diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b1df3e92a..28cf3ccfc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -189,6 +189,11 @@ jobs:
       - name: Build image with default channel dependencies
         run: docker build -t nanobot:test .
 
+      - name: Verify Docker Compose startup
+        env:
+          HOME: ${{ runner.temp }}
+        run: docker compose run --rm --no-deps --build -T nanobot-cli status
+
       - name: Verify default WhatsApp dependencies
         run: docker run --rm --entrypoint python nanobot:test -c "import neonize, segno"
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 96d138e24..86706a8e0 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -8,6 +8,11 @@ x-common-config: &common-config
     - ~/.nanobot:/home/nanobot/.nanobot
   cap_drop:
     - ALL
+  # Entrypoint uses these to fix bind-mount ownership and drop to the nanobot user.
+  cap_add:
+    - CHOWN
+    - SETGID
+    - SETUID
 
 services:
   nanobot-gateway: