diff --git a/Dockerfile b/Dockerfile
index 140a30340..76f61ed87 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -10,7 +10,13 @@ RUN setcap cap_net_bind_service=+ep /coredns
 
 FROM ${BASE}
 COPY --from=build /coredns /coredns
-USER nonroot:nonroot
+# Use the numeric uid/gid (distroless "nonroot" is 65532) rather than the named
+# user so Kubernetes can verify the image runs as non-root when runAsNonRoot is
+# set. A named user is rejected at admission ("container has runAsNonRoot and
+# image has non-numeric user, cannot verify user is non-root"). The binary keeps
+# cap_net_bind_service (set in the build stage), so it can still bind :53.
+# Refs #7542.
+USER 65532:65532
 # Reset the working directory inherited from the base image back to the expected default:
 # https://github.com/coredns/coredns/issues/7009#issuecomment-3124851608
 WORKDIR /