diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..c9e02df
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,7 @@
+# Force LF for anything that gets exec'd inside the (Linux) Docker image.
+# Checking these out with CRLF -- which happens by default on Windows
+# clones with core.autocrlf=true -- breaks `exec` at container startup
+# with a misleading "no such file or directory": the CRLF shebang line
+# doesn't resolve to a real interpreter path.
+*.sh text eol=lf
+Dockerfile text eol=lf
diff --git a/Dockerfile b/Dockerfile
index b6cc6b7..7af2223 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -38,7 +38,12 @@ COPY --from=build /app/prisma.config.ts ./prisma.config.ts
 COPY --from=build /app/package.json ./package.json
 COPY --from=build /app/next.config.ts ./next.config.ts
 COPY docker-entrypoint.sh ./docker-entrypoint.sh
-RUN chmod +x docker-entrypoint.sh
+# Strip any CRLF line endings before making it executable -- a CRLF
+# shebang (e.g. from a Windows checkout without .gitattributes honoring
+# `eol=lf`) makes the kernel look for a literal "/bin/sh\r" interpreter,
+# which fails with a misleading "no such file or directory" at container
+# startup. This keeps the image correct even if the checkout wasn't.
+RUN sed -i 's/\r$//' docker-entrypoint.sh && chmod +x docker-entrypoint.sh
 
 EXPOSE 3000
 ENTRYPOINT ["./docker-entrypoint.sh"]