diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 5188465..f31f05d 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -103,7 +103,7 @@ jobs:
       - name: A imagem sobe e responde
         if: ${{ steps.plano.outputs.reuse != 'true' }}
         run: |
-          docker run -d --name pss-ci -p 127.0.0.1:3998:80 pss:ci
+          docker run -d --name pss-ci -p 127.0.0.1:3998:8080 pss:ci
           status=0
           scripts/smoke-imagem.sh http://127.0.0.1:3998 || status=1
           docker rm -f pss-ci >/dev/null
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 046237c..04df28b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,7 +14,8 @@ Everything notable in PSS is recorded here. The format follows
   (`git.lucasrguerra.dev.br`). The deployment pulls the image from its registry.
 - The `Dockerfile` is multi-stage: it builds Vite from source inside the image instead
   of unpacking a `dist.tar.gz` committed to the repository (removed, along with the
-  `build:release` script).
+  `build:release` script). The final stage is `nginx-unprivileged`: the container runs
+  as the `nginx` user and listens on port 8080 instead of 80 (Trivy DS-0002).
 - New CI on Gitea runners (`.gitea/workflows`): types, 282 tests, Trivy on the repository
   and on the image, and an image smoke test. The image is built once per content hash and
   reused by the release, so a merge or a tag on an already validated commit rebuilds nothing.
diff --git a/Dockerfile b/Dockerfile
index fd00d45..f765aa7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -8,13 +8,14 @@ RUN --mount=type=cache,target=/root/.npm npm ci
 COPY . .
 RUN npm run build
 
-# ── Imagem final: só o nginx e os arquivos estáticos ──
-FROM nginx:alpine
+# ── Imagem final: nginx sem privilégios (usuário nginx, porta 8080) e os estáticos ──
+FROM nginxinc/nginx-unprivileged:alpine
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 COPY --from=build /app/dist /usr/share/nginx/html
 
-EXPOSE 80
+USER nginx
+EXPOSE 8080
 HEALTHCHECK --interval=30s --timeout=10s --start-period=15s --retries=3 \
-  CMD wget -q --spider http://127.0.0.1:80/ || exit 1
+  CMD wget -q --spider http://127.0.0.1:8080/ || exit 1
 
 CMD ["nginx", "-g", "daemon off;"]
diff --git a/README.en.md b/README.en.md
index 79c60f8..7045605 100644
--- a/README.en.md
+++ b/README.en.md
@@ -61,14 +61,14 @@ docker compose up --build
 ```
 
 The `Dockerfile` builds Vite inside the image (Node 22) and serves the static files
-with nginx. There is no pre-built artifact in the repository.
+with an unprivileged nginx (`nginx` user, port 8080). There is no pre-built artifact in the repository.
 
 ### Published image
 
 Every version is published to the Gitea container registry (linux/arm64):
 
 ```bash
-docker run -p 8080:80 git.lucasrguerra.dev.br/lucasrguerra/pss:latest
+docker run -p 8080:8080 git.lucasrguerra.dev.br/lucasrguerra/pss:latest
 ```
 
 Tags: `latest`, `X.Y.Z`, `X.Y` and `sha-<commit>`. The public instance runs at
diff --git a/README.md b/README.md
index e4cca29..94dbc24 100644
--- a/README.md
+++ b/README.md
@@ -59,14 +59,14 @@ docker compose up --build
 ```
 
 O `Dockerfile` compila o Vite dentro da própria imagem (Node 22) e entrega os
-arquivos estáticos pelo nginx. Não há artefato pré-construído no repositório.
+arquivos estáticos por um nginx sem privilégios (usuário `nginx`, porta 8080). Não há artefato pré-construído no repositório.
 
 ### Imagem publicada
 
 Cada versão é publicada no registro de contêineres do Gitea (linux/arm64):
 
 ```bash
-docker run -p 8080:80 git.lucasrguerra.dev.br/lucasrguerra/pss:latest
+docker run -p 8080:8080 git.lucasrguerra.dev.br/lucasrguerra/pss:latest
 ```
 
 Tags: `latest`, `X.Y.Z`, `X.Y` e `sha-<commit>`. A instância pública roda em
diff --git a/docker-compose.yml b/docker-compose.yml
index 5878751..fc4b9b7 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -2,10 +2,10 @@ services:
   pss:
     build: .
     ports:
-      - "${PORT:-3000}:80"
+      - "${PORT:-3000}:8080"
     restart: unless-stopped
     healthcheck:
-      test: ["CMD-SHELL", "wget -q --spider http://127.0.0.1:80/ || exit 1"]
+      test: ["CMD-SHELL", "wget -q --spider http://127.0.0.1:8080/ || exit 1"]
       interval: 30s
       timeout: 10s
       retries: 3
diff --git a/nginx.conf b/nginx.conf
index ba3284d..0b46232 100644
--- a/nginx.conf
+++ b/nginx.conf
@@ -1,5 +1,5 @@
 server {
-    listen 80;
+    listen 8080;
     server_name _;
     root /usr/share/nginx/html;
     index index.html;