hsts: disabled — HSTS must only be set when the app is served over HTTPS.
+//   Enabling it over HTTP permanently breaks browser access for 1 year.
+// contentSecurityPolicy.upgrade-insecure-requests: removed — this directive
+//   tells browsers to silently upgrade all HTTP sub-resource fetches to HTTPS.
+//   On a plain-HTTP self-hosted deployment (the common case) this causes every
+//   JS/CSS asset to fail with ERR_SSL_PROTOCOL_ERROR, producing a blank page.
+app.use(helmet({
+  crossOriginEmbedderPolicy: false,
+  hsts: false,
+  contentSecurityPolicy: {
+    directives: {
+      defaultSrc: ["'self'"],
+      baseUri: ["'self'"],
+      fontSrc: ["'self'", 'https:', 'data:'],
+      formAction: ["'self'"],
+      frameAncestors: ["'self'"],
+      imgSrc: ["'self'", 'data:'],
+      objectSrc: ["'none'"],
+      scriptSrc: ["'self'"],
+      scriptSrcAttr: ["'none'"],
+      styleSrc: ["'self'", 'https:', "'unsafe-inline'"],
+      // 'upgrade-insecure-requests' is intentionally absent — see comment above.
+    },
+  },
+}));
 
 // CORS — in production restrict to the configured frontend origin.
 // In development, mirror the request origin so Vite's dev server works.
diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh
index 779c7a4d..e1c3cbb7 100644
--- a/docker-entrypoint.sh
+++ b/docker-entrypoint.sh
@@ -4,6 +4,67 @@ set -e
 # Resolve the data directory, mirroring DatabaseService.ts logic.
 DATA_DIR="${DATA_DIR:-/app/data}"
 
+# If running as root (the default Docker container start), fix volume ownership,
+# fix Docker socket group access, then drop privileges before executing the app.
+#
+# This is the industry-standard pattern used by the official PostgreSQL, Redis,
+# and MariaDB Docker images, and by Docker management tools like Portainer and
+# Dockge that also require access to /var/run/docker.sock as a non-root user.
+#
+# The UID guard also ensures compatibility with strict environments like
+# Kubernetes (runAsNonRoot: true) or OpenShift, where the container is forced to
+# run as a random high UID. In that case both blocks are skipped and the app
+# exec's directly without crashing.
+if [ "$(id -u)" = '0' ]; then
+
+    # ── 1. Fix data volume ownership ────────────────────────────────────────
+    # Handles host volumes previously created by root or a different UID, which
+    # would cause SQLITE_READONLY errors when the non-root sencho user starts.
+    # Only touches files with wrong user OR group (efficient on large dirs).
+    mkdir -p "$DATA_DIR"
+    find "$DATA_DIR" \( \! -user sencho -o \! -group sencho \) \
+        -exec chown sencho:sencho '{}' +
+    echo "[entrypoint] Data directory ownership ensured: $DATA_DIR"
+
+    # ── 2. Fix Docker socket group access ───────────────────────────────────
+    # The Docker socket on the host is owned by the host's docker group, whose
+    # GID varies by Linux distribution and does not match any group inside the
+    # container by default.
+    #
+    # Solution: detect the socket's GID at runtime, create a matching group
+    # inside the container if one doesn't already exist, then add sencho to it.
+    # su-exec calls getgrouplist() which reads /etc/group, so supplementary
+    # groups added here ARE inherited by the Node process.
+    if [ -S /var/run/docker.sock ]; then
+        DOCKER_SOCK_GID=$(stat -c '%g' /var/run/docker.sock)
+        DOCKER_SOCK_MODE=$(stat -c '%a' /var/run/docker.sock)
+        echo "[entrypoint] Docker socket found: GID=$DOCKER_SOCK_GID mode=$DOCKER_SOCK_MODE"
+
+        if [ "$DOCKER_SOCK_GID" = "0" ]; then
+            # Socket is owned by root:root. The only way to access it without
+            # running as root is to make it group-readable and assign a shared
+            # group. We create a 'docker-sock' group with GID 0 for clarity.
+            echo "[entrypoint] WARNING: Docker socket is root:root — adding sencho to root group"
+            addgroup sencho root 2>/dev/null || true
+        else
+            if ! getent group "$DOCKER_SOCK_GID" > /dev/null 2>&1; then
+                addgroup -S -g "$DOCKER_SOCK_GID" docker-host
+                echo "[entrypoint] Created group docker-host with GID $DOCKER_SOCK_GID"
+            fi
+            DOCKER_GROUP=$(getent group "$DOCKER_SOCK_GID" | cut -d: -f1)
+            addgroup sencho "$DOCKER_GROUP" 2>/dev/null || true
+            echo "[entrypoint] Added sencho to group '$DOCKER_GROUP' (GID $DOCKER_SOCK_GID)"
+        fi
+    else
+        echo "[entrypoint] WARNING: /var/run/docker.sock not found — Docker features will be unavailable"
+    fi
+
+    echo "[entrypoint] Dropping privileges to sencho (uid=$(id -u sencho))"
+
+    # ── 3. Drop privileges ──────────────────────────────────────────────────
+    # Replace this shell process with su-exec so that Node becomes PID 1 and
+    # receives SIGTERM/SIGINT directly from Docker. su-exec calls getgrouplist()
+    # for named users, so all supplementary groups set above are inherited.
 # If running as root (the default Docker container start), fix volume ownership
 # then drop privileges before executing the application.
 #