diff --git a/telegraf-snmp-unifi/Dockerfile b/telegraf-snmp-unifi/Dockerfile
index 674165c..3774be0 100644
--- a/telegraf-snmp-unifi/Dockerfile
+++ b/telegraf-snmp-unifi/Dockerfile
@@ -1,6 +1,27 @@
-FROM telegraf:latest
+FROM buildpack-deps:bookworm-curl
 LABEL org.opencontainers.image.authors="dockerimage@dresi.wtf"
 
+RUN DEBIAN_FRONTEND=noninteractive apt-get update && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+      iputils-ping snmp procps lm-sensors libcap2-bin && \
+    rm -rf /var/lib/apt/lists/*
+
+RUN wget -q -O - https://repos.influxdata.com/influxdata-archive_compat.key | \
+    gpg --dearmor > /etc/apt/trusted.gpg.d/influxdata.gpg
+
+ENV TELEGRAF_VERSION=1.39.0
+RUN ARCH= && dpkgArch="$(dpkg --print-architecture)" && \
+    case "${dpkgArch##*-}" in \
+      amd64) ARCH='amd64';; \
+      arm64) ARCH='arm64';; \
+      *)     echo "Unsupported architecture: ${dpkgArch}"; exit 1;; \
+    esac && \
+    wget --no-verbose https://dl.influxdata.com/telegraf/releases/telegraf_${TELEGRAF_VERSION}-1_${ARCH}.deb.asc && \
+    wget --no-verbose https://dl.influxdata.com/telegraf/releases/telegraf_${TELEGRAF_VERSION}-1_${ARCH}.deb && \
+    gpg --batch --verify telegraf_${TELEGRAF_VERSION}-1_${ARCH}.deb.asc telegraf_${TELEGRAF_VERSION}-1_${ARCH}.deb && \
+    dpkg -i telegraf_${TELEGRAF_VERSION}-1_${ARCH}.deb && \
+    rm -f telegraf_${TELEGRAF_VERSION}-1_${ARCH}.deb*
+
 RUN cd /usr/share/snmp/mibs && \
     wget -q https://raw.githubusercontent.com/net-snmp/net-snmp/master/mibs/SNMPv2-SMI.txt \
             https://raw.githubusercontent.com/net-snmp/net-snmp/master/mibs/SNMPv2-TC.txt \
@@ -16,3 +37,8 @@ RUN cd /usr/share/snmp/mibs && \
     wget -q -O UBNT-UniFi-MIB \
       https://raw.githubusercontent.com/librenms/librenms/master/mibs/ubnt/UBNT-UniFi-MIB && \
     echo "mibs +ALL" >> /etc/snmp/snmp.conf
+
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+ENTRYPOINT ["/entrypoint.sh"]
+CMD ["telegraf"]
diff --git a/telegraf-snmp-unifi/entrypoint.sh b/telegraf-snmp-unifi/entrypoint.sh
new file mode 100644
index 0000000..8e0fa62
--- /dev/null
+++ b/telegraf-snmp-unifi/entrypoint.sh
@@ -0,0 +1,29 @@
+#!/bin/bash
+set -e
+
+if [ "${1:0:1}" = '-' ]; then
+    set -- telegraf "$@"
+fi
+
+if [ $EUID -ne 0 ]; then
+    exec "$@"
+else
+    # Allow telegraf to send ICMP packets and bind to privliged ports
+    setcap cap_net_raw,cap_net_bind_service+ep /usr/bin/telegraf || echo "Failed to set additional capabilities on /usr/bin/telegraf"
+
+    # ensure HOME is set to the telegraf user's home dir
+    export HOME=$(getent passwd telegraf | cut -d : -f 6)
+
+    # honor groups supplied via 'docker run --group-add ...' but drop 'root'
+    # (also removes 'telegraf' since we unconditionally add it and don't want it listed twice)
+    # see https://github.com/influxdata/influxdata-docker/issues/724
+    groups="telegraf"
+    extra_groups="$(id -Gn || true)"
+    for group in $extra_groups; do
+        case "$group" in
+            root | telegraf) ;;
+            *) groups="$groups,$group" ;;
+        esac
+    done
+    exec setpriv --reuid telegraf --regid telegraf --groups "$groups" "$@"
+fi