diff --git a/Dockerfile b/Dockerfile
index 499ee39..2dcad10 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,10 +1,11 @@
 # Multi-stage Build für OIDC Identity Provider
 FROM python:3.10-slim as base
 
-# System dependencies
+# System dependencies (including openssl for JWT key generation)
 RUN apt-get update && apt-get install -y \
     gcc \
     postgresql-client \
+    openssl \
     && rm -rf /var/lib/apt/lists/*
 
 # Working directory
@@ -30,12 +31,15 @@ COPY templates/ templates/
 # Copy migrations directory for database schema management
 COPY migrations/ migrations/
 
-# Copy instance directory with JWT keys
-COPY instance/ instance/
-
 # Copy static directory with CSS files
 COPY static/ static/
 
+# Copy entrypoint script for initialization
+COPY docker-entrypoint.sh /app/docker-entrypoint.sh
+
+# Make entrypoint script executable and create instance directory
+RUN