diff --git a/docker/photoprism/armv7/Dockerfile b/docker/photoprism/armv7/Dockerfile
index 2472bc919..ac8de35d8 100644
--- a/docker/photoprism/armv7/Dockerfile
+++ b/docker/photoprism/armv7/Dockerfile
@@ -77,7 +77,7 @@ ENV PHOTOPRISM_ARCH=$TARGETARCH \
     PHOTOPRISM_AUTO_IMPORT=300
 
 # copy dist files, scripts, and debian backports sources list
-COPY --from=build /opt/photoprism/ /opt/photoprism
+COPY --from=build --chown=root:root --chmod=755 /opt/photoprism/ /opt/photoprism
 COPY --chown=root:root --chmod=755 /scripts/dist/* /scripts/
 COPY /docker/develop/bookworm/sources.list /etc/apt/sources.list.d/bookworm.list
 
@@ -88,8 +88,6 @@ RUN echo 'APT::Acquire::Retries "3";' > /etc/apt/apt.conf.d/80retries && \
     echo 'APT::Get::Assume-Yes "true";' > /etc/apt/apt.conf.d/80forceyes && \
     echo 'APT::Get::Fix-Missing "true";' > /etc/apt/apt.conf.d/80fixmissing && \
     mv /opt/photoprism/sbin/gosu /usr/local/sbin/gosu && \
-    chown root:root /usr/local/sbin/gosu && \
-    chmod 755 /usr/local/sbin/gosu && \
     apt-get update && apt-get -qq dist-upgrade && apt-get -qq install --no-install-recommends \
       libc6 ca-certificates sudo bash tzdata \
       gpg zip unzip wget curl rsync make nano \
diff --git a/docker/photoprism/bookworm/Dockerfile b/docker/photoprism/bookworm/Dockerfile
index 841ad32fb..47b480514 100644
--- a/docker/photoprism/bookworm/Dockerfile
+++ b/docker/photoprism/bookworm/Dockerfile
@@ -86,10 +86,8 @@ WORKDIR /photoprism
 EXPOSE 2342
 
 # copy dist files
-COPY --from=build /opt/photoprism/ /opt/photoprism
-RUN mv /opt/photoprism/sbin/gosu /usr/local/sbin/gosu && \
-    chown root:root /usr/local/sbin/gosu && \
-    chmod 755 /usr/local/sbin/gosu
+COPY --from=build --chown=root:root --chmod=755 /opt/photoprism/ /opt/photoprism
+RUN mv /opt/photoprism/sbin/gosu /usr/local/sbin/gosu
 
 # set container entrypoint script
 ENTRYPOINT ["/scripts/entrypoint.sh"]
diff --git a/docker/photoprism/bullseye/Dockerfile b/docker/photoprism/bullseye/Dockerfile
index 2f0b27bfd..c94d08e83 100644
--- a/docker/photoprism/bullseye/Dockerfile
+++ b/docker/photoprism/bullseye/Dockerfile
@@ -86,10 +86,8 @@ WORKDIR /photoprism
 EXPOSE 2342
 
 # copy dist files
-COPY --from=build /opt/photoprism/ /opt/photoprism
-RUN mv /opt/photoprism/sbin/gosu /usr/local/sbin/gosu && \
-    chown root:root /usr/local/sbin/gosu && \
-    chmod 755 /usr/local/sbin/gosu
+COPY --from=build --chown=root:root --chmod=755 /opt/photoprism/ /opt/photoprism
+RUN mv /opt/photoprism/sbin/gosu /usr/local/sbin/gosu
 
 # set container entrypoint script
 ENTRYPOINT ["/scripts/entrypoint.sh"]
diff --git a/docker/photoprism/buster/Dockerfile b/docker/photoprism/buster/Dockerfile
index 4e542bc18..08481b6a4 100644
--- a/docker/photoprism/buster/Dockerfile
+++ b/docker/photoprism/buster/Dockerfile
@@ -77,7 +77,7 @@ ENV PHOTOPRISM_ARCH=$TARGETARCH \
     PHOTOPRISM_AUTO_IMPORT=300
 
 # copy dist files, scripts, and debian backports sources list
-COPY --from=build /opt/photoprism/ /opt/photoprism
+COPY --from=build --chown=root:root --chmod=755 /opt/photoprism/ /opt/photoprism
 COPY --chown=root:root --chmod=755 /scripts/dist/* /scripts/
 COPY --chown=root:root --chmod=644 /docker/develop/buster/sources.list /etc/apt/sources.list.d/buster.list
 
