diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..2f1cba2
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,8 @@
+# Auto detect text files and ensure LF for Linux scripts
+* text=auto eol=lf
+
+# Force LF for all files used inside Docker/Linux containers
+docker/rootfs/**/* text eol=lf
+docker/scripts/**/* text eol=lf
+*.sh text eol=lf
+Dockerfile text eol=lf
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 335d3a9..e19d6fc 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -47,6 +47,15 @@ RUN yarn install \
 COPY docker/rootfs /
 COPY --from=testca /home/step/certs/root_ca.crt /etc/ssl/certs/NginxProxyManager.crt
 
+# Fix CRLF line endings from Windows and set execute permissions on all s6 scripts
+RUN find /etc/s6-overlay -type f -exec sed -i 's/\r$//' {} + \
+	&& find /etc/s6-overlay/s6-rc.d -name 'run' -exec chmod +x {} + \
+	&& find /etc/s6-overlay/s6-rc.d -name 'up' -exec chmod +x {} + \
+	&& find /etc/s6-overlay/s6-rc.d -name '*.sh' -exec chmod +x {} + \
+	&& chmod +x /usr/bin/check-health 2>/dev/null || true \
+	&& sed -i 's/\r$//' /usr/bin/check-health /usr/bin/common.sh 2>/dev/null || true \
+	&& chmod +x /usr/bin/common.sh 2>/dev/null || true
+
 # Remove frontend service not required for prod, dev nginx config as well
 RUN rm -rf /etc/s6-overlay/s6-rc.d/user/contents.d/frontend /etc/nginx/conf.d/dev.conf \
 	&& chmod 644 /etc/logrotate.d/nginx-proxy-manager