diff --git a/27/apache/Dockerfile b/27/apache/Dockerfile
index 10b2e00f9..8b9a64fea 100644
--- a/27/apache/Dockerfile
+++ b/27/apache/Dockerfile
@@ -15,7 +15,7 @@ RUN set -ex; \
     rm -rf /var/lib/apt/lists/*; \
     \
     mkdir -p /var/spool/cron/crontabs; \
-    echo '*/5 * * * * php -f /var/www/html/cron.php' > /var/spool/cron/crontabs/www-data
+    echo '*/5 * * * * occ-cron' > /var/spool/cron/crontabs/www-data
 
 # install the PHP extensions we need
 # see https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html
@@ -167,7 +167,8 @@ RUN set -ex; \
     apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false $fetchDeps; \
     rm -rf /var/lib/apt/lists/*
 
-COPY *.sh upgrade.exclude /
+COPY entrypoint.sh cron.sh upgrade.exclude /
+COPY occ occ-cron /usr/local/bin/
 COPY config/* /usr/src/nextcloud/config/
 
 ENTRYPOINT ["/entrypoint.sh"]
diff --git a/27/apache/entrypoint.sh b/27/apache/entrypoint.sh
index 4e06fcc40..ef80647a4 100755
--- a/27/apache/entrypoint.sh
+++ b/27/apache/entrypoint.sh
@@ -11,14 +11,6 @@ directory_empty() {
     [ -z "$(ls -A "$1/")" ]
 }
 
-run_as() {
-    if [ "$(id -u)" = 0 ]; then
-        su -p "$user" -s /bin/sh -c "$1"
-    else
-        sh -c "$1"
-    fi
-}
-
 # Execute all executable files in a given directory in alphanumeric order
 run_path() {
     local hook_folder_path="/docker-entrypoint-hooks.d/$1"
@@ -40,7 +32,11 @@ run_path() {
 
             echo "==> Running the script (cwd: $(pwd)): \"${script_file_path}\""
 
-            run_as "${script_file_path}" || return_code="$?"
+            if [ "$(id -u)" = 0 ]; then
+                su -p "$user" -s /bin/sh "${script_file_path}" || return_code="$?"
+            else
+                "${script_file_path}" || return_code="$?"
+            fi
 
             if [ "${return_code}" -ne "0" ]; then
                 echo "==> Failed at executing \"${script_file_path}\". Exit code: ${return_code}"
@@ -163,7 +159,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                     exit 1
                 fi
                 echo "Upgrading nextcloud from $installed_version ..."
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
             fi
             if [ "$(id -u)" = 0 ]; then
                 rsync_options="-rlDog --chown $user:$group"
@@ -225,7 +221,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                         echo "Starting nextcloud installation"
                         max_retries=10
                         try=0
-                        until  [ "$try" -gt "$max_retries" ] || run_as "php /var/www/html/occ maintenance:install $install_options" 
+                        until [ "$try" -gt "$max_retries" ] || eval "occ maintenance:install $install_options"
                         do
                             echo "Retrying install..."
                             try=$((try+1))
@@ -240,7 +236,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                             NC_TRUSTED_DOMAIN_IDX=1
                             for DOMAIN in $NEXTCLOUD_TRUSTED_DOMAINS ; do
                                 DOMAIN=$(echo "$DOMAIN" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
-                                run_as "php /var/www/html/occ config:system:set trusted_domains $NC_TRUSTED_DOMAIN_IDX --value=$DOMAIN"
+                                occ config:system:set trusted_domains "$NC_TRUSTED_DOMAIN_IDX" --value="$DOMAIN"
                                 NC_TRUSTED_DOMAIN_IDX=$((NC_TRUSTED_DOMAIN_IDX+1))
                             done
                         fi
@@ -257,9 +253,9 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
             else
                 run_path pre-upgrade
 
-                run_as 'php /var/www/html/occ upgrade'
+                occ upgrade
 
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
                 echo "The following apps have been disabled:"
                 diff /tmp/list_before /tmp/list_after | grep '<' | cut -d- -f2 | cut -d: -f1
                 rm -f /tmp/list_before /tmp/list_after
@@ -272,7 +268,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
 
         # Update htaccess after init if requested
         if [ -n "${NEXTCLOUD_INIT_HTACCESS+x}" ] && [ "$installed_version" != "0.0.0.0" ]; then
-            run_as 'php /var/www/html/occ maintenance:update:htaccess'
+            occ maintenance:update:htaccess
         fi
     ) 9> /var/www/html/nextcloud-init-sync.lock
 
diff --git a/27/apache/occ b/27/apache/occ
new file mode 100755
index 000000000..70b08e7d3
--- /dev/null
+++ b/27/apache/occ
@@ -0,0 +1,14 @@
+#!/bin/sh
+set -eu
+
+[ -e /var/www/html/occ ] || { echo "Unable to run \`occ\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/occ ] || { echo "Unable to run \`occ\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/occ)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/occ -- "$@"' -- '/bin/sh' "$@"
+else
+    exec php -f /var/www/html/occ -- "$@"
+fi
diff --git a/27/apache/occ-cron b/27/apache/occ-cron
new file mode 100755
index 000000000..798cc175a
--- /dev/null
+++ b/27/apache/occ-cron
@@ -0,0 +1,19 @@
+#!/bin/sh
+set -eu
+
+if [ "$(occ status 2> /dev/null | sed -ne 's/^  - installed: \(.*\)$/\1/p')" != "true" ]; then
+    echo "Nextcloud is not installed - cronjobs are not available" >&2
+    exit 1
+fi
+
+[ -e /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/cron.php)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ-cron\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/cron.php' -- '/bin/sh'
+else
+    exec php -f /var/www/html/cron.php
+fi
diff --git a/27/fpm-alpine/Dockerfile b/27/fpm-alpine/Dockerfile
index 3f9ebe655..68bfba037 100644
--- a/27/fpm-alpine/Dockerfile
+++ b/27/fpm-alpine/Dockerfile
@@ -17,7 +17,7 @@ RUN set -ex; \
     ; \
     \
     rm /var/spool/cron/crontabs/root; \
-    echo '*/5 * * * * php -f /var/www/html/cron.php' > /var/spool/cron/crontabs/www-data
+    echo '*/5 * * * * occ-cron' > /var/spool/cron/crontabs/www-data
 
 # install the PHP extensions we need
 # see https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html
@@ -143,7 +143,8 @@ RUN set -ex; \
     chmod +x /usr/src/nextcloud/occ; \
     apk del --no-network .fetch-deps
 
-COPY *.sh upgrade.exclude /
+COPY entrypoint.sh cron.sh upgrade.exclude /
+COPY occ occ-cron /usr/local/bin/
 COPY config/* /usr/src/nextcloud/config/
 
 ENTRYPOINT ["/entrypoint.sh"]
diff --git a/27/fpm-alpine/entrypoint.sh b/27/fpm-alpine/entrypoint.sh
index 4e06fcc40..ef80647a4 100755
--- a/27/fpm-alpine/entrypoint.sh
+++ b/27/fpm-alpine/entrypoint.sh
@@ -11,14 +11,6 @@ directory_empty() {
     [ -z "$(ls -A "$1/")" ]
 }
 
-run_as() {
-    if [ "$(id -u)" = 0 ]; then
-        su -p "$user" -s /bin/sh -c "$1"
-    else
-        sh -c "$1"
-    fi
-}
-
 # Execute all executable files in a given directory in alphanumeric order
 run_path() {
     local hook_folder_path="/docker-entrypoint-hooks.d/$1"
@@ -40,7 +32,11 @@ run_path() {
 
             echo "==> Running the script (cwd: $(pwd)): \"${script_file_path}\""
 
-            run_as "${script_file_path}" || return_code="$?"
+            if [ "$(id -u)" = 0 ]; then
+                su -p "$user" -s /bin/sh "${script_file_path}" || return_code="$?"
+            else
+                "${script_file_path}" || return_code="$?"
+            fi
 
             if [ "${return_code}" -ne "0" ]; then
                 echo "==> Failed at executing \"${script_file_path}\". Exit code: ${return_code}"
@@ -163,7 +159,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                     exit 1
                 fi
                 echo "Upgrading nextcloud from $installed_version ..."
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
             fi
             if [ "$(id -u)" = 0 ]; then
                 rsync_options="-rlDog --chown $user:$group"
@@ -225,7 +221,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                         echo "Starting nextcloud installation"
                         max_retries=10
                         try=0
-                        until  [ "$try" -gt "$max_retries" ] || run_as "php /var/www/html/occ maintenance:install $install_options" 
+                        until [ "$try" -gt "$max_retries" ] || eval "occ maintenance:install $install_options"
                         do
                             echo "Retrying install..."
                             try=$((try+1))
@@ -240,7 +236,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                             NC_TRUSTED_DOMAIN_IDX=1
                             for DOMAIN in $NEXTCLOUD_TRUSTED_DOMAINS ; do
                                 DOMAIN=$(echo "$DOMAIN" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
-                                run_as "php /var/www/html/occ config:system:set trusted_domains $NC_TRUSTED_DOMAIN_IDX --value=$DOMAIN"
+                                occ config:system:set trusted_domains "$NC_TRUSTED_DOMAIN_IDX" --value="$DOMAIN"
                                 NC_TRUSTED_DOMAIN_IDX=$((NC_TRUSTED_DOMAIN_IDX+1))
                             done
                         fi
@@ -257,9 +253,9 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
             else
                 run_path pre-upgrade
 
-                run_as 'php /var/www/html/occ upgrade'
+                occ upgrade
 
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
                 echo "The following apps have been disabled:"
                 diff /tmp/list_before /tmp/list_after | grep '<' | cut -d- -f2 | cut -d: -f1
                 rm -f /tmp/list_before /tmp/list_after
@@ -272,7 +268,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
 
         # Update htaccess after init if requested
         if [ -n "${NEXTCLOUD_INIT_HTACCESS+x}" ] && [ "$installed_version" != "0.0.0.0" ]; then
-            run_as 'php /var/www/html/occ maintenance:update:htaccess'
+            occ maintenance:update:htaccess
         fi
     ) 9> /var/www/html/nextcloud-init-sync.lock
 
diff --git a/27/fpm-alpine/occ b/27/fpm-alpine/occ
new file mode 100755
index 000000000..70b08e7d3
--- /dev/null
+++ b/27/fpm-alpine/occ
@@ -0,0 +1,14 @@
+#!/bin/sh
+set -eu
+
+[ -e /var/www/html/occ ] || { echo "Unable to run \`occ\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/occ ] || { echo "Unable to run \`occ\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/occ)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/occ -- "$@"' -- '/bin/sh' "$@"
+else
+    exec php -f /var/www/html/occ -- "$@"
+fi
diff --git a/27/fpm-alpine/occ-cron b/27/fpm-alpine/occ-cron
new file mode 100755
index 000000000..798cc175a
--- /dev/null
+++ b/27/fpm-alpine/occ-cron
@@ -0,0 +1,19 @@
+#!/bin/sh
+set -eu
+
+if [ "$(occ status 2> /dev/null | sed -ne 's/^  - installed: \(.*\)$/\1/p')" != "true" ]; then
+    echo "Nextcloud is not installed - cronjobs are not available" >&2
+    exit 1
+fi
+
+[ -e /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/cron.php)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ-cron\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/cron.php' -- '/bin/sh'
+else
+    exec php -f /var/www/html/cron.php
+fi
diff --git a/27/fpm/Dockerfile b/27/fpm/Dockerfile
index 8602fcca7..25dcc6042 100644
--- a/27/fpm/Dockerfile
+++ b/27/fpm/Dockerfile
@@ -15,7 +15,7 @@ RUN set -ex; \
     rm -rf /var/lib/apt/lists/*; \
     \
     mkdir -p /var/spool/cron/crontabs; \
-    echo '*/5 * * * * php -f /var/www/html/cron.php' > /var/spool/cron/crontabs/www-data
+    echo '*/5 * * * * occ-cron' > /var/spool/cron/crontabs/www-data
 
 # install the PHP extensions we need
 # see https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html
@@ -152,7 +152,8 @@ RUN set -ex; \
     apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false $fetchDeps; \
     rm -rf /var/lib/apt/lists/*
 
-COPY *.sh upgrade.exclude /
+COPY entrypoint.sh cron.sh upgrade.exclude /
+COPY occ occ-cron /usr/local/bin/
 COPY config/* /usr/src/nextcloud/config/
 
 ENTRYPOINT ["/entrypoint.sh"]
diff --git a/27/fpm/entrypoint.sh b/27/fpm/entrypoint.sh
index 4e06fcc40..ef80647a4 100755
--- a/27/fpm/entrypoint.sh
+++ b/27/fpm/entrypoint.sh
@@ -11,14 +11,6 @@ directory_empty() {
     [ -z "$(ls -A "$1/")" ]
 }
 
-run_as() {
-    if [ "$(id -u)" = 0 ]; then
-        su -p "$user" -s /bin/sh -c "$1"
-    else
-        sh -c "$1"
-    fi
-}
-
 # Execute all executable files in a given directory in alphanumeric order
 run_path() {
     local hook_folder_path="/docker-entrypoint-hooks.d/$1"
@@ -40,7 +32,11 @@ run_path() {
 
             echo "==> Running the script (cwd: $(pwd)): \"${script_file_path}\""
 
-            run_as "${script_file_path}" || return_code="$?"
+            if [ "$(id -u)" = 0 ]; then
+                su -p "$user" -s /bin/sh "${script_file_path}" || return_code="$?"
+            else
+                "${script_file_path}" || return_code="$?"
+            fi
 
             if [ "${return_code}" -ne "0" ]; then
                 echo "==> Failed at executing \"${script_file_path}\". Exit code: ${return_code}"
@@ -163,7 +159,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                     exit 1
                 fi
                 echo "Upgrading nextcloud from $installed_version ..."
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
             fi
             if [ "$(id -u)" = 0 ]; then
                 rsync_options="-rlDog --chown $user:$group"
@@ -225,7 +221,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                         echo "Starting nextcloud installation"
                         max_retries=10
                         try=0
-                        until  [ "$try" -gt "$max_retries" ] || run_as "php /var/www/html/occ maintenance:install $install_options" 
+                        until [ "$try" -gt "$max_retries" ] || eval "occ maintenance:install $install_options"
                         do
                             echo "Retrying install..."
                             try=$((try+1))
@@ -240,7 +236,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                             NC_TRUSTED_DOMAIN_IDX=1
                             for DOMAIN in $NEXTCLOUD_TRUSTED_DOMAINS ; do
                                 DOMAIN=$(echo "$DOMAIN" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
-                                run_as "php /var/www/html/occ config:system:set trusted_domains $NC_TRUSTED_DOMAIN_IDX --value=$DOMAIN"
+                                occ config:system:set trusted_domains "$NC_TRUSTED_DOMAIN_IDX" --value="$DOMAIN"
                                 NC_TRUSTED_DOMAIN_IDX=$((NC_TRUSTED_DOMAIN_IDX+1))
                             done
                         fi
@@ -257,9 +253,9 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
             else
                 run_path pre-upgrade
 
-                run_as 'php /var/www/html/occ upgrade'
+                occ upgrade
 
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
                 echo "The following apps have been disabled:"
                 diff /tmp/list_before /tmp/list_after | grep '<' | cut -d- -f2 | cut -d: -f1
                 rm -f /tmp/list_before /tmp/list_after
@@ -272,7 +268,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
 
         # Update htaccess after init if requested
         if [ -n "${NEXTCLOUD_INIT_HTACCESS+x}" ] && [ "$installed_version" != "0.0.0.0" ]; then
-            run_as 'php /var/www/html/occ maintenance:update:htaccess'
+            occ maintenance:update:htaccess
         fi
     ) 9> /var/www/html/nextcloud-init-sync.lock
 
diff --git a/27/fpm/occ b/27/fpm/occ
new file mode 100755
index 000000000..70b08e7d3
--- /dev/null
+++ b/27/fpm/occ
@@ -0,0 +1,14 @@
+#!/bin/sh
+set -eu
+
+[ -e /var/www/html/occ ] || { echo "Unable to run \`occ\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/occ ] || { echo "Unable to run \`occ\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/occ)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/occ -- "$@"' -- '/bin/sh' "$@"
+else
+    exec php -f /var/www/html/occ -- "$@"
+fi
diff --git a/27/fpm/occ-cron b/27/fpm/occ-cron
new file mode 100755
index 000000000..798cc175a
--- /dev/null
+++ b/27/fpm/occ-cron
@@ -0,0 +1,19 @@
+#!/bin/sh
+set -eu
+
+if [ "$(occ status 2> /dev/null | sed -ne 's/^  - installed: \(.*\)$/\1/p')" != "true" ]; then
+    echo "Nextcloud is not installed - cronjobs are not available" >&2
+    exit 1
+fi
+
+[ -e /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/cron.php)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ-cron\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/cron.php' -- '/bin/sh'
+else
+    exec php -f /var/www/html/cron.php
+fi
diff --git a/28/apache/Dockerfile b/28/apache/Dockerfile
index c4089c5f6..d31bfc2a6 100644
--- a/28/apache/Dockerfile
+++ b/28/apache/Dockerfile
@@ -15,7 +15,7 @@ RUN set -ex; \
     rm -rf /var/lib/apt/lists/*; \
     \
     mkdir -p /var/spool/cron/crontabs; \
-    echo '*/5 * * * * php -f /var/www/html/cron.php' > /var/spool/cron/crontabs/www-data
+    echo '*/5 * * * * occ-cron' > /var/spool/cron/crontabs/www-data
 
 # install the PHP extensions we need
 # see https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html
@@ -167,7 +167,8 @@ RUN set -ex; \
     apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false $fetchDeps; \
     rm -rf /var/lib/apt/lists/*
 
-COPY *.sh upgrade.exclude /
+COPY entrypoint.sh cron.sh upgrade.exclude /
+COPY occ occ-cron /usr/local/bin/
 COPY config/* /usr/src/nextcloud/config/
 
 ENTRYPOINT ["/entrypoint.sh"]
diff --git a/28/apache/entrypoint.sh b/28/apache/entrypoint.sh
index 4e06fcc40..ef80647a4 100755
--- a/28/apache/entrypoint.sh
+++ b/28/apache/entrypoint.sh
@@ -11,14 +11,6 @@ directory_empty() {
     [ -z "$(ls -A "$1/")" ]
 }
 
-run_as() {
-    if [ "$(id -u)" = 0 ]; then
-        su -p "$user" -s /bin/sh -c "$1"
-    else
-        sh -c "$1"
-    fi
-}
-
 # Execute all executable files in a given directory in alphanumeric order
 run_path() {
     local hook_folder_path="/docker-entrypoint-hooks.d/$1"
@@ -40,7 +32,11 @@ run_path() {
 
             echo "==> Running the script (cwd: $(pwd)): \"${script_file_path}\""
 
-            run_as "${script_file_path}" || return_code="$?"
+            if [ "$(id -u)" = 0 ]; then
+                su -p "$user" -s /bin/sh "${script_file_path}" || return_code="$?"
+            else
+                "${script_file_path}" || return_code="$?"
+            fi
 
             if [ "${return_code}" -ne "0" ]; then
                 echo "==> Failed at executing \"${script_file_path}\". Exit code: ${return_code}"
@@ -163,7 +159,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                     exit 1
                 fi
                 echo "Upgrading nextcloud from $installed_version ..."
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
             fi
             if [ "$(id -u)" = 0 ]; then
                 rsync_options="-rlDog --chown $user:$group"
@@ -225,7 +221,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                         echo "Starting nextcloud installation"
                         max_retries=10
                         try=0
-                        until  [ "$try" -gt "$max_retries" ] || run_as "php /var/www/html/occ maintenance:install $install_options" 
+                        until [ "$try" -gt "$max_retries" ] || eval "occ maintenance:install $install_options"
                         do
                             echo "Retrying install..."
                             try=$((try+1))
@@ -240,7 +236,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                             NC_TRUSTED_DOMAIN_IDX=1
                             for DOMAIN in $NEXTCLOUD_TRUSTED_DOMAINS ; do
                                 DOMAIN=$(echo "$DOMAIN" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
-                                run_as "php /var/www/html/occ config:system:set trusted_domains $NC_TRUSTED_DOMAIN_IDX --value=$DOMAIN"
+                                occ config:system:set trusted_domains "$NC_TRUSTED_DOMAIN_IDX" --value="$DOMAIN"
                                 NC_TRUSTED_DOMAIN_IDX=$((NC_TRUSTED_DOMAIN_IDX+1))
                             done
                         fi
@@ -257,9 +253,9 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
             else
                 run_path pre-upgrade
 
-                run_as 'php /var/www/html/occ upgrade'
+                occ upgrade
 
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
                 echo "The following apps have been disabled:"
                 diff /tmp/list_before /tmp/list_after | grep '<' | cut -d- -f2 | cut -d: -f1
                 rm -f /tmp/list_before /tmp/list_after
@@ -272,7 +268,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
 
         # Update htaccess after init if requested
         if [ -n "${NEXTCLOUD_INIT_HTACCESS+x}" ] && [ "$installed_version" != "0.0.0.0" ]; then
-            run_as 'php /var/www/html/occ maintenance:update:htaccess'
+            occ maintenance:update:htaccess
         fi
     ) 9> /var/www/html/nextcloud-init-sync.lock
 
diff --git a/28/apache/occ b/28/apache/occ
new file mode 100755
index 000000000..70b08e7d3
--- /dev/null
+++ b/28/apache/occ
@@ -0,0 +1,14 @@
+#!/bin/sh
+set -eu
+
+[ -e /var/www/html/occ ] || { echo "Unable to run \`occ\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/occ ] || { echo "Unable to run \`occ\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/occ)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/occ -- "$@"' -- '/bin/sh' "$@"
+else
+    exec php -f /var/www/html/occ -- "$@"
+fi
diff --git a/28/apache/occ-cron b/28/apache/occ-cron
new file mode 100755
index 000000000..798cc175a
--- /dev/null
+++ b/28/apache/occ-cron
@@ -0,0 +1,19 @@
+#!/bin/sh
+set -eu
+
+if [ "$(occ status 2> /dev/null | sed -ne 's/^  - installed: \(.*\)$/\1/p')" != "true" ]; then
+    echo "Nextcloud is not installed - cronjobs are not available" >&2
+    exit 1
+fi
+
+[ -e /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/cron.php)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ-cron\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/cron.php' -- '/bin/sh'
+else
+    exec php -f /var/www/html/cron.php
+fi
diff --git a/28/fpm-alpine/Dockerfile b/28/fpm-alpine/Dockerfile
index 1c0df0a40..638a25848 100644
--- a/28/fpm-alpine/Dockerfile
+++ b/28/fpm-alpine/Dockerfile
@@ -17,7 +17,7 @@ RUN set -ex; \
     ; \
     \
     rm /var/spool/cron/crontabs/root; \
-    echo '*/5 * * * * php -f /var/www/html/cron.php' > /var/spool/cron/crontabs/www-data
+    echo '*/5 * * * * occ-cron' > /var/spool/cron/crontabs/www-data
 
