diff --git a/defaults/main.yml b/defaults/main.yml
index 6a8d24c..f6ad151 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -51,7 +51,7 @@ immich_config_log_level: info
 immich_container_image: "{{ immich_container_image_registry_prefix }}imagegenius/immich:{{ immich_container_image_tag }}"
 immich_container_image_registry_prefix: ghcr.io/
 immich_container_image_tag: "{{ immich_distro_variant }}-{{ immich_version }}"
-immich_container_image_force_pull: "{{ immich_container_image_registry_prefix }}imagegenius/immich:latest"
+immich_container_image_force_pull: "{{ immich_container_image.endswith(':latest') }}"
 
 # The base container network. It will be auto-created by this role if it doesn't exist already.
 immich_container_network: "{{ immich_identifier }}"
@@ -78,6 +78,15 @@ immich_container_labels_traefik_entrypoints: web-secure
 immich_container_labels_traefik_tls: "{{ immich_container_labels_traefik_entrypoints != 'web' }}"
 immich_container_labels_traefik_tls_certResolver: default  # noqa var-naming
 
+# immich_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
+# See `roles/immich/immich/templates/labels.j2` for details.
+#
+# Example:
+# immich_container_labels_additional_labels: |
+#   my.label=1
+#   another.label="here"
+immich_container_labels_additional_labels: ''
+
 # A list of extra arguments to pass to the container
 immich_container_extra_arguments: []
 
diff --git a/templates/immich.service.j2 b/templates/immich.service.j2
index fe33b48..f456ccf 100644
--- a/templates/immich.service.j2
+++ b/templates/immich.service.j2
@@ -17,9 +17,6 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
 			--name={{ immich_identifier }} \
 			--log-driver=none \
 			--network={{ immich_container_network }} \
-			--user={{ immich_uid }}:{{ immich_gid }} \
-			--cap-drop=ALL \
-			--read-only \
 			--env-file={{ immich_base_path }}/env \
 			--label-file={{ immich_base_path }}/labels \
 			--mount type=bind,src={{ immich_config_dir_path }},dst=/config \