diff --git a/docker/brouter/Dockerfile b/docker/brouter/Dockerfile
index c1dcf36..4c02262 100644
--- a/docker/brouter/Dockerfile
+++ b/docker/brouter/Dockerfile
@@ -10,11 +10,17 @@ RUN apt-get update && apt-get install -y --no-install-recommends wget unzip curl
     && mv "brouter-${BROUTER_VERSION}"/* . \
     && rmdir "brouter-${BROUTER_VERSION}" \
     && rm "brouter-${BROUTER_VERSION}.zip" \
-    && apt-get purge -y wget unzip && apt-get autoremove -y && rm -rf /var/lib/apt/lists/*
+    && apt-get purge -y unzip && apt-get autoremove -y && rm -rf /var/lib/apt/lists/*
 
 # Create non-root user and directories for segments and profiles
 RUN addgroup --system app && adduser --system --ingroup app app \
-    && mkdir -p /data/segments /data/profiles
+    && mkdir -p /data/segments /data/profiles \
+    && chown -R app:app /data
+
+# Install entrypoint + segment downloader
+COPY download-segments.sh /brouter/download-segments.sh
+COPY entrypoint.sh /brouter/entrypoint.sh
+RUN chmod +x /brouter/download-segments.sh /brouter/entrypoint.sh
 
 # Copy default profiles from release and rename JAR for simpler CMD
 RUN cp -r profiles2/* /data/profiles/ 2>/dev/null || true \
@@ -45,9 +51,10 @@ ENV JAVA_OPTS="-Xmx1024M -Xms256M -Xmn64M"
 # sets it to 16; flagship/CI keep the default.
 ENV BROUTER_THREADS=4
 
+# Entrypoint downloads segments on first start if /data/segments is empty,
+# then execs the CMD. Shell form on CMD so $JAVA_OPTS / $BROUTER_THREADS
+# expand at container start.
+ENTRYPOINT ["/brouter/entrypoint.sh"]
+
 # BRouter server: <segmentdir> <profiledir> <customprofiledir> <port> <maxthreads>
-# Shell form so $JAVA_OPTS and $BROUTER_THREADS expand at container start.
-CMD java $JAVA_OPTS -DmaxRunningTime=300 -cp brouter.jar \
-    btools.server.RouteServer \
-    /data/segments /data/profiles /data/profiles \
-    17777 $BROUTER_THREADS
+CMD ["sh", "-c", "java $JAVA_OPTS -DmaxRunningTime=300 -cp brouter.jar btools.server.RouteServer /data/segments /data/profiles /data/profiles 17777 $BROUTER_THREADS"]
diff --git a/docker/brouter/entrypoint.sh b/docker/brouter/entrypoint.sh
new file mode 100755
index 0000000..6936c31
--- /dev/null
+++ b/docker/brouter/entrypoint.sh
@@ -0,0 +1,16 @@
+#!/bin/bash
+set -euo pipefail
+
+SEGMENTS_DIR="/data/segments"
+
+# Auto-populate segments on first start. The named volume is empty after
+# `docker compose up`, which leaves BRouter returning 400 for every routing
+# request. Downloading here means a fresh checkout works end-to-end without
+# extra setup steps. On subsequent starts the rd5 files are already present
+# and we skip straight to the server.
+if ! ls "$SEGMENTS_DIR"/*.rd5 >/dev/null 2>&1; then
+  echo "No segments found in $SEGMENTS_DIR — downloading…"
+  /brouter/download-segments.sh "$SEGMENTS_DIR"
+fi
+
+exec "$@"