diff --git a/CHANGELOG.md b/CHANGELOG.md
index a7600f2..14ea418 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -23,6 +23,9 @@ Follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) · versioned wi
 - **Security Regression Coverage.** Added a Python test gate for character metadata validation, private-download URL
   rejection and oversized JSON request rejection.
 - **Navigation Reliability.** Rehearser phase requests now survive the feature-module initialization boundary.
+- **Container Hardening.** The web container now uses a read-only root filesystem,
+  drops all Linux capabilities, and enables `no-new-privileges`; application data remains writable only through
+  the declared mounts.
 
 ### Fixed
 - **SSRF and Credential-Leak Paths.** User-supplied downloads are validated against private-network access settings,
diff --git a/TODO.md b/TODO.md
index 9592faa..11b2e11 100644
--- a/TODO.md
+++ b/TODO.md
@@ -33,9 +33,9 @@ the first block before investing in architecture or polish.
   malformed records at API boundaries.
 - [x] **L — Add database migrations and prompt/generation history.** Preserve old record
   shapes and allow bad regenerations to be reverted.
-- [ ] **L — Harden container and Docker access.** Run as non-root with dropped
-  capabilities/read-only filesystems where practical, and isolate Docker socket access
-  behind a minimal privileged service.
+- [ ] **L — Harden container and Docker access.** The app now runs non-root with
+  dropped capabilities, no-new-privileges and a read-only root filesystem; isolate
+  the remaining Docker socket access behind a minimal privileged service.
 
 ### P1 — next, highest user impact
 
diff --git a/docker-compose.yml b/docker-compose.yml
index aed8d5a..026ebaf 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -7,6 +7,16 @@ services:
     container_name: tts-voice-creator-clone-and-design-2
     restart: unless-stopped
 
+    # The application writes only to the explicitly mounted data paths below.
+    # Keep the image filesystem immutable even if an endpoint is compromised.
+    read_only: true
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    tmpfs:
+      - /tmp:size=1g,mode=1777
+
     # Keep a runaway OCR/import/generation request from consuming all host RAM.
     # Override these per machine when large PDF jobs need more headroom:
     # APP_MEM_LIMIT=12g APP_MEM_RESERVATION=2g docker compose up -d