diff --git a/Dockerfile b/Dockerfile
index 2a57373..f1f88a7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,11 @@
-ARG VERSION=0.3.135-wmde.13
+ARG VERSION=wdqs0.3.165
 FROM wikibase/wdqs:$VERSION
 ARG VERSION
 
+# Stopgap as upstream is non-root but our volume is root-owned (see T443565)
+# hadolint ignore=DL3002
+USER 0
+
 LABEL org.opencontainers.image.source="https://github.com/wbstack/queryservice"
 
 ENV USER_AGENT="Wikibase.Cloud Query Service ($VERSION); https://github.com/wbstack/queryservice"