diff --git a/Dockerfile b/Dockerfile
index 6324568e841..8f3c1279ce9 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -17,16 +17,11 @@ VOLUME ["/var/syncthing"]
 RUN apk add --no-cache ca-certificates su-exec
 
 COPY --from=builder /src/syncthing /bin/syncthing
+COPY --from=builder /src/script/docker-entrypoint.sh /bin/entrypoint.sh
 
 ENV PUID=1000 PGID=1000
 
 HEALTHCHECK --interval=1m --timeout=10s \
   CMD nc -z localhost 8384 || exit 1
 
-ENTRYPOINT \
-  chown "${PUID}:${PGID}" /var/syncthing \
-  && su-exec "${PUID}:${PGID}" \
-     env HOME=/var/syncthing \
-     /bin/syncthing \
-       -home /var/syncthing/config \
-       -gui-address 0.0.0.0:8384
+ENTRYPOINT ["/bin/entrypoint.sh", "-home", "/var/syncthing/config", "-gui-address", "0.0.0.0:8384"]
diff --git a/script/docker-entrypoint.sh b/script/docker-entrypoint.sh
new file mode 100755
index 00000000000..a9bf3320084
--- /dev/null
+++ b/script/docker-entrypoint.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+set -eu
+
+chown "${PUID}:${PGID}" /var/syncthing \
+  && exec su-exec "${PUID}:${PGID}" \
+     env HOME=/var/syncthing \
+     /bin/syncthing "$@"