diff --git a/docker-images/ziti-cli/Dockerfile b/docker-images/ziti-cli/Dockerfile
index 125fb3628..0a006e7ce 100644
--- a/docker-images/ziti-cli/Dockerfile
+++ b/docker-images/ziti-cli/Dockerfile
@@ -18,6 +18,9 @@ ARG TARGETOS
 # e.g. arm64
 ARG TARGETARCH
 
+ARG ZUID=2171
+ARG ZGID=2171
+
 ### Required OpenShift Labels 
 LABEL name="openziti/ziti-cli" \
       maintainer="developers@openziti.org" \
@@ -28,7 +31,7 @@ LABEL name="openziti/ziti-cli" \
 USER root
 
 ### install packages
-RUN   INSTALL_PKGS="python38 python38-pip tar bash-completion vim-minimal less" && \
+RUN   INSTALL_PKGS="python38 python38-pip tar bash-completion vim-minimal less shadow-utils" && \
       microdnf -y update --setopt=install_weak_deps=0 --setopt=tsflags=nodocs && \
       microdnf -y install --setopt=install_weak_deps=0 --setopt=tsflags=nodocs ${INSTALL_PKGS}
 
@@ -43,12 +46,20 @@ COPY --from=bitnami-kubectl /opt/bitnami/kubectl/bin/kubectl /usr/local/bin/
 RUN mkdir -p -m0755 /licenses
 COPY ./LICENSE /licenses/apache.txt
 
+RUN groupadd --gid ${ZGID} ziggy \
+      && adduser --uid ${ZUID} --gid ${ZGID} --system --home /home/ziggy --shell /bin/bash ziggy \
+      && mkdir -p /home/ziggy \
+      && chown -R ${ZUID}:${ZGID} /home/ziggy \
+      && chmod -R g+rwX /home/ziggy
 RUN mkdir -p /usr/local/bin
 COPY ${ARTIFACTS_DIR}/${TARGETARCH}/${TARGETOS}/ziti /usr/local/bin/
 RUN chmod 0755 /usr/local/bin/ziti
 
+RUN /usr/local/bin/ziti completion bash > /etc/bash_completion.d/ziti_cli
+
 COPY ${DOCKER_BUILD_DIR}/entrypoint.sh /
 RUN chmod +x /entrypoint.sh
-USER nobody
+USER ziggy
+COPY ${DOCKER_BUILD_DIR}/bashrc /home/ziggy/.bashrc
 ENTRYPOINT [ "/entrypoint.sh" ]
 CMD [ "ziti" ]
diff --git a/docker-images/ziti-cli/bashrc b/docker-images/ziti-cli/bashrc
new file mode 100644
index 000000000..82f366d9e
--- /dev/null
+++ b/docker-images/ziti-cli/bashrc
@@ -0,0 +1,21 @@
+# this script addresses the problem of /etc/profile not being sourced
+# because ziggy's BASH shell is not a "login shell." /etc/profile is
+# intended to be sourced only once by the first shell, but it never runs
+# automatically upon login because the first shell isn't invoked as a login
+# shell. .bashrc runs for all interactive shells, so we can use it to
+# replace the current shell process with a login shell.
+
+set -euo pipefail
+USER="${USER:-$( id -u )}"
+SHELL="${SHELL:-$( getent passwd "${USER}" | cut -d : -f 7 )}"
+if [ -z "${SHELL}" ] ; then
+    echo 1>&2 "${0}: can't set SHELL; giving up"
+    exit 1
+fi
+HOME="${HOME:-$( getent passwd "${USER}" | cut -d : -f 6 )}"
+if [ -z "${HOME}" ] ; then
+    echo 1>&2 "${0}: can't set HOME; giving up"
+    exit 1
+fi
+cd "${HOME}"
+SHELL="${SHELL}" exec -a "-${SHELL##*/}" "${SHELL}"