diff --git a/Dockerfile b/Dockerfile
index 4afb7ce..2adf5a8 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -101,6 +101,7 @@ RUN ARCH=$(uname -m) && \
 COPY --from=install /temp/prod/node_modules node_modules
 COPY --from=prerelease /app/public/ /app/public/
 COPY --from=prerelease /app/dist /app/dist
+COPY entrypoint.sh /app/entrypoint.sh
 
 # COPY . .
 RUN mkdir data
@@ -109,4 +110,4 @@ EXPOSE 3000/tcp
 # used for calibre
 ENV QTWEBENGINE_CHROMIUM_FLAGS="--no-sandbox"
 ENV NODE_ENV=production
-ENTRYPOINT [ "bun", "run", "dist/src/index.js" ]
+ENTRYPOINT [ "/app/entrypoint.sh" ]
diff --git a/README.md b/README.md
index 7822aa0..5078f33 100644
--- a/README.md
+++ b/README.md
@@ -101,6 +101,8 @@ All are optional, JWT_SECRET is recommended to be set.
 | LANGUAGE                     | en                                                 | Language to format date strings in, specified as a [BCP 47 language tag](https://en.wikipedia.org/wiki/IETF_language_tag)                                     |
 | UNAUTHENTICATED_USER_SHARING | false                                              | Shares conversion history between all unauthenticated users                                                                                                   |
 | MAX_CONVERT_PROCESS          | 0                                                  | Maximum number of concurrent conversion processes allowed. Set to 0 for unlimited.                                                                            |
+| MAGICK_MAX_WIDTH             | 8000                                               | (Docker only) ImageMagick maximum image width in pixels                                                                                                       |
+| MAGICK_MAX_HEIGHT            | 8000                                               | (Docker only) ImageMagick maximum image height in pixels                                                                                                      |
 
 ### Docker images
 
diff --git a/entrypoint.sh b/entrypoint.sh
new file mode 100755
index 0000000..b9c200f
--- /dev/null
+++ b/entrypoint.sh
@@ -0,0 +1,20 @@
+#!/bin/bash
+set -e
+
+if [ -n "$MAGICK_MAX_WIDTH" ] || [ -n "$MAGICK_MAX_HEIGHT" ]; then
+  POLICY_DIR="/etc/ImageMagick-7"
+  POLICY_FILE="$POLICY_DIR/policy.xml"
+
+  mkdir -p "$POLICY_DIR"
+
+  echo "<policymap>" > "$POLICY_FILE"
+  if [ -n "$MAGICK_MAX_WIDTH" ]; then
+    echo "  <policy domain=\"resource\" name=\"width\" value=\"$MAGICK_MAX_WIDTH\"/>" >> "$POLICY_FILE"
+  fi
+  if [ -n "$MAGICK_MAX_HEIGHT" ]; then
+    echo "  <policy domain=\"resource\" name=\"height\" value=\"$MAGICK_MAX_HEIGHT\"/>" >> "$POLICY_FILE"
+  fi
+  echo "</policymap>" >> "$POLICY_FILE"
+fi
+
+exec bun run dist/src/index.js