diff --git a/deploy/all-in-one/supervisord.conf b/deploy/all-in-one/supervisord.conf
index bd19505..153aa7c 100644
--- a/deploy/all-in-one/supervisord.conf
+++ b/deploy/all-in-one/supervisord.conf
@@ -35,7 +35,7 @@ stderr_logfile_maxbytes=0
 priority=30
 
 [program:rspamd]
-command=/usr/bin/rspamd -f
+command=/usr/bin/rspamd -f -u _rspamd -g _rspamd
 autostart=true
 autorestart=true
 stdout_logfile=/dev/fd/1
diff --git a/deploy/dovecot/dovecot.conf b/deploy/dovecot/dovecot.conf
index 9187d71..079c283 100644
--- a/deploy/dovecot/dovecot.conf
+++ b/deploy/dovecot/dovecot.conf
@@ -12,11 +12,21 @@ ssl_key = </etc/ssl/private/ssl-cert-snakeoil.key
 mail_home = /var/mail/vhosts/%d/%n
 namespace inbox {
   inbox = yes
-  mailbox Drafts { special_use = \Drafts }
-  mailbox Sent { special_use = \Sent }
-  mailbox Trash { special_use = \Trash }
-  mailbox Archive { special_use = \Archive }
-  mailbox Spam { special_use = \Junk }
+  mailbox Drafts {
+    special_use = \Drafts
+  }
+  mailbox Sent {
+    special_use = \Sent
+  }
+  mailbox Trash {
+    special_use = \Trash
+  }
+  mailbox Archive {
+    special_use = \Archive
+  }
+  mailbox Spam {
+    special_use = \Junk
+  }
 }
 
 passdb {
@@ -29,11 +39,17 @@ userdb {
 }
 
 service imap-login {
-  inet_listener imaps { port = 993 ssl = yes }
+  inet_listener imaps {
+    port = 993
+    ssl = yes
+  }
 }
 
 service lmtp {
-  inet_listener lmtp { address = 0.0.0.0 port = 24 }
+  inet_listener lmtp {
+    address = 0.0.0.0
+    port = 24
+  }
 }
 
 service auth {
diff --git a/deploy/rspamd/entrypoint.sh b/deploy/rspamd/entrypoint.sh
index 6d0fbb7..72ba8cb 100644
--- a/deploy/rspamd/entrypoint.sh
+++ b/deploy/rspamd/entrypoint.sh
@@ -10,4 +10,9 @@ fi
 
 /usr/local/bin/lanqin-rspamd-sync-dkim --once || true
 /usr/local/bin/lanqin-rspamd-sync-dkim &
-exec rspamd -f
+if id _rspamd >/dev/null 2>&1; then
+  exec rspamd -f -u _rspamd -g _rspamd
+elif id rspamd >/dev/null 2>&1; then
+  exec rspamd -f -u rspamd -g rspamd
+fi
+exec rspamd -f --insecure