diff --git a/Dockerfile b/Dockerfile
index f09862e..696fbf2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -6,10 +6,14 @@ FROM nodered/node-red:latest
 # Install curl for health checks
 USER root
 RUN apk add --no-cache curl
-USER node-red
 
-# Set working directory to the EVOLV bind mount location
+# Set working directory to the EVOLV bind mount location.
+# Create + chown explicitly so the unprivileged node-red user can
+# write `node_modules` during `npm install` below. Without this the
+# WORKDIR is created as root and npm fails with EACCES.
+RUN mkdir -p /data/evolv && chown -R node-red:node-red /data/evolv
 WORKDIR /data/evolv
+USER node-red
 
 # -------------------------------------------------------
 # Layer-cache: copy dependency manifests first