 # install the PHP extensions we need
 # see https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html
@@ -143,7 +143,8 @@ RUN set -ex; \
     chmod +x /usr/src/nextcloud/occ; \
     apk del --no-network .fetch-deps
 
-COPY *.sh upgrade.exclude /
+COPY entrypoint.sh cron.sh upgrade.exclude /
+COPY occ occ-cron /usr/local/bin/
 COPY config/* /usr/src/nextcloud/config/
 
 ENTRYPOINT ["/entrypoint.sh"]
diff --git a/28/fpm-alpine/entrypoint.sh b/28/fpm-alpine/entrypoint.sh
index 4e06fcc40..ef80647a4 100755
--- a/28/fpm-alpine/entrypoint.sh
+++ b/28/fpm-alpine/entrypoint.sh
@@ -11,14 +11,6 @@ directory_empty() {
     [ -z "$(ls -A "$1/")" ]
 }
 
-run_as() {
-    if [ "$(id -u)" = 0 ]; then
-        su -p "$user" -s /bin/sh -c "$1"
-    else
-        sh -c "$1"
-    fi
-}
-
 # Execute all executable files in a given directory in alphanumeric order
 run_path() {
     local hook_folder_path="/docker-entrypoint-hooks.d/$1"
@@ -40,7 +32,11 @@ run_path() {
 
             echo "==> Running the script (cwd: $(pwd)): \"${script_file_path}\""
 
-            run_as "${script_file_path}" || return_code="$?"
+            if [ "$(id -u)" = 0 ]; then
+                su -p "$user" -s /bin/sh "${script_file_path}" || return_code="$?"
+            else
+                "${script_file_path}" || return_code="$?"
+            fi
 
             if [ "${return_code}" -ne "0" ]; then
                 echo "==> Failed at executing \"${script_file_path}\". Exit code: ${return_code}"
@@ -163,7 +159,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                     exit 1
                 fi
                 echo "Upgrading nextcloud from $installed_version ..."
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
             fi
             if [ "$(id -u)" = 0 ]; then
                 rsync_options="-rlDog --chown $user:$group"
@@ -225,7 +221,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                         echo "Starting nextcloud installation"
                         max_retries=10
                         try=0
-                        until  [ "$try" -gt "$max_retries" ] || run_as "php /var/www/html/occ maintenance:install $install_options" 
+                        until [ "$try" -gt "$max_retries" ] || eval "occ maintenance:install $install_options"
                         do
                             echo "Retrying install..."
                             try=$((try+1))
@@ -240,7 +236,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                             NC_TRUSTED_DOMAIN_IDX=1
                             for DOMAIN in $NEXTCLOUD_TRUSTED_DOMAINS ; do
                                 DOMAIN=$(echo "$DOMAIN" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
-                                run_as "php /var/www/html/occ config:system:set trusted_domains $NC_TRUSTED_DOMAIN_IDX --value=$DOMAIN"
+                                occ config:system:set trusted_domains "$NC_TRUSTED_DOMAIN_IDX" --value="$DOMAIN"
                                 NC_TRUSTED_DOMAIN_IDX=$((NC_TRUSTED_DOMAIN_IDX+1))
                             done
                         fi
@@ -257,9 +253,9 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
             else
                 run_path pre-upgrade
 
-                run_as 'php /var/www/html/occ upgrade'
+                occ upgrade
 
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
                 echo "The following apps have been disabled:"
                 diff /tmp/list_before /tmp/list_after | grep '<' | cut -d- -f2 | cut -d: -f1
                 rm -f /tmp/list_before /tmp/list_after
@@ -272,7 +268,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
 
         # Update htaccess after init if requested
         if [ -n "${NEXTCLOUD_INIT_HTACCESS+x}" ] && [ "$installed_version" != "0.0.0.0" ]; then
-            run_as 'php /var/www/html/occ maintenance:update:htaccess'
+            occ maintenance:update:htaccess
         fi
     ) 9> /var/www/html/nextcloud-init-sync.lock
 
diff --git a/28/fpm-alpine/occ b/28/fpm-alpine/occ
new file mode 100755
index 000000000..70b08e7d3
--- /dev/null
+++ b/28/fpm-alpine/occ
@@ -0,0 +1,14 @@
+#!/bin/sh
+set -eu
+
+[ -e /var/www/html/occ ] || { echo "Unable to run \`occ\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/occ ] || { echo "Unable to run \`occ\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/occ)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/occ -- "$@"' -- '/bin/sh' "$@"
+else
+    exec php -f /var/www/html/occ -- "$@"
+fi
diff --git a/28/fpm-alpine/occ-cron b/28/fpm-alpine/occ-cron
new file mode 100755
index 000000000..798cc175a
--- /dev/null
+++ b/28/fpm-alpine/occ-cron
@@ -0,0 +1,19 @@
+#!/bin/sh
+set -eu
+
+if [ "$(occ status 2> /dev/null | sed -ne 's/^  - installed: \(.*\)$/\1/p')" != "true" ]; then
+    echo "Nextcloud is not installed - cronjobs are not available" >&2
+    exit 1
+fi
+
+[ -e /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/cron.php)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ-cron\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/cron.php' -- '/bin/sh'
+else
+    exec php -f /var/www/html/cron.php
+fi
diff --git a/28/fpm/Dockerfile b/28/fpm/Dockerfile
index 593beb1bc..f443ea82f 100644
--- a/28/fpm/Dockerfile
+++ b/28/fpm/Dockerfile
@@ -15,7 +15,7 @@ RUN set -ex; \
     rm -rf /var/lib/apt/lists/*; \
     \
     mkdir -p /var/spool/cron/crontabs; \
-    echo '*/5 * * * * php -f /var/www/html/cron.php' > /var/spool/cron/crontabs/www-data
+    echo '*/5 * * * * occ-cron' > /var/spool/cron/crontabs/www-data
 
 # install the PHP extensions we need
 # see https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html
@@ -152,7 +152,8 @@ RUN set -ex; \
     apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false $fetchDeps; \
     rm -rf /var/lib/apt/lists/*
 
-COPY *.sh upgrade.exclude /
+COPY entrypoint.sh cron.sh upgrade.exclude /
+COPY occ occ-cron /usr/local/bin/
 COPY config/* /usr/src/nextcloud/config/
 
 ENTRYPOINT ["/entrypoint.sh"]
diff --git a/28/fpm/entrypoint.sh b/28/fpm/entrypoint.sh
index 4e06fcc40..ef80647a4 100755
--- a/28/fpm/entrypoint.sh
+++ b/28/fpm/entrypoint.sh
@@ -11,14 +11,6 @@ directory_empty() {
     [ -z "$(ls -A "$1/")" ]
 }
 
