diff --git a/docker-compose.yml b/docker-compose.yml
index f6811b2..d633c90 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -16,6 +16,9 @@ services:
         ELASTIC_VERSION: ${ELASTIC_VERSION}
     init: true
     volumes:
+      - ./setup/entrypoint.sh:/entrypoint.sh:ro,Z
+      - ./setup/helpers.sh:/helpers.sh:ro,Z
+      - ./setup/roles:/roles:ro,Z
       - setup:/state:Z
     environment:
       ELASTIC_PASSWORD: ${ELASTIC_PASSWORD:-}
diff --git a/setup/Dockerfile b/setup/Dockerfile
index 0b2ef90..5365a99 100644
--- a/setup/Dockerfile
+++ b/setup/Dockerfile
@@ -5,12 +5,10 @@ FROM docker.elastic.co/elasticsearch/elasticsearch:${ELASTIC_VERSION}
 
 USER root
 
-COPY . /
-
 RUN set -eux; \
 	mkdir /state; \
-	chown elasticsearch /state; \
-	chmod +x /entrypoint.sh
+	chmod 0775 /state; \
+	chown elasticsearch:root /state
 
 USER elasticsearch:root