diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..f7dbbde
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,4 @@
+# Shell must stay LF: containers execute entrypoint scripts from the bind-mount
+# and dash rejects CRLF (a `set -e\r` line aborts startup with
+# "set: Illegal option -").
+*.sh text eol=lf
\ No newline at end of file
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8eab383..ffec58f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+### Fixed
+- LFX runtime user gets a home directory (`useradd -m`, `HOME` set):
+  without one every flow run failed with "Settings service not found".
 ### Security
 - Production ops: `scripts/check_prod.py` validates `.env` secrets and
   modes before deploy (with tests); README production checklist
diff --git a/Dockerfile.lfx b/Dockerfile.lfx
index 657e531..c533199 100644
--- a/Dockerfile.lfx
+++ b/Dockerfile.lfx
@@ -13,8 +13,11 @@ ENV PYTHONUNBUFFERED=1 \
 ARG LFX_VERSION=1.12.0
 RUN pip install "lfx~=${LFX_VERSION}" requests
 
-# Non-root runtime: uploads persist into the mounted volume.
-RUN useradd -r -s /bin/false lfx && mkdir -p /flows && chown lfx /flows
+# Non-root runtime: uploads persist into the mounted volume. The user needs
+# a home directory: lfx resolves settings/cache paths from $HOME, and
+# without one every flow run fails ("Settings service not found").
+ENV HOME=/home/lfx
+RUN useradd -r -m -s /bin/false lfx && mkdir -p /flows && chown lfx /flows
 VOLUME /flows
 EXPOSE 6004
 USER lfx