diff --git a/containers/searxng/docker-compose.yml b/containers/searxng/docker-compose.yml
index 002b859..6cecb2b 100755
--- a/containers/searxng/docker-compose.yml
+++ b/containers/searxng/docker-compose.yml
@@ -30,6 +30,18 @@ services:
       - CHOWN
       - SETGID
       - SETUID
+      # DAC_OVERRIDE is required, not optional hardening slack. The image's
+      # entrypoint runs as root and, on first start, chowns the mounted config
+      # dir to searxng:searxng (uid 977) using CHOWN — then immediately copies
+      # settings.yml into the directory it just gave away. Without DAC_OVERRIDE
+      # root cannot write to a 0755 directory owned by another uid, so the copy
+      # failed and the container exited with:
+      #   cp: can't create '/etc/searxng/settings.yml': Permission denied
+      #   !!! "/etc/searxng/settings.yml" is not a valid file, exiting...
+      # It restart-looped forever and SearXNG never came up at all. Granting
+      # CHOWN without DAC_OVERRIDE is the specific combination that breaks;
+      # every other capability stays dropped.
+      - DAC_OVERRIDE
     logging:
       driver: "json-file"
       options: