diff --git a/Dockerfile.release b/Dockerfile.release
index caf6b342..397c8990 100644
--- a/Dockerfile.release
+++ b/Dockerfile.release
@@ -1,5 +1,5 @@
 # vim: syntax=dockerfile
-FROM gcr.io/distroless/base
+FROM gcr.io/distroless/base:nonroot
 COPY validated-update-graph.yaml /opt/operator/config.yaml
 COPY --from=ghcr.io/grpc-ecosystem/grpc-health-probe:v0.4.19 /ko-app/grpc-health-probe /usr/local/bin/grpc_health_probe
 COPY spicedb-operator /usr/local/bin/spicedb-operator