diff --git a/build-analytics-backend-workspace.sh b/build-analytics-backend-workspace.sh
old mode 100644
new mode 100755
index 592eec2..72c9a2e
--- a/build-analytics-backend-workspace.sh
+++ b/build-analytics-backend-workspace.sh
@@ -5,54 +5,48 @@
 set -euo pipefail
 
 IMG_NAME="analytics-backend-workspace"
+DEV_USER=devuser
 SECURE=/opt/secure
-DEV_HOME=/home/devuser
+DEV_HOME=/home/$DEV_USER
 
-ctr=$(buildah from registry.fedoraproject.org/fedora-minimal:40)
+ctr=$(buildah from registry.fedoraproject.org/fedora-minimal:42)
 
-buildah run "$ctr" -- bash -c "microdnf update -y &&
-  microdnf install -y &&
-  neovim git zsh tmux podman fzf fd ripgrep &&
-  java-17-openjdk maven shadow-utils gnupg attr &&
-  microdnf clean all &&
-  useradd -ms /bin/zsh devuser &&
-  echo 'devuser ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/devuser &&
-  mkdir -p $DEV_HOME/.gnupg $DEV_HOME/.git-credentials
+buildah run "$ctr" -- bash -c "
+  microdnf update -y && microdnf install -y neovim git zsh tmux podman \
+  fzf fd ripgrep java-devel maven gnupg attr && \
+  microdnf clean all && useradd -ms /bin/zsh $DEV_USER && \
+  useradd --system --no-create-home --shell /usr/sbin/nologin viewer && \
+  usermod -aG $DEV_USER viewer && mkdir -p /tmp/tmux-shared && \
+  chmod 750 /tmp/tmux-shared && chown $DEV_USER:$DEV_USER /tmp/tmux-shared \
+  mkdir -p $DEV_HOME/.gnupg && chmod 700 $DEV_HOME/.gnupg && \
+  chown $DEV_USER:$DEV_USER $DEV_HOME/.gnupg
 "
+# copy start script
+buildah copy "$ctr" start.sh /start.sh
 
 # copy ssh setup
 buildah copy "$ctr" ssh /"$SECURE"/ssh
 
-# copy neovim and tmux setup
-buildah copy "$ctr" config /home/devuser/.config
-buildah copy "$ctr" local /home/devuser/.local
+# copy zshrc, neovim and tmux setup
+buildah copy "$ctr" zshrc $DEV_HOME/.zshrc
+buildah copy "$ctr" config $DEV_HOME/.config
+buildah copy "$ctr" local $DEV_HOME/.local
 
 # zsh and tmux config (immutable)
-buildah copy "$ctr" zshrc /home/devuser/.zshrc
-buildah run "$ctr" -- chmod -R 600 /home/devuser/.zshrc
-buildah run "$ctr" -- chattr +i /home/devuser/.zshrc
-buildah run "$ctr" -- bash -c 'echo "set -g mouse on" > /home/devuser/.tmux.conf'
-buildah run "$ctr" -- chattr +i /home/devuser/.config/tmux/tmux.conf.local
-
-# Git config and secrets placeholder (immutable)
-buildah run "$ctr" -- mkdir -p /home/devuser/.gnupg /home/devuser/.git-credentials
-buildah copy "$ctr" ./gitconfig /home/devuser/.gitconfig
-buildah copy "$ctr" ./gpg-key.asc /home/devuser/.gnupg/gpg-key.asc
-buildah run "$ctr" -- chattr +i /home/devuser/.gitconfig
-buildah run "$ctr" -- chattr +i /home/devuser/.gnupg/gpg-key.asc
-
-# Neovim config (immutable)
-buildah run "$ctr" -- chmod -R 600 /home/devuser/.config/nvim
-buildah run "$ctr" -- chattr -R +i /home/devuser/.config
-
-buildah run "$ctr" -- chown -R devuser:devuser /home/devuser
+buildah run "$ctr" -- bash -c "
+  find $DEV_HOME -type f -exec chmod 400 {} + && \
+  find $DEV_HOME -type d -exec chmod 500 {} + && \
+  find $DEV_HOME -mindepth 1 -exec chattr +i {} + && \
+  chmod -R 500 $SECURE && \
+  chattr -R +i $SECURE && \
+  chmod 511 /start.sh
+"
 
 buildah config \
-  --user devuser \
-  --workingdir /home/devuser \
+  --user $DEV_USER \
+  --workingdir /app \
   --env CONTAINER_HOST=unix:///run/podman/podman.sock \
-  --env GIT_SSH=/usr/local/bin/git-ssh-wrapper.sh \
-  --cmd '["/home/devuser/start.sh"]' \
+  --cmd ["$DEV_HOME/start.sh"] \
   "$ctr"
 
 buildah commit "$ctr" $IMG_NAME