diff --git a/Dockerfile b/Dockerfile
index e550d4c0..71f5500a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,4 +15,9 @@ VOLUME ${ENKETO_SRC_DIR}/setup/docker/secrets
 
 EXPOSE 8005
 
-CMD ${ENKETO_SRC_DIR}/setup/docker/start.sh
+# Override the base image's ENTRYPOINT instead of passing arguments to it using
+# CMD, and use the "exec form" to avoid spawning an intermediary shell.
+# NB: Docker will not expand environment variables like ENKETO_SRC_DIR within
+# the ENTRYPOINT instruction; see
+# https://docs.docker.com/engine/reference/builder/#environment-replacement
+ENTRYPOINT ["/srv/src/enketo_express/setup/docker/start.sh"]