diff --git a/backend/docker_entrypoint.sh b/backend/docker_entrypoint.sh
index 0f9221c..dfff104 100644
--- a/backend/docker_entrypoint.sh
+++ b/backend/docker_entrypoint.sh
@@ -32,5 +32,19 @@ echo "[entrypoint] Running database migrations (alembic upgrade head)..."
 uv run --frozen alembic upgrade head
 echo "[entrypoint] Migrations complete."
 
+# Idempotent first-admin bootstrap. Only runs when ADMIN_EMAIL and
+# ADMIN_PASSWORD are provided; it creates/updates a super_admin user and org
+# (never overwrites an existing password). Optional in the image so a deployed
+# container can self-provision its first super_admin on startup.
+if [[ -n "${ADMIN_EMAIL:-}" && -n "${ADMIN_PASSWORD:-}" ]]; then
+  echo "[entrypoint] Bootstrapping first super_admin (${ADMIN_EMAIL})..."
+  uv run --frozen python scripts/bootstrap_super_admin.py \
+    --email "${ADMIN_EMAIL}" --password "${ADMIN_PASSWORD}" \
+    --org "${ADMIN_ORG_NAME:-Acme}" --slug "${ADMIN_ORG_SLUG:-}"
+  echo "[entrypoint] super_admin bootstrap complete."
+else
+  echo "[entrypoint] ADMIN_EMAIL/ADMIN_PASSWORD not set; skipping auto bootstrap."
+fi
+
 echo "[entrypoint] Starting supervisord (nginx + backend + worker)..."
 exec /usr/bin/supervisord -n