diff --git a/library/install.sh b/library/install.sh
index 5f7c849..334f356 100755
--- a/library/install.sh
+++ b/library/install.sh
@@ -116,7 +116,10 @@ dc up -d
 c_info "First start installs the database - waiting for the staff interface..."
 for i in $(seq 1 120); do
     if curl -fsS -o /dev/null "http://127.0.0.1:$STAFF_PORT/" 2>/dev/null; then READY=1; break; fi
-    if ! docker ps --format '{{.Names}}' | grep -qx library-koha; then c_err "library-koha stopped - see: docker logs library-koha"; exit 1; fi
+    # One restart is tolerated (Docker's restart policy); a crash loop is not.
+    if [ "$(docker inspect -f '{{.RestartCount}}' library-koha 2>/dev/null || echo 99)" -ge 3 ]; then
+        c_err "library-koha keeps crashing - see: docker logs library-koha"; exit 1
+    fi
     sleep 5
 done
 [ "${READY:-0}" = 1 ] || { c_err "Timed out - see: docker logs -f library-koha"; exit 1; }
diff --git a/library/koha/entrypoint.sh b/library/koha/entrypoint.sh
index f395132..aee233c 100755
--- a/library/koha/entrypoint.sh
+++ b/library/koha/entrypoint.sh
@@ -50,7 +50,15 @@ if [ ! -d "/etc/koha/sites/$INST" ]; then
         -e 's|^\(\s*\)Include /etc/koha/apache-shared-intranet.conf|\1Include /etc/koha/apache-shared-intranet-plack.conf|' \
         -e 's|^#\s*Include /etc/koha/apache-shared-opac-plack.conf||' \
         -e 's|^#\s*Include /etc/koha/apache-shared-intranet-plack.conf||' "$SITE"
-    koha-plack --enable "$INST" >/dev/null
+    koha-plack --enable "$INST" >/dev/null 2>&1 || true   # koha-create may already have enabled it
+
+    # Run Apache itself as the instance user instead of mpm_itk's per-vhost
+    # uid switching (which needs extra capabilities and is pointless here:
+    # Plack does the real work as that user already).
+    sed -i '/AssignUserID/d' "$SITE"
+    sed -i -e "s/^export APACHE_RUN_USER=.*/export APACHE_RUN_USER=$INST-koha/" \
+           -e "s/^export APACHE_RUN_GROUP=.*/export APACHE_RUN_GROUP=$INST-koha/" /etc/apache2/envvars
+    grep -q "^Listen $STAFF_PORT\b" /etc/apache2/ports.conf || echo "Listen $STAFF_PORT" >> /etc/apache2/ports.conf
     grep -q '^ServerName' /etc/apache2/apache2.conf || echo 'ServerName localhost' >> /etc/apache2/apache2.conf
 fi
 chown -R "$INST-koha:$INST-koha" "/var/lib/koha/$INST" "/var/log/koha/$INST" 2>/dev/null || true
@@ -68,13 +76,16 @@ else
     FIRST_RUN=0
 fi
 
-# --- 5. search index (Zebra) ------------------------------------------------
-koha-plack --restart "$INST" >/dev/null 2>&1 || koha-plack --start "$INST" >/dev/null 2>&1 || true
-koha-worker --restart "$INST" >/dev/null 2>&1 || true
+# --- 5. background services (their `daemon` processes die with the container,
+#        so they are started explicitly on every start) ------------------------
 if [ "$FIRST_RUN" = 1 ] || [ ! -e "/var/lib/koha/$INST/biblios/register" ]; then
     log "building search index..."
-    koha-rebuild-zebra -f -b -a -v "$INST" >/dev/null 2>&1 || koha-rebuild-zebra -f -v "$INST" || true
+    koha-rebuild-zebra -f -v "$INST" >/dev/null 2>&1 || true
 fi
+for svc in koha-zebra koha-indexer koha-worker koha-plack; do
+    "$svc" --restart "$INST" >/dev/null 2>&1 || "$svc" --start "$INST" >/dev/null 2>&1 \
+        || log "WARNING: could not start $svc"
+done
 
 log "ready - library catalogue on :80, staff interface on :$STAFF_PORT"
 exec apache2ctl -D FOREGROUND