diff --git a/ci/docker/daml-sdk/Dockerfile b/ci/docker/daml-sdk/Dockerfile
index b3dce07cf7..c5b58c519f 100644
--- a/ci/docker/daml-sdk/Dockerfile
+++ b/ci/docker/daml-sdk/Dockerfile
@@ -1,5 +1,7 @@
 FROM openjdk:8u212-alpine
 RUN apk add curl bash
 ARG VERSION
+RUN addgroup -S daml && adduser -S daml -G daml
+USER daml
 RUN curl https://get.daml.com | sh -s $VERSION
-ENV PATH="~/.daml/bin:${PATH}"
+ENV PATH="/home/daml/.daml/bin:${PATH}"
diff --git a/unreleased.rst b/unreleased.rst
index 3b7e0e6048..739a7e94ca 100644
--- a/unreleased.rst
+++ b/unreleased.rst
@@ -24,3 +24,5 @@ HEAD — ongoing
 + [Scala Codegen] Fixes for StackOverflowErrors in reading large LF archives. See `issue #3104 <https://github.com/digital-asset/daml/issues/3104>`_.
 + [Scala Bindings] Fixed a bug in the retry logic of ``LedgerClientBinding#retryingConfirmedCommands``. Commands are now only retried when the server responds with status ``RESOURCE_EXHAUSTED`` or ``UNAVAILABLE``.
 
++ [DAML-SDK Docker Image] The image now contains a ``daml`` user and the SDK is installed to ``/home/daml/.daml``.
+  ``/home/daml/.daml/bin`` is automatically added to ``PATH``.