diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 149911d..f245665 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -39,17 +39,22 @@ jobs:
 
       - name: Run unit tests
         run: npm run test:unit -- --run
+        env:
+          DATABASE_URL: "postgresql://test:test@localhost:5432/test"
+          SMTP_HOST: "smtp.example.com"
+          SMTP_PORT: "587"
+          SMTP_SECURE: "false"
+          SMTP_USER: "your-email@example.com"
+          SMTP_PASS: "your-password"
+          SMTP_FROM_NAME: "Open Reception"
+          SMTP_FROM_EMAIL: "noreply@example.com"
+          JWT_SECRET: "test"
 
       - name: Build application
         run: npm run build
         env:
           DATABASE_URL: "postgresql://test:test@localhost:5432/test"
-
-      - name: Install Playwright browsers
-        run: npx playwright install --with-deps
-
-      - name: Run E2E tests
-        run: npm run test:e2e
+          JWT_SECRET: "build"
 
       - name: Log in to Docker Hub
         uses: docker/login-action@v3
diff --git a/Dockerfile b/Dockerfile
index 7c6741b..aec12d0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -19,25 +19,41 @@ FROM node:24-alpine AS production
 
 # Create non-root user
 RUN addgroup -g 1001 -S nodejs && \
-    adduser -S sveltekit -u 1001 -G nodejs
+    adduser -S openreception -u 1001 -G nodejs
 
 WORKDIR /app
 
 # Copy built application and dependencies
-COPY --from=builder --chown=sveltekit:nodejs /app/build ./build
-COPY --from=builder --chown=sveltekit:nodejs /app/package*.json ./
-COPY --from=builder --chown=sveltekit:nodejs /app/node_modules ./node_modules
+COPY --from=builder --chown=openreception:nodejs /app/build ./build
+COPY --from=builder --chown=openreception:nodejs /app/package*.json ./
+COPY --from=builder --chown=openreception:nodejs /app/node_modules ./node_modules
+
+# Copy migration files (required at runtime)
+COPY --from=builder --chown=openreception:nodejs /app/migrations ./migrations
+COPY --from=builder --chown=openreception:nodejs /app/tenant-migrations ./tenant-migrations
+
+# Copy drizzle configs (required for migrations)
+COPY --from=builder --chown=openreception:nodejs /app/drizzle.config.ts ./drizzle.config.ts
+COPY --from=builder --chown=openreception:nodejs /app/drizzle.tenant.config.ts ./drizzle.tenant.config.ts
+
+# Copy static files (includes argon2 WASM)
+COPY --from=builder --chown=openreception:nodejs /app/static ./static
 
 # Create logs directory
 RUN mkdir -p /app/logs && \
-    chown -R sveltekit:nodejs /app
+    chown -R openreception:nodejs /app
 
 # Drop privileges
-USER sveltekit
+USER openreception
 
 # Expose port
 EXPOSE 3000
 
+# Security: In docker compose, this container should run with:
+# - cap_drop: ALL (no Linux capabilities needed)
+# - security_opt: no-new-privileges:true
+# - read_only: true (with tmpfs for /tmp and /app/logs)
+
 # Health check
 HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
     CMD wget --no-verbose --tries=1 --spider http://localhost:3000/api/health || exit 1
diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml
index a60a1e8..d87eac2 100644
--- a/docker-compose.dev.yml
+++ b/docker-compose.dev.yml
@@ -28,8 +28,17 @@ services:
       start_period: 30s
     security_opt:
       - no-new-privileges:true
+    cap_drop:
+      - ALL
+    cap_add:
+      - CHOWN
+      - DAC_OVERRIDE
+      - FOWNER
+      - SETGID
+      - SETUID
     tmpfs:
       - /tmp
+      - /var/run/postgresql
 
 volumes:
   postgres_data_dev:
diff --git a/src/lib/components/ui/page/page-with-claim.svelte b/src/lib/components/ui/page/page-with-claim.svelte
index 4341bbf..35c94bc 100644
--- a/src/lib/components/ui/page/page-with-claim.svelte
+++ b/src/lib/components/ui/page/page-with-claim.svelte
@@ -1,3 +1,7 @@
+<script module lang="ts">
+  declare const __APP_VERSION__: string;
+</script>
+
 <script lang="ts">
   import { dev } from "$app/environment";
   import { m } from "$i18n/messages";
@@ -57,9 +61,9 @@
       {#if footer}
         {@render footer()}
       {/if}
-      <Text style="xs">
+      <Text style="xs" title={`v${__APP_VERSION__}`}>
         {m.poweredBy()}
-        <a href="https://open-reception.org" target="_blank" class="underline">OpenReception</a>
+        <a href="https://open-reception.org" target="_blank" class="underline"> OpenReception </a>
       </Text>
     </div>
     {#if dev}
diff --git a/vite.config.ts b/vite.config.ts
index 08e92a7..9e556d3 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -3,6 +3,9 @@ import tailwindcss from "@tailwindcss/vite";
 import { svelteTesting } from "@testing-library/svelte/vite";
 import { sveltekit } from "@sveltejs/kit/vite";
 import { defineConfig } from "vite";
+import { readFileSync } from "fs";
+
+const pkg = JSON.parse(readFileSync(new URL("./package.json", import.meta.url), "utf8"));
 
 export default defineConfig({
   plugins: [
@@ -10,6 +13,9 @@ export default defineConfig({
     sveltekit(),
     paraglideVitePlugin({ project: "./project.inlang", outdir: "./src/i18n" }),
   ],
+  define: {
+    __APP_VERSION__: JSON.stringify(pkg.version),
+  },
   test: {
     projects: [
       {