diff --git a/Dockerfile b/Dockerfile
index 05b59c2..ecc1e59 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -23,5 +23,8 @@ ENV S3_ENDPOINT=s3.msk-1.ngcloud.ru \
     PORT=5000
 # ── Secrets in UI jsonEnv: S3_ACCESS_KEY, S3_SECRET_KEY ───────────────────
 
+RUN adduser -D -u 1000 registry
+USER registry
+
 EXPOSE 5000
 CMD ["/registry"]
diff --git a/server/handlers.go b/server/handlers.go
index be73de5..5690019 100644
--- a/server/handlers.go
+++ b/server/handlers.go
@@ -64,7 +64,12 @@ func rootHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	tmpl, _ := templateFS.ReadFile("templates/index.html")
+	tmpl, err := templateFS.ReadFile("templates/index.html")
+	if err != nil {
+		log.Printf("root: template read error: %v", err)
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		return
+	}
 	html := strings.Replace(string(tmpl), "{{.Version}}", VERSION, 1)
 	fmt.Fprint(w, html)
 }
diff --git a/server/router_versions.go b/server/router_versions.go
index e2df2c3..c9b1679 100644
--- a/server/router_versions.go
+++ b/server/router_versions.go
@@ -10,6 +10,7 @@ import (
 	"net/url"
 	"sort"
 	"strings"
+	"time"
 
 	s3 "github.com/minio/minio-go/v7"
 )
@@ -36,7 +37,10 @@ func listVersions(w http.ResponseWriter, namespace, pType string) {
 	versions := []Version{}
 	seenVersions := map[string]*Version{}
 
-	objectCh := s3Client.ListObjects(context.Background(), bucketName, s3.ListObjectsOptions{
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	objectCh := s3Client.ListObjects(ctx, bucketName, s3.ListObjectsOptions{
 		Prefix:    prefix,
 		Recursive: true,
 	})
@@ -96,7 +100,9 @@ func downloadVersion(w http.ResponseWriter, namespace, pType, version, osType, a
 	sigKey := fmt.Sprintf("%s/terraform-provider-%s_%s_SHA256SUMS.sig", basePath, pType, version)
 
 	var shasumValue string
-	shasumsObj, err := s3Client.GetObject(context.Background(), bucketName, shasumsKey, s3.GetObjectOptions{})
+	s3ctx, s3cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer s3cancel()
+	shasumsObj, err := s3Client.GetObject(s3ctx, bucketName, shasumsKey, s3.GetObjectOptions{})
 	if err == nil {
 		defer shasumsObj.Close()
 		scanner := bufio.NewScanner(shasumsObj)
@@ -116,9 +122,9 @@ func downloadVersion(w http.ResponseWriter, namespace, pType, version, osType, a
 	}
 
 	baseURL := "https://" + hostname
-	downloadLink := fmt.Sprintf("%s/v1/proxy?bucket=%s&key=%s", baseURL, bucketName, url.QueryEscape(fullKey))
-	shasumsLink := fmt.Sprintf("%s/v1/proxy?bucket=%s&key=%s", baseURL, bucketName, url.QueryEscape(shasumsKey))
-	sigLink := fmt.Sprintf("%s/v1/proxy?bucket=%s&key=%s", baseURL, bucketName, url.QueryEscape(sigKey))
+	downloadLink := fmt.Sprintf("%s/v1/proxy?key=%s", baseURL, url.QueryEscape(fullKey))
+	shasumsLink := fmt.Sprintf("%s/v1/proxy?key=%s", baseURL, url.QueryEscape(shasumsKey))
+	sigLink := fmt.Sprintf("%s/v1/proxy?key=%s", baseURL, url.QueryEscape(sigKey))
 
 	resp := DownloadResponse{
 		Protocols:           []string{"5.0"},