diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml
index 915da999..8f7a3571 100644
--- a/.github/workflows/documentation.yml
+++ b/.github/workflows/documentation.yml
@@ -22,6 +22,7 @@ jobs:
         uses: actions/checkout@v2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Login to DockerHub
         uses: docker/login-action@v1
diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
index f38018bf..8d5804ab 100644
--- a/.github/workflows/pull_request.yml
+++ b/.github/workflows/pull_request.yml
@@ -15,6 +15,7 @@ jobs:
         uses: actions/checkout@v2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Package documentation
         run: make docs-package
diff --git a/Dockerfile b/Dockerfile
index 1ace60ed..72e7cccb 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -43,4 +43,6 @@ RUN addgroup -g 1000 -S app && \
 COPY --from=base-image /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
 COPY --from=maker /go/src/github.com/traefik/mesh/dist/traefik-mesh /app/
 
+USER app
+
 ENTRYPOINT ["/app/traefik-mesh"]
diff --git a/tmpl.Dockerfile b/tmpl.Dockerfile
index 40dff83e..52294429 100644
--- a/tmpl.Dockerfile
+++ b/tmpl.Dockerfile
@@ -36,4 +36,6 @@ RUN addgroup -g 1000 -S app && \
 COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
 COPY --from=builder /go/src/github.com/traefik/mesh/dist/traefik-mesh /app/
 
+USER app
+
 ENTRYPOINT ["/app/traefik-mesh"]