diff --git a/deploy/docker/Dockerfile.nodered b/deploy/docker/Dockerfile.nodered
index 624b05c..573201a 100644
--- a/deploy/docker/Dockerfile.nodered
+++ b/deploy/docker/Dockerfile.nodered
@@ -11,9 +11,12 @@ USER root
 # Copy our nodes into a path outside /data (which is volume-mounted)
 COPY nodered /usr/src/betterframe-nodes
 
-# Settings file at a non-/data path so the nodered-data volume doesn't
-# overlay it. CMD passes --settings to point Node-RED at it.
+# Settings template + entrypoint that seeds /data/settings.js on first boot
+# (the /data named volume hides anything we COPY directly there, so we have
+# to plant the file after the volume mount comes up).
 COPY deploy/docker/nodered-settings.js /usr/src/bf-settings.js
+COPY deploy/docker/nodered-entrypoint.sh /usr/local/bin/bf-nodered-entrypoint
+RUN chmod +x /usr/local/bin/bf-nodered-entrypoint
 
 # Install deps for the nodes
 RUN cd /usr/src/betterframe-nodes && \
@@ -22,5 +25,5 @@ RUN cd /usr/src/betterframe-nodes && \
 
 USER node-red
 
-# Override the default CMD to use the baked settings.js.
-CMD ["npm", "start", "--cache", "/data/.npm", "--", "--userDir", "/data", "--settings", "/usr/src/bf-settings.js"]
+ENTRYPOINT ["/usr/local/bin/bf-nodered-entrypoint"]
+CMD []
diff --git a/deploy/docker/nodered-entrypoint.sh b/deploy/docker/nodered-entrypoint.sh
new file mode 100755
index 0000000..9356986
--- /dev/null
+++ b/deploy/docker/nodered-entrypoint.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env sh
+# Seed /data/settings.js with our BF defaults on first boot.
+# /data is volume-mounted, so the COPY in the Dockerfile gets hidden
+# unless we plant a copy after the mount comes up.
+set -eu
+
+DATA=/data
+TPL=/usr/src/bf-settings.js
+
+if [ ! -f "$DATA/settings.js" ]; then
+  echo "[bf-nodered] seeding $DATA/settings.js from $TPL"
+  cp "$TPL" "$DATA/settings.js"
+fi
+
+# Exec the upstream nodered entrypoint args verbatim.
+exec npm start --cache /data/.npm -- --userDir /data "$@"