diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index e812d06..f86e5a1 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -36,6 +36,20 @@ jobs:
       - name: Run E2E tests
         run: docker compose run --rm tests
 
+      - name: Serve on GEO_PORT as a non-root user
+        run: |
+          docker run -d --name geo-port --user 82:82 --cap-drop ALL \
+            --sysctl net.ipv4.ip_unprivileged_port_start=1024 \
+            -e GEO_PORT=8081 -e GEO_SECRET=test-secret -p 8081:8081 geo-dev
+          for i in $(seq 1 30); do
+            if curl -sf http://localhost:8081/v1/health; then
+              exit 0
+            fi
+            sleep 1
+          done
+          docker logs geo-port
+          exit 1
+
       - name: Show logs on failure
         if: failure()
         run: docker compose logs geo
diff --git a/Dockerfile b/Dockerfile
index 05b867e..d409658 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -27,6 +27,6 @@ COPY ./src /usr/src/code/src
 EXPOSE 80
 
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
-    CMD php -r "exit(str_contains(file_get_contents('http://localhost:80/v1/health'), 'ok') ? 0 : 1);"
+    CMD php -r "exit(str_contains(file_get_contents('http://localhost:' . (getenv('GEO_PORT') ?: '80') . '/v1/health'), 'ok') ? 0 : 1);"
 
 CMD ["php", "app/http.php"]
diff --git a/src/Geo/Server/Server.php b/src/Geo/Server/Server.php
index 7bef392..0f3bee7 100644
--- a/src/Geo/Server/Server.php
+++ b/src/Geo/Server/Server.php
@@ -39,7 +39,7 @@ public function __construct(?Http $http = null)
         $http ??= new Http(
             new SwooleServer(
                 host: '0.0.0.0',
-                port: '80',
+                port: (string) System::getEnv('GEO_PORT', '80'),
                 settings: [
                     'enable_coroutine' => true,
                 ],