diff --git a/Dockerfile b/Dockerfile
index ca17c9a0d179789e71fec5704c446fabc722e55c..5a6075e685cc11c5321a999ff8b74c22dab695e8 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,3 +4,5 @@ COPY conf /tmp/conf
 COPY build.sh /tmp/build.sh
 
 RUN /tmp/build.sh && rm /tmp/build.sh
+
+ENTRYPOINT ["/usr/local/bin/chaperone"]
diff --git a/build.sh b/build.sh
index e35ccaa337b3e6df0bd91ae5c6cd31b888aeac1b..6a6654020cc3ed4b4442b67d798c2e9aa61c9f52 100755
--- a/build.sh
+++ b/build.sh
@@ -5,7 +5,7 @@
 
 # Packages that are only used to build the container. These will be
 # removed once we're done.
-BUILD_PACKAGES="gnupg rsync"
+BUILD_PACKAGES="curl gnupg rsync apt-transport-https"
 
 # Packages to install.
 PACKAGES="
@@ -66,7 +66,7 @@ EOF
  echo "deb [arch=amd64] https://packages.elastic.co/curator/5/debian9 stable main") \
     > /etc/apt/sources.list.d/elastic.list
 
-apt-get -qq update
+apt-get update
 
 # If we do not install a JRE before ES, the installation will fail (huh?)...
 install_packages default-jre-headless
@@ -79,6 +79,10 @@ curl -sL ${EXPORTER_RELEASE_URL} \
     > /usr/sbin/elasticsearch_exporter
 chmod 755 /usr/sbin/elasticsearch_exporter
 
+# For some reason the Debian package installs the /etc/default file
+# with very restrictive permissions.
+chmod 644 /etc/default/elasticsearch
+
 # Overlay our configuration on top of /etc.
 rsync -a /tmp/conf/ /etc/
 
diff --git a/conf/chaperone.d/elasticsearch.conf b/conf/chaperone.d/elasticsearch.conf
index d4b210baba2f86b91dcb0320c82cfe8350790a57..e59ff070a1064923b7146bc05568365178b4b64f 100644
--- a/conf/chaperone.d/elasticsearch.conf
+++ b/conf/chaperone.d/elasticsearch.conf
@@ -1,5 +1,5 @@
 elasticsearch.service: {
-    command: "/bin/sh -c 'exec env ES_HOME=/usr/share/elasticsearch ES_PATH_CONF=/etc/elasticsearch /usr/share/elasticsearch/bin/elasticsearch -E http.port=${PORT}'",
+    command: "/bin/sh -c 'exec /usr/share/elasticsearch/bin/elasticsearch -E http.port=${PORT}'",
     kill_signal: SIGTERM,
     exit_kills: true,
 }