diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh
index ecba473..686a556 100755
--- a/docker/entrypoint.sh
+++ b/docker/entrypoint.sh
@@ -5,8 +5,8 @@ mkdir -p /app/var/data /app/var/bootstrap-cache
 chown -R www-data:www-data /app/var
 
 if [ "${APP_ENV:-prod}" != "test" ]; then
-  php /app/bin/console cache:clear --no-warmup --no-interaction
-  php /app/bin/console doctrine:migrations:migrate --no-interaction --allow-no-migration
+  su -m www-data -s /bin/sh -c 'cd /app && php /app/bin/console cache:clear --no-warmup --no-interaction'
+  su -m www-data -s /bin/sh -c 'cd /app && php /app/bin/console doctrine:migrations:migrate --no-interaction --allow-no-migration'
 fi
 
 if [ "${APP_ENV:-prod}" = "prod" ] && [ "${1:-}" = "php-fpm" ]; then
diff --git a/tests/Docker/EntrypointTest.php b/tests/Docker/EntrypointTest.php
new file mode 100644
index 0000000..304285c
--- /dev/null
+++ b/tests/Docker/EntrypointTest.php
@@ -0,0 +1,23 @@
+<?php
+
+namespace App\Tests\Docker;
+
+use PHPUnit\Framework\TestCase;
+
+final class EntrypointTest extends TestCase
+{
+    public function testBootConsoleCommandsRunAsRuntimeUser(): void
+    {
+        $entrypoint = file_get_contents(__DIR__.'/../../docker/entrypoint.sh');
+
+        self::assertIsString($entrypoint);
+        self::assertStringContainsString(
+            "su -m www-data -s /bin/sh -c 'cd /app && php /app/bin/console cache:clear --no-warmup --no-interaction'",
+            $entrypoint
+        );
+        self::assertStringContainsString(
+            "su -m www-data -s /bin/sh -c 'cd /app && php /app/bin/console doctrine:migrations:migrate --no-interaction --allow-no-migration'",
+            $entrypoint
+        );
+    }
+}