-run_as() {
-    if [ "$(id -u)" = 0 ]; then
-        su -p "$user" -s /bin/sh -c "$1"
-    else
-        sh -c "$1"
-    fi
-}
-
 # Execute all executable files in a given directory in alphanumeric order
 run_path() {
     local hook_folder_path="/docker-entrypoint-hooks.d/$1"
@@ -40,7 +32,11 @@ run_path() {
 
             echo "==> Running the script (cwd: $(pwd)): \"${script_file_path}\""
 
-            run_as "${script_file_path}" || return_code="$?"
+            if [ "$(id -u)" = 0 ]; then
+                su -p "$user" -s /bin/sh "${script_file_path}" || return_code="$?"
+            else
+                "${script_file_path}" || return_code="$?"
+            fi
 
             if [ "${return_code}" -ne "0" ]; then
                 echo "==> Failed at executing \"${script_file_path}\". Exit code: ${return_code}"
@@ -163,7 +159,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                     exit 1
                 fi
                 echo "Upgrading nextcloud from $installed_version ..."
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
             fi
             if [ "$(id -u)" = 0 ]; then
                 rsync_options="-rlDog --chown $user:$group"
@@ -225,7 +221,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                         echo "Starting nextcloud installation"
                         max_retries=10
                         try=0
-                        until  [ "$try" -gt "$max_retries" ] || run_as "php /var/www/html/occ maintenance:install $install_options" 
+                        until [ "$try" -gt "$max_retries" ] || eval "occ maintenance:install $install_options"
                         do
                             echo "Retrying install..."
                             try=$((try+1))
@@ -240,7 +236,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                             NC_TRUSTED_DOMAIN_IDX=1
                             for DOMAIN in $NEXTCLOUD_TRUSTED_DOMAINS ; do
                                 DOMAIN=$(echo "$DOMAIN" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
-                                run_as "php /var/www/html/occ config:system:set trusted_domains $NC_TRUSTED_DOMAIN_IDX --value=$DOMAIN"
+                                occ config:system:set trusted_domains "$NC_TRUSTED_DOMAIN_IDX" --value="$DOMAIN"
                                 NC_TRUSTED_DOMAIN_IDX=$((NC_TRUSTED_DOMAIN_IDX+1))
                             done
                         fi
@@ -257,9 +253,9 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
             else
                 run_path pre-upgrade
 
-                run_as 'php /var/www/html/occ upgrade'
+                occ upgrade
 
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
                 echo "The following apps have been disabled:"
                 diff /tmp/list_before /tmp/list_after | grep '<' | cut -d- -f2 | cut -d: -f1
                 rm -f /tmp/list_before /tmp/list_after
@@ -272,7 +268,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
 
         # Update htaccess after init if requested
         if [ -n "${NEXTCLOUD_INIT_HTACCESS+x}" ] && [ "$installed_version" != "0.0.0.0" ]; then
-            run_as 'php /var/www/html/occ maintenance:update:htaccess'
+            occ maintenance:update:htaccess
         fi
     ) 9> /var/www/html/nextcloud-init-sync.lock
 
diff --git a/28/fpm/occ b/28/fpm/occ
new file mode 100755
index 000000000..70b08e7d3
--- /dev/null
+++ b/28/fpm/occ
@@ -0,0 +1,14 @@
+#!/bin/sh
+set -eu
+
+[ -e /var/www/html/occ ] || { echo "Unable to run \`occ\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/occ ] || { echo "Unable to run \`occ\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/occ)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/occ -- "$@"' -- '/bin/sh' "$@"
+else
+    exec php -f /var/www/html/occ -- "$@"
+fi
diff --git a/28/fpm/occ-cron b/28/fpm/occ-cron
new file mode 100755
index 000000000..798cc175a
--- /dev/null
+++ b/28/fpm/occ-cron
@@ -0,0 +1,19 @@
+#!/bin/sh
+set -eu
+
+if [ "$(occ status 2> /dev/null | sed -ne 's/^  - installed: \(.*\)$/\1/p')" != "true" ]; then
+    echo "Nextcloud is not installed - cronjobs are not available" >&2
+    exit 1
+fi
+
+[ -e /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/cron.php)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ-cron\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/cron.php' -- '/bin/sh'
+else
+    exec php -f /var/www/html/cron.php
+fi
diff --git a/29/apache/Dockerfile b/29/apache/Dockerfile
index 1255bafeb..8b9dc15f4 100644
--- a/29/apache/Dockerfile
+++ b/29/apache/Dockerfile
@@ -15,7 +15,7 @@ RUN set -ex; \
     rm -rf /var/lib/apt/lists/*; \
     \
     mkdir -p /var/spool/cron/crontabs; \
-    echo '*/5 * * * * php -f /var/www/html/cron.php' > /var/spool/cron/crontabs/www-data
+    echo '*/5 * * * * occ-cron' > /var/spool/cron/crontabs/www-data
 
 # install the PHP extensions we need
 # see https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html
@@ -167,7 +167,8 @@ RUN set -ex; \
     apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false $fetchDeps; \
     rm -rf /var/lib/apt/lists/*
 
-COPY *.sh upgrade.exclude /
+COPY entrypoint.sh cron.sh upgrade.exclude /
+COPY occ occ-cron /usr/local/bin/
 COPY config/* /usr/src/nextcloud/config/
 
 ENTRYPOINT ["/entrypoint.sh"]
diff --git a/29/apache/entrypoint.sh b/29/apache/entrypoint.sh
index 4e06fcc40..ef80647a4 100755
--- a/29/apache/entrypoint.sh
+++ b/29/apache/entrypoint.sh
@@ -11,14 +11,6 @@ directory_empty() {
     [ -z "$(ls -A "$1/")" ]
 }
 
-run_as() {
-    if [ "$(id -u)" = 0 ]; then
-        su -p "$user" -s /bin/sh -c "$1"
-    else
-        sh -c "$1"
-    fi
-}
-
 # Execute all executable files in a given directory in alphanumeric order
 run_path() {
     local hook_folder_path="/docker-entrypoint-hooks.d/$1"
@@ -40,7 +32,11 @@ run_path() {
 
             echo "==> Running the script (cwd: $(pwd)): \"${script_file_path}\""
 
-            run_as "${script_file_path}" || return_code="$?"
+            if [ "$(id -u)" = 0 ]; then
+                su -p "$user" -s /bin/sh "${script_file_path}" || return_code="$?"
+            else
+                "${script_file_path}" || return_code="$?"
+            fi
 
             if [ "${return_code}" -ne "0" ]; then
                 echo "==> Failed at executing \"${script_file_path}\". Exit code: ${return_code}"
@@ -163,7 +159,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                     exit 1
                 fi
                 echo "Upgrading nextcloud from $installed_version ..."
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
             fi
             if [ "$(id -u)" = 0 ]; then
                 rsync_options="-rlDog --chown $user:$group"
@@ -225,7 +221,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                         echo "Starting nextcloud installation"
                         max_retries=10
                         try=0
-                        until  [ "$try" -gt "$max_retries" ] || run_as "php /var/www/html/occ maintenance:install $install_options" 
+                        until [ "$try" -gt "$max_retries" ] || eval "occ maintenance:install $install_options"
                         do
                             echo "Retrying install..."
                             try=$((try+1))
@@ -240,7 +236,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                             NC_TRUSTED_DOMAIN_IDX=1
                             for DOMAIN in $NEXTCLOUD_TRUSTED_DOMAINS ; do
                                 DOMAIN=$(echo "$DOMAIN" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
-                                run_as "php /var/www/html/occ config:system:set trusted_domains $NC_TRUSTED_DOMAIN_IDX --value=$DOMAIN"
+                                occ config:system:set trusted_domains "$NC_TRUSTED_DOMAIN_IDX" --value="$DOMAIN"
                                 NC_TRUSTED_DOMAIN_IDX=$((NC_TRUSTED_DOMAIN_IDX+1))
                             done
                         fi
@@ -257,9 +253,9 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
             else
                 run_path pre-upgrade
 
