diff --git a/canvas/Dockerfile b/canvas/Dockerfile
index f871bd07..14b28e7f 100644
--- a/canvas/Dockerfile
+++ b/canvas/Dockerfile
@@ -21,6 +21,10 @@ EXPOSE 3000
 ENV PORT=3000
 ENV HOSTNAME="0.0.0.0"
 # Non-root runtime — node image defaults to root, explicitly drop.
-RUN addgroup -g 1000 canvas && adduser -u 1000 -G canvas -s /bin/sh -D canvas
+# node:20-alpine ships with a `node` user at uid/gid 1000; remove it before
+# claiming 1000 for `canvas` so `addgroup -g 1000` doesn't collide.
+RUN deluser --remove-home node 2>/dev/null || true; \
+    delgroup node 2>/dev/null || true; \
+    addgroup -g 1000 canvas && adduser -u 1000 -G canvas -s /bin/sh -D canvas
 USER canvas
 CMD ["node", "server.js"]