diff --git a/configs/paivana/Containerfile b/configs/paivana/Containerfile
index 20ba0bb..621fc43 100644
--- a/configs/paivana/Containerfile
+++ b/configs/paivana/Containerfile
@@ -39,7 +39,8 @@ RUN apt-get update -yqq \
       libtalerexchange libtalermerchant libgnunet \
       libmicrohttpd12t64 libcurl3t64-gnutls libjansson4 libgcrypt20 zlib1g libpq5 \
  && rm -rf /var/lib/apt/lists/* \
- && useradd --system --home /var/lib/paivana --shell /usr/sbin/nologin paivana-httpd \
+ && groupadd --gid 1000 paivana-httpd \
+ && useradd --uid 1000 --gid 1000 --home-dir /var/lib/paivana --shell /usr/sbin/nologin paivana-httpd \
  && mkdir -p /etc/paivana /var/lib/paivana \
  && chown -R paivana-httpd:paivana-httpd /var/lib/paivana /etc/paivana
 
diff --git a/configs/paivana/README.md b/configs/paivana/README.md
index 097c833..e813a82 100644
--- a/configs/paivana/README.md
+++ b/configs/paivana/README.md
@@ -6,7 +6,8 @@ GNU Taler **paivana-httpd** reverse-proxy paywall (DD 95 / DD 76 style), GOA pay
 |------|--------|
 | Live | `/home/hernani/koopa-paivana/` |
 | Containers | `koopa-paivana`, `koopa-paivana-upstream` |
-| Image | `localhost/koopa-paivana:latest` (built from `Containerfile`) |
+| Image | `localhost/koopa-paivana:latest` (built from `Containerfile`); process **uid 1000** `paivana-httpd` |
+| Upstream | `nginxinc/nginx-unprivileged` on **:8080** (not root nginx:80) |
 | Host port | **9025** → Caddy `paivana.hacktivism.ch` |
 | Currency | **GOA** |
 | Merchant | `https://taler.hacktivism.ch/instances/goa-shop/` |
diff --git a/configs/paivana/compose.yml b/configs/paivana/compose.yml
index 016d633..27c8ed9 100644
--- a/configs/paivana/compose.yml
+++ b/configs/paivana/compose.yml
@@ -8,6 +8,9 @@ services:
     image: localhost/koopa-paivana:latest
     container_name: koopa-paivana
     restart: unless-stopped
+    # Image already USER paivana-httpd; pin numeric + keep-id for host secrets/volumes.
+    user: "1000:1000"
+    userns_mode: keep-id
     ports:
       - "9025:9967"
     extra_hosts:
@@ -29,13 +32,14 @@ services:
       org.hacktivism.currency: GOA
 
   upstream:
-    image: docker.io/library/nginx:1.27-alpine
+    # Non-root nginx (listens on 8080). See DESTINATION_BASE_URL in conf template.
+    image: docker.io/nginxinc/nginx-unprivileged:1.27-alpine
     container_name: koopa-paivana-upstream
     restart: unless-stopped
     volumes:
       - ./upstream:/usr/share/nginx/html:ro
     expose:
-      - "80"
+      - "8080"
     command: ["nginx", "-g", "daemon off;"]
     labels:
       org.hacktivism.service: paivana-upstream
diff --git a/configs/paivana/conf/paivana.conf.template b/configs/paivana/conf/paivana.conf.template
index abad54b..6dec110 100644
--- a/configs/paivana/conf/paivana.conf.template
+++ b/configs/paivana/conf/paivana.conf.template
@@ -8,7 +8,7 @@ BIND_TO = 0.0.0.0
 
 BASE_URL = https://paivana.hacktivism.ch/
 
-DESTINATION_BASE_URL = http://upstream:80/
+DESTINATION_BASE_URL = http://upstream:8080/
 
 MERCHANT_BACKEND_URL = https://taler.hacktivism.ch/instances/goa-shop/
 MERCHANT_ACCESS_TOKEN = @MERCHANT_ACCESS_TOKEN@