diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 290dca1..d537e0d 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -15,3 +15,7 @@ updates:
   - package-ecosystem: docker
     directory: /
     schedule: { interval: monthly }
+    ignore:
+      # Python stays on the version servers run (Debian 12 ships 3.11). Move it on purpose.
+      - dependency-name: python
+        update-types: ["version-update:semver-major", "version-update:semver-minor"]
diff --git a/Dockerfile b/Dockerfile
index 2089a50..68442f4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -7,7 +7,7 @@ COPY web/ ./
 RUN npm run build
 
 # Stage 2: the logger
-FROM python:3.15-slim
+FROM python:3.11-slim
 
 LABEL org.opencontainers.image.title="Net Logger" \
       org.opencontainers.image.description="Receive-only check-in logger for AllStar ham radio nets" \
diff --git a/install.sh b/install.sh
index 0d7a437..04b96fe 100755
--- a/install.sh
+++ b/install.sh
@@ -259,6 +259,10 @@ if [ ! -f "$APP_DIR/web/dist/index.html" ]; then
       || die "Couldn't get the dashboard. Install Node 20+ (apt install nodejs npm) and run this again."
   fi
 fi
+# Code and dashboard are owned by root and readable by the service, whatever permissions
+# they arrived with (a copy from a Mac can carry owner-only files)
+chown -R root:root "$APP_DIR/netlogger" "$APP_DIR/web/dist"
+chmod -R u=rwX,go=rX "$APP_DIR/netlogger" "$APP_DIR/web/dist"
 ok "dashboard ready"
 
 # Settings: sized to this machine, kept on later runs