diff --git a/Dockerfile b/Dockerfile
index a38b610..caa3a43 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -103,15 +103,19 @@ COPY --from=builder --chown=nextjs:nodejs /app/lib ./lib
 COPY --from=builder --chown=nextjs:nodejs /app/scripts/public-traffic-rollup-from-nginx.py ./scripts/public-traffic-rollup-from-nginx.py
 COPY --from=builder --chown=nextjs:nodejs /app/scripts/collapse-performance-survey-template-versions.mjs ./scripts/collapse-performance-survey-template-versions.mjs
 
-# 创建必要目录并设置权限
+# 创建必要目录并收紧权限。
+# 应用代码归 root 所有，运行账号只能写上传目录和 Next.js 运行时缓存；
+# 即使上层文件路径校验再次出现缺陷，也不能覆盖 server.js 或业务源码。
 RUN mkdir -p /app/public /app/uploads && \
     mkdir -p /app/scripts && \
+    mkdir -p /app/.next/cache && \
     mkdir -p /app/uploads/temp && \
     mkdir -p /app/uploads/assembled && \
     mkdir -p /app/uploads/materials && \
     mkdir -p /app/uploads/cleanup && \
-    chown -R nextjs:nodejs /app/public /app/uploads && \
-    chmod -R 777 /app/uploads
+    chown -R root:root /app && \
+    chown -R nextjs:nodejs /app/.next/cache /app/uploads && \
+    chmod 0750 /app/uploads /app/uploads/temp /app/uploads/assembled /app/uploads/materials /app/uploads/cleanup
 
 USER nextjs