-                run_as 'php /var/www/html/occ upgrade'
+                occ upgrade
 
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
                 echo "The following apps have been disabled:"
                 diff /tmp/list_before /tmp/list_after | grep '<' | cut -d- -f2 | cut -d: -f1
                 rm -f /tmp/list_before /tmp/list_after
@@ -272,7 +268,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
 
         # Update htaccess after init if requested
         if [ -n "${NEXTCLOUD_INIT_HTACCESS+x}" ] && [ "$installed_version" != "0.0.0.0" ]; then
-            run_as 'php /var/www/html/occ maintenance:update:htaccess'
+            occ maintenance:update:htaccess
         fi
     ) 9> /var/www/html/nextcloud-init-sync.lock
 
diff --git a/29/apache/occ b/29/apache/occ
new file mode 100755
index 000000000..70b08e7d3
--- /dev/null
+++ b/29/apache/occ
@@ -0,0 +1,14 @@
+#!/bin/sh
+set -eu
+
+[ -e /var/www/html/occ ] || { echo "Unable to run \`occ\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/occ ] || { echo "Unable to run \`occ\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/occ)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/occ -- "$@"' -- '/bin/sh' "$@"
+else
+    exec php -f /var/www/html/occ -- "$@"
+fi
diff --git a/29/apache/occ-cron b/29/apache/occ-cron
new file mode 100755
index 000000000..798cc175a
--- /dev/null
+++ b/29/apache/occ-cron
@@ -0,0 +1,19 @@
+#!/bin/sh
+set -eu
+
+if [ "$(occ status 2> /dev/null | sed -ne 's/^  - installed: \(.*\)$/\1/p')" != "true" ]; then
+    echo "Nextcloud is not installed - cronjobs are not available" >&2
+    exit 1
+fi
+
+[ -e /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/cron.php)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ-cron\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/cron.php' -- '/bin/sh'
+else
+    exec php -f /var/www/html/cron.php
+fi
diff --git a/29/fpm-alpine/Dockerfile b/29/fpm-alpine/Dockerfile
index d36b0c9ec..d43b71fcb 100644
--- a/29/fpm-alpine/Dockerfile
+++ b/29/fpm-alpine/Dockerfile
@@ -17,7 +17,7 @@ RUN set -ex; \
     ; \
     \
     rm /var/spool/cron/crontabs/root; \
-    echo '*/5 * * * * php -f /var/www/html/cron.php' > /var/spool/cron/crontabs/www-data
+    echo '*/5 * * * * occ-cron' > /var/spool/cron/crontabs/www-data
 
 # install the PHP extensions we need
 # see https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html
@@ -143,7 +143,8 @@ RUN set -ex; \
     chmod +x /usr/src/nextcloud/occ; \
     apk del --no-network .fetch-deps
 
-COPY *.sh upgrade.exclude /
+COPY entrypoint.sh cron.sh upgrade.exclude /
+COPY occ occ-cron /usr/local/bin/
 COPY config/* /usr/src/nextcloud/config/
 
 ENTRYPOINT ["/entrypoint.sh"]
diff --git a/29/fpm-alpine/entrypoint.sh b/29/fpm-alpine/entrypoint.sh
index 4e06fcc40..ef80647a4 100755
--- a/29/fpm-alpine/entrypoint.sh
+++ b/29/fpm-alpine/entrypoint.sh
@@ -11,14 +11,6 @@ directory_empty() {
     [ -z "$(ls -A "$1/")" ]
 }
 
-run_as() {
-    if [ "$(id -u)" = 0 ]; then
-        su -p "$user" -s /bin/sh -c "$1"
-    else
-        sh -c "$1"
-    fi
-}
-
 # Execute all executable files in a given directory in alphanumeric order
 run_path() {
     local hook_folder_path="/docker-entrypoint-hooks.d/$1"
@@ -40,7 +32,11 @@ run_path() {
 
             echo "==> Running the script (cwd: $(pwd)): \"${script_file_path}\""
 
-            run_as "${script_file_path}" || return_code="$?"
+            if [ "$(id -u)" = 0 ]; then
+                su -p "$user" -s /bin/sh "${script_file_path}" || return_code="$?"
+            else
+                "${script_file_path}" || return_code="$?"
+            fi
 
             if [ "${return_code}" -ne "0" ]; then
                 echo "==> Failed at executing \"${script_file_path}\". Exit code: ${return_code}"
@@ -163,7 +159,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                     exit 1
                 fi
                 echo "Upgrading nextcloud from $installed_version ..."
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
             fi
             if [ "$(id -u)" = 0 ]; then
                 rsync_options="-rlDog --chown $user:$group"
@@ -225,7 +221,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                         echo "Starting nextcloud installation"
                         max_retries=10
                         try=0
-                        until  [ "$try" -gt "$max_retries" ] || run_as "php /var/www/html/occ maintenance:install $install_options" 
+                        until [ "$try" -gt "$max_retries" ] || eval "occ maintenance:install $install_options"
                         do
                             echo "Retrying install..."
                             try=$((try+1))
@@ -240,7 +236,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                             NC_TRUSTED_DOMAIN_IDX=1
                             for DOMAIN in $NEXTCLOUD_TRUSTED_DOMAINS ; do
                                 DOMAIN=$(echo "$DOMAIN" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
-                                run_as "php /var/www/html/occ config:system:set trusted_domains $NC_TRUSTED_DOMAIN_IDX --value=$DOMAIN"
+                                occ config:system:set trusted_domains "$NC_TRUSTED_DOMAIN_IDX" --value="$DOMAIN"
                                 NC_TRUSTED_DOMAIN_IDX=$((NC_TRUSTED_DOMAIN_IDX+1))
                             done
                         fi
@@ -257,9 +253,9 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
             else
                 run_path pre-upgrade
 
-                run_as 'php /var/www/html/occ upgrade'
+                occ upgrade
 
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
                 echo "The following apps have been disabled:"
                 diff /tmp/list_before /tmp/list_after | grep '<' | cut -d- -f2 | cut -d: -f1
                 rm -f /tmp/list_before /tmp/list_after
@@ -272,7 +268,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
 
