diff --git a/Dockerfile b/Dockerfile
index 2ee2449c..fd774305 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -43,7 +43,7 @@ RUN mkdir -p wp-content/plugins \
 RUN chown -R 82:82 wp-content \
   && tar -caf /wp-content.tgz --exclude="**/node_modules" wp-content
 
-FROM wordpress:6.9.1-fpm-alpine AS runtime
+FROM wordpress:7.0.2-fpm-alpine AS runtime
 LABEL org.opencontainers.image.description="WordPress image for Data Viz"
 LABEL org.opencontainers.image.authors="Development Gateway <info@developmentgateway.org>"
 LABEL org.opencontainers.image.url="https://github.com/devgateway/data-viz-wordpress"
@@ -57,5 +57,10 @@ COPY --chmod=755 wordpress.sh /usr/local/sbin/
 
 EXPOSE 80 443
 
+# Ensure WordPress core remains read-only for the PHP user; only wp-content needs to be writable
+RUN chown -R www-data:www-data /var/www/html/wp-content \
+    && find /var/www/html -type d -exec chmod 755 {} + \
+    && find /var/www/html -type f -exec chmod 644 {} +
+
 ENTRYPOINT ["/usr/local/sbin/wordpress.sh"]
 CMD ["php-fpm"]
\ No newline at end of file