diff --git a/contrib/docker-compose/.env b/contrib/docker-compose/.env
index 9ad25eeff..f371e21ef 100644
--- a/contrib/docker-compose/.env
+++ b/contrib/docker-compose/.env
@@ -33,7 +33,7 @@ TZ="UTC"
 # Please do this before deploying an application!
 #
 # See: https://docs.pixelfed.org/technical-documentation/config/#app_key
-APP_KEY=""
+APP_KEY=base64:IvvWCuLmAAcyPBzDI+IH6OxnU9w2kTSYZrcg6F4m7Uk=
 
 # See: https://docs.pixelfed.org/technical-documentation/config/#app_name-1
 APP_NAME="Pixelfed Prod"
@@ -264,7 +264,7 @@ DB_HOST="db"
 DB_USERNAME="pixelfed"
 
 # See: https://docs.pixelfed.org/technical-documentation/config/#db_password
-DB_PASSWORD="__CHANGE_ME__"
+DB_PASSWORD="helloworld"
 
 # See: https://docs.pixelfed.org/technical-documentation/config/#db_database
 DB_DATABASE="pixelfed_prod"
diff --git a/contrib/docker/shared/root/docker/entrypoint.d/15-storage-permissions.sh b/contrib/docker/shared/root/docker/entrypoint.d/01-permissions.sh
similarity index 68%
rename from contrib/docker/shared/root/docker/entrypoint.d/15-storage-permissions.sh
rename to contrib/docker/shared/root/docker/entrypoint.d/01-permissions.sh
index 30a58c5a9..81d422ecd 100755
--- a/contrib/docker/shared/root/docker/entrypoint.d/15-storage-permissions.sh
+++ b/contrib/docker/shared/root/docker/entrypoint.d/01-permissions.sh
@@ -3,6 +3,11 @@ source /docker/helpers.sh
 
 entrypoint-set-script-name "$0"
 
+# Ensure the two Docker volumes are owned by the runtime user
+run-as-current-user chown --verbose ${RUNTIME_UID}:${RUNTIME_GID} "./.env"
+run-as-current-user chown --verbose ${RUNTIME_UID}:${RUNTIME_GID} "./bootstrap/cache"
+run-as-current-user chown --verbose ${RUNTIME_UID}:${RUNTIME_GID} "./storage"
+
 # Optionally fix ownership of configured paths
 : ${ENTRYPOINT_ENSURE_OWNERSHIP_PATHS:=""}
 
diff --git a/contrib/docker/shared/root/docker/entrypoint.d/10-storage.sh b/contrib/docker/shared/root/docker/entrypoint.d/10-storage.sh
index f0e467973..bb2f61f0a 100755
--- a/contrib/docker/shared/root/docker/entrypoint.d/10-storage.sh
+++ b/contrib/docker/shared/root/docker/entrypoint.d/10-storage.sh
@@ -3,9 +3,6 @@ source /docker/helpers.sh
 
 entrypoint-set-script-name "$0"
 
-run-as-current-user chown --verbose ${RUNTIME_UID}:${RUNTIME_GID} "./bootstrap/cache"
-run-as-current-user chown --verbose ${RUNTIME_UID}:${RUNTIME_GID} "./storage"
-
 # Copy the [storage/] skeleton files over the "real" [storage/] directory so assets are updated between versions
 run-as-runtime-user cp --recursive storage.skel/. ./storage/
 
diff --git a/contrib/docker/shared/root/docker/entrypoint.d/11-first-time-setup.sh b/contrib/docker/shared/root/docker/entrypoint.d/11-first-time-setup.sh
new file mode 100755
index 000000000..0e30e74ac
--- /dev/null
+++ b/contrib/docker/shared/root/docker/entrypoint.d/11-first-time-setup.sh
@@ -0,0 +1,45 @@
+#!/bin/bash
+source /docker/helpers.sh
+
+entrypoint-set-script-name "$0"
+
+# if the script is running in another container, wait for it to complete
+while [ -e "./storage/docker-first-time-is-running" ]; do
+    sleep 1
+done
+
+# We got the lock!
+touch "./storage/docker-first-time-is-running"
+
+# Make sure to clean up on exit
+trap "rm -f ./storage/docker-first-time-is-running" EXIT
+
+if [ ! -e "./storage/docker-storage-link-has-run" ]; then
+    run-as-runtime-user php artisan storage:link
+    touch "./storage/docker-storage-link-has-run"
+fi
+
+if [ ! -e "./storage/docker-key-generate-has-run" ]; then
+    run-as-runtime-user php artisan key:generate
+    touch "./storage/docker-key-generate-has-run"
+fi
+
+if [ ! -e "./storage/docker-migrate-has-run" ]; then
+    run-as-runtime-user php artisan migrate --force
+    touch "./storage/docker-migrate-has-run"
+fi
+
+if [ ! -e "./storage/docker-import-cities-has-run" ]; then
+    run-as-runtime-user php artisan import:cities
+    touch "./storage/docker-import-cities-has-run"
+fi
+
+# if [ ! -e "./storage/docker-instance-actor-has-run" ]; then
+#     run-as-runtime-user php artisan instance:actor
+#     touch "./storage/docker-instance-actor-has-run"
+# fi
+
+# if [ ! -e "./storage/docker-passport-keys-has-run" ]; then
+#     run-as-runtime-user php artisan instance:actor
+#     touch "./storage/docker-passport-keys-has-run"
+# fi