         # Update htaccess after init if requested
         if [ -n "${NEXTCLOUD_INIT_HTACCESS+x}" ] && [ "$installed_version" != "0.0.0.0" ]; then
-            run_as 'php /var/www/html/occ maintenance:update:htaccess'
+            occ maintenance:update:htaccess
         fi
     ) 9> /var/www/html/nextcloud-init-sync.lock
 
diff --git a/29/fpm-alpine/occ b/29/fpm-alpine/occ
new file mode 100755
index 000000000..70b08e7d3
--- /dev/null
+++ b/29/fpm-alpine/occ
@@ -0,0 +1,14 @@
+#!/bin/sh
+set -eu
+
+[ -e /var/www/html/occ ] || { echo "Unable to run \`occ\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/occ ] || { echo "Unable to run \`occ\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/occ)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/occ -- "$@"' -- '/bin/sh' "$@"
+else
+    exec php -f /var/www/html/occ -- "$@"
+fi
diff --git a/29/fpm-alpine/occ-cron b/29/fpm-alpine/occ-cron
new file mode 100755
index 000000000..798cc175a
--- /dev/null
+++ b/29/fpm-alpine/occ-cron
@@ -0,0 +1,19 @@
+#!/bin/sh
+set -eu
+
+if [ "$(occ status 2> /dev/null | sed -ne 's/^  - installed: \(.*\)$/\1/p')" != "true" ]; then
+    echo "Nextcloud is not installed - cronjobs are not available" >&2
+    exit 1
+fi
+
+[ -e /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/cron.php)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ-cron\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/cron.php' -- '/bin/sh'
+else
+    exec php -f /var/www/html/cron.php
+fi
diff --git a/29/fpm/Dockerfile b/29/fpm/Dockerfile
index 8dc9a1f08..2fabf3ee5 100644
--- a/29/fpm/Dockerfile
+++ b/29/fpm/Dockerfile
@@ -15,7 +15,7 @@ RUN set -ex; \
     rm -rf /var/lib/apt/lists/*; \
     \
     mkdir -p /var/spool/cron/crontabs; \
-    echo '*/5 * * * * php -f /var/www/html/cron.php' > /var/spool/cron/crontabs/www-data
+    echo '*/5 * * * * occ-cron' > /var/spool/cron/crontabs/www-data
 
 # install the PHP extensions we need
 # see https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html
@@ -152,7 +152,8 @@ RUN set -ex; \
     apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false $fetchDeps; \
     rm -rf /var/lib/apt/lists/*
 
-COPY *.sh upgrade.exclude /
+COPY entrypoint.sh cron.sh upgrade.exclude /
+COPY occ occ-cron /usr/local/bin/
 COPY config/* /usr/src/nextcloud/config/
 
 ENTRYPOINT ["/entrypoint.sh"]
diff --git a/29/fpm/entrypoint.sh b/29/fpm/entrypoint.sh
index 4e06fcc40..ef80647a4 100755
--- a/29/fpm/entrypoint.sh
+++ b/29/fpm/entrypoint.sh
@@ -11,14 +11,6 @@ directory_empty() {
     [ -z "$(ls -A "$1/")" ]
 }
 
-run_as() {
-    if [ "$(id -u)" = 0 ]; then
-        su -p "$user" -s /bin/sh -c "$1"
-    else
-        sh -c "$1"
-    fi
-}
-
 # Execute all executable files in a given directory in alphanumeric order
 run_path() {
     local hook_folder_path="/docker-entrypoint-hooks.d/$1"
@@ -40,7 +32,11 @@ run_path() {
 
             echo "==> Running the script (cwd: $(pwd)): \"${script_file_path}\""
 
-            run_as "${script_file_path}" || return_code="$?"
+            if [ "$(id -u)" = 0 ]; then
+                su -p "$user" -s /bin/sh "${script_file_path}" || return_code="$?"
+            else
+                "${script_file_path}" || return_code="$?"
+            fi
 
             if [ "${return_code}" -ne "0" ]; then
                 echo "==> Failed at executing \"${script_file_path}\". Exit code: ${return_code}"
@@ -163,7 +159,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                     exit 1
                 fi
                 echo "Upgrading nextcloud from $installed_version ..."
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
             fi
             if [ "$(id -u)" = 0 ]; then
                 rsync_options="-rlDog --chown $user:$group"
@@ -225,7 +221,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                         echo "Starting nextcloud installation"
                         max_retries=10
                         try=0
-                        until  [ "$try" -gt "$max_retries" ] || run_as "php /var/www/html/occ maintenance:install $install_options" 
+                        until [ "$try" -gt "$max_retries" ] || eval "occ maintenance:install $install_options"
                         do
                             echo "Retrying install..."
                             try=$((try+1))
@@ -240,7 +236,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                             NC_TRUSTED_DOMAIN_IDX=1
                             for DOMAIN in $NEXTCLOUD_TRUSTED_DOMAINS ; do
                                 DOMAIN=$(echo "$DOMAIN" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
-                                run_as "php /var/www/html/occ config:system:set trusted_domains $NC_TRUSTED_DOMAIN_IDX --value=$DOMAIN"
+                                occ config:system:set trusted_domains "$NC_TRUSTED_DOMAIN_IDX" --value="$DOMAIN"
                                 NC_TRUSTED_DOMAIN_IDX=$((NC_TRUSTED_DOMAIN_IDX+1))
                             done
                         fi
@@ -257,9 +253,9 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
             else
                 run_path pre-upgrade
 
-                run_as 'php /var/www/html/occ upgrade'
+                occ upgrade
 
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
                 echo "The following apps have been disabled:"
                 diff /tmp/list_before /tmp/list_after | grep '<' | cut -d- -f2 | cut -d: -f1
                 rm -f /tmp/list_before /tmp/list_after
@@ -272,7 +268,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
 
         # Update htaccess after init if requested
         if [ -n "${NEXTCLOUD_INIT_HTACCESS+x}" ] && [ "$installed_version" != "0.0.0.0" ]; then
-            run_as 'php /var/www/html/occ maintenance:update:htaccess'
+            occ maintenance:update:htaccess
         fi
     ) 9> /var/www/html/nextcloud-init-sync.lock
 
diff --git a/29/fpm/occ b/29/fpm/occ
new file mode 100755
index 000000000..70b08e7d3
--- /dev/null
+++ b/29/fpm/occ
@@ -0,0 +1,14 @@
+#!/bin/sh
+set -eu
+
+[ -e /var/www/html/occ ] || { echo "Unable to run \`occ\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/occ ] || { echo "Unable to run \`occ\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/occ)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/occ -- "$@"' -- '/bin/sh' "$@"
+else
+    exec php -f /var/www/html/occ -- "$@"
+fi
diff --git a/29/fpm/occ-cron b/29/fpm/occ-cron
new file mode 100755
index 000000000..798cc175a
--- /dev/null
+++ b/29/fpm/occ-cron
@@ -0,0 +1,19 @@
+#!/bin/sh
+set -eu
+
+if [ "$(occ status 2> /dev/null | sed -ne 's/^  - installed: \(.*\)$/\1/p')" != "true" ]; then
+    echo "Nextcloud is not installed - cronjobs are not available" >&2
+    exit 1
+fi
+
+[ -e /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/cron.php)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ-cron\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/cron.php' -- '/bin/sh'
+else
+    exec php -f /var/www/html/cron.php
+fi
diff --git a/Dockerfile-alpine.template b/Dockerfile-alpine.template
index de69eef26..b474b76b7 100644
--- a/Dockerfile-alpine.template
+++ b/Dockerfile-alpine.template
@@ -16,7 +16,7 @@ RUN set -ex; \
     ; \
     \
     rm /var/spool/cron/crontabs/root; \
-    echo '*/%%CRONTAB_INT%% * * * * php -f /var/www/html/cron.php' > /var/spool/cron/crontabs/www-data
+    echo '*/%%CRONTAB_INT%% * * * * occ-cron' > /var/spool/cron/crontabs/www-data
 
 # install the PHP extensions we need
 # see https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html
@@ -142,7 +142,8 @@ RUN set -ex; \
     chmod +x /usr/src/nextcloud/occ; \
     apk del --no-network .fetch-deps
 
