diff --git a/scripts/entrypoint.sh b/scripts/entrypoint.sh
index 109fbc7..509cb48 100755
--- a/scripts/entrypoint.sh
+++ b/scripts/entrypoint.sh
@@ -32,7 +32,16 @@ ln -s /home/$user/logs/nodejs /var/log/nodejs
 
 # Set ownership and permissions
 chown -R $user:$user /home/$user
-chmod -R 755 /home/$user
+# Do NOT `chmod -R 755` here. /home/$user is the customer's bind-mounted
+# directory; a recursive 755 on every start made every file (.env, app
+# secrets) world-readable AND executable, and reverted any tighter
+# permissions the customer had set. nginx workers run as `nginx` (not the
+# customer) and serve /static/ straight from /home/$user/app/public/, so they
+# only need to traverse directories. Normalise that and nothing else: open the
+# home dir itself (adduser -m creates it 0700 when it does not exist yet), and
+# add o+x to directories that lack it. Regular files are never touched.
+chmod 755 /home/$user
+find /home/$user -type d ! -perm -o=x -exec chmod o+x {} +
 
 # Start nginx
 nginx