@@ -88,8 +88,6 @@ RUN echo 'APT::Acquire::Retries "3";' > /etc/apt/apt.conf.d/80retries && \
     echo 'APT::Get::Assume-Yes "true";' > /etc/apt/apt.conf.d/80forceyes && \
     echo 'APT::Get::Fix-Missing "true";' > /etc/apt/apt.conf.d/80fixmissing && \
     mv /opt/photoprism/sbin/gosu /usr/local/sbin/gosu && \
-    chown root:root /usr/local/sbin/gosu && \
-    chmod 755 /usr/local/sbin/gosu && \
     apt-get update && apt-get -qq dist-upgrade && apt-get -qq install --no-install-recommends \
       ca-certificates \
       jq \
diff --git a/docker/photoprism/impish/Dockerfile b/docker/photoprism/impish/Dockerfile
index 91a8eb5b2..fe0304c0e 100644
--- a/docker/photoprism/impish/Dockerfile
+++ b/docker/photoprism/impish/Dockerfile
@@ -77,7 +77,7 @@ ENV PHOTOPRISM_ARCH=$TARGETARCH \
     PHOTOPRISM_AUTO_IMPORT=300
 
 # copy dist files and scripts
-COPY --from=build /opt/photoprism/ /opt/photoprism
+COPY --from=build --chown=root:root --chmod=755 /opt/photoprism/ /opt/photoprism
 COPY --chown=root:root --chmod=755 /scripts/dist/* /scripts/
 
 # install additional distribution packages
@@ -87,8 +87,6 @@ RUN echo 'APT::Acquire::Retries "3";' > /etc/apt/apt.conf.d/80retries && \
     echo 'APT::Get::Assume-Yes "true";' > /etc/apt/apt.conf.d/80forceyes && \
     echo 'APT::Get::Fix-Missing "true";' > /etc/apt/apt.conf.d/80fixmissing && \
     mv /opt/photoprism/sbin/gosu /usr/local/sbin/gosu && \
-    chown root:root /usr/local/sbin/gosu && \
-    chmod 755 /usr/local/sbin/gosu && \
     apt-get update && apt-get -qq dist-upgrade && apt-get -qq install --no-install-recommends \
       ca-certificates \
       jq \
diff --git a/docker/photoprism/jammy/Dockerfile b/docker/photoprism/jammy/Dockerfile
index 733f36a26..1ba45a3a2 100644
--- a/docker/photoprism/jammy/Dockerfile
+++ b/docker/photoprism/jammy/Dockerfile
@@ -77,7 +77,7 @@ ENV PHOTOPRISM_ARCH=$TARGETARCH \
     PHOTOPRISM_AUTO_IMPORT=300
 
 # copy dist files and scripts
-COPY --from=build /opt/photoprism/ /opt/photoprism
+COPY --from=build --chown=root:root --chmod=755 /opt/photoprism/ /opt/photoprism
 COPY --chown=root:root --chmod=755 /scripts/dist/* /scripts/
 
 # install additional distribution packages
@@ -87,8 +87,6 @@ RUN echo 'APT::Acquire::Retries "3";' > /etc/apt/apt.conf.d/80retries && \
     echo 'APT::Get::Assume-Yes "true";' > /etc/apt/apt.conf.d/80forceyes && \
     echo 'APT::Get::Fix-Missing "true";' > /etc/apt/apt.conf.d/80fixmissing && \
     mv /opt/photoprism/sbin/gosu /usr/local/sbin/gosu && \
-    chown root:root /usr/local/sbin/gosu && \
-    chmod 755 /usr/local/sbin/gosu && \
     apt-get update && apt-get -qq dist-upgrade && apt-get -qq install --no-install-recommends \
       ca-certificates \
       jq \
diff --git a/scripts/dist/entrypoint-init.sh b/scripts/dist/entrypoint-init.sh
index d3717d4f8..4786ea857 100755
--- a/scripts/dist/entrypoint-init.sh
+++ b/scripts/dist/entrypoint-init.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 
 # INITIALIZES CONTAINER PACKAGES AND PERMISSIONS
-export PATH="/usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bin:/bin:/scripts:$PATH"
+export PATH="/usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bin:/bin:/scripts"
 
 # abort if not executed as root
 if [[ $(id -u) != "0" ]]; then
@@ -17,8 +17,8 @@ case $DOCKER_ENV in
   prod)
     export PATH="/usr/local/sbin:/usr/sbin:/sbin:/bin:/usr/local/bin:/usr/bin:/scripts:/opt/photoprism/bin";
     INIT_SCRIPTS="/scripts"
-    CHOWN_DIRS=("/photoprism" "/opt/photoprism")
-    CHMOD_DIRS=("/opt/photoprism")
+    CHOWN_DIRS=("/photoprism/storage")
+    CHMOD_DIRS=("/photoprism/storage")
     ;;
 
   develop)