-COPY *.sh upgrade.exclude /
+COPY entrypoint.sh cron.sh upgrade.exclude /
+COPY occ occ-cron /usr/local/bin/
 COPY config/* /usr/src/nextcloud/config/
 
 ENTRYPOINT ["/entrypoint.sh"]
diff --git a/Dockerfile-debian.template b/Dockerfile-debian.template
index 8b66dd34a..65487f265 100644
--- a/Dockerfile-debian.template
+++ b/Dockerfile-debian.template
@@ -14,7 +14,7 @@ RUN set -ex; \
     rm -rf /var/lib/apt/lists/*; \
     \
     mkdir -p /var/spool/cron/crontabs; \
-    echo '*/%%CRONTAB_INT%% * * * * php -f /var/www/html/cron.php' > /var/spool/cron/crontabs/www-data
+    echo '*/%%CRONTAB_INT%% * * * * occ-cron' > /var/spool/cron/crontabs/www-data
 
 # install the PHP extensions we need
 # see https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html
@@ -151,7 +151,8 @@ RUN set -ex; \
     apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false $fetchDeps; \
     rm -rf /var/lib/apt/lists/*
 
-COPY *.sh upgrade.exclude /
+COPY entrypoint.sh cron.sh upgrade.exclude /
+COPY occ occ-cron /usr/local/bin/
 COPY config/* /usr/src/nextcloud/config/
 
 ENTRYPOINT ["/entrypoint.sh"]
diff --git a/README.md b/README.md
index b9f7a66d5..8760ee378 100644
--- a/README.md
+++ b/README.md
@@ -105,13 +105,13 @@ If mounting additional volumes under `/var/www/html`, you should consider:
 
 
 ## Using the Nextcloud command-line interface
-To use the [Nextcloud command-line interface](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/occ_command.html) (aka. `occ` command):
+To use the [Nextcloud command-line interface](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/occ_command.html) (aka. `occ` command), you can use a simple wrapper script provided by the Nextcloud image dealing with permissions:
 ```console
-$ docker exec --user www-data CONTAINER_ID php occ
+$ docker exec CONTAINER_ID occ
 ```
 or for docker-compose:
 ```console
-$ docker-compose exec --user www-data app php occ
+$ docker-compose exec app occ
 ```
 
 ## Auto configuration via environment variables
diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh
index 4e06fcc40..ef80647a4 100755
--- a/docker-entrypoint.sh
+++ b/docker-entrypoint.sh
@@ -11,14 +11,6 @@ directory_empty() {
     [ -z "$(ls -A "$1/")" ]
 }
 
-run_as() {
-    if [ "$(id -u)" = 0 ]; then
-        su -p "$user" -s /bin/sh -c "$1"
-    else
-        sh -c "$1"
-    fi
-}
-
 # Execute all executable files in a given directory in alphanumeric order
 run_path() {
     local hook_folder_path="/docker-entrypoint-hooks.d/$1"
@@ -40,7 +32,11 @@ run_path() {
 
             echo "==> Running the script (cwd: $(pwd)): \"${script_file_path}\""
 
-            run_as "${script_file_path}" || return_code="$?"
+            if [ "$(id -u)" = 0 ]; then
+                su -p "$user" -s /bin/sh "${script_file_path}" || return_code="$?"
+            else
+                "${script_file_path}" || return_code="$?"
+            fi
 
             if [ "${return_code}" -ne "0" ]; then
                 echo "==> Failed at executing \"${script_file_path}\". Exit code: ${return_code}"
@@ -163,7 +159,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                     exit 1
                 fi
                 echo "Upgrading nextcloud from $installed_version ..."
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
             fi
             if [ "$(id -u)" = 0 ]; then
                 rsync_options="-rlDog --chown $user:$group"
@@ -225,7 +221,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                         echo "Starting nextcloud installation"
                         max_retries=10
                         try=0
-                        until  [ "$try" -gt "$max_retries" ] || run_as "php /var/www/html/occ maintenance:install $install_options" 
+                        until [ "$try" -gt "$max_retries" ] || eval "occ maintenance:install $install_options"
                         do
                             echo "Retrying install..."
                             try=$((try+1))
@@ -240,7 +236,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                             NC_TRUSTED_DOMAIN_IDX=1
                             for DOMAIN in $NEXTCLOUD_TRUSTED_DOMAINS ; do
                                 DOMAIN=$(echo "$DOMAIN" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
-                                run_as "php /var/www/html/occ config:system:set trusted_domains $NC_TRUSTED_DOMAIN_IDX --value=$DOMAIN"
+                                occ config:system:set trusted_domains "$NC_TRUSTED_DOMAIN_IDX" --value="$DOMAIN"
                                 NC_TRUSTED_DOMAIN_IDX=$((NC_TRUSTED_DOMAIN_IDX+1))
                             done
                         fi
@@ -257,9 +253,9 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
             else
                 run_path pre-upgrade
 
-                run_as 'php /var/www/html/occ upgrade'
+                occ upgrade
 
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
                 echo "The following apps have been disabled:"
                 diff /tmp/list_before /tmp/list_after | grep '<' | cut -d- -f2 | cut -d: -f1
                 rm -f /tmp/list_before /tmp/list_after
@@ -272,7 +268,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
 
         # Update htaccess after init if requested
         if [ -n "${NEXTCLOUD_INIT_HTACCESS+x}" ] && [ "$installed_version" != "0.0.0.0" ]; then
-            run_as 'php /var/www/html/occ maintenance:update:htaccess'
+            occ maintenance:update:htaccess
         fi
     ) 9> /var/www/html/nextcloud-init-sync.lock
 
diff --git a/docker-occ-cron.sh b/docker-occ-cron.sh
new file mode 100755
index 000000000..798cc175a
--- /dev/null
+++ b/docker-occ-cron.sh
@@ -0,0 +1,19 @@
+#!/bin/sh
+set -eu
+
+if [ "$(occ status 2> /dev/null | sed -ne 's/^  - installed: \(.*\)$/\1/p')" != "true" ]; then
+    echo "Nextcloud is not installed - cronjobs are not available" >&2
+    exit 1
+fi
+
+[ -e /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/cron.php)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ-cron\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/cron.php' -- '/bin/sh'
+else
+    exec php -f /var/www/html/cron.php
+fi
diff --git a/docker-occ.sh b/docker-occ.sh
new file mode 100755
index 000000000..70b08e7d3
--- /dev/null
+++ b/docker-occ.sh
@@ -0,0 +1,14 @@
+#!/bin/sh
+set -eu
+
+[ -e /var/www/html/occ ] || { echo "Unable to run \`occ\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/occ ] || { echo "Unable to run \`occ\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/occ)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/occ -- "$@"' -- '/bin/sh' "$@"
+else
+    exec php -f /var/www/html/occ -- "$@"
+fi
diff --git a/update.sh b/update.sh
index bc35ce198..c28522009 100755
--- a/update.sh
+++ b/update.sh
@@ -128,9 +128,10 @@ function create_variant() {
 	' "$dir/Dockerfile"
 
 	# Copy the shell scripts
-	for name in entrypoint cron; do
-		cp "docker-$name.sh" "$dir/$name.sh"
-	done
+	cp "docker-entrypoint.sh" "$dir/entrypoint.sh"
+	cp "docker-cron.sh" "$dir/cron.sh"
+	cp "docker-occ.sh" "$dir/occ"
+	cp "docker-occ-cron.sh" "$dir/occ-cron"
 
 	# Copy the upgrade.exclude
 	cp upgrade.exclude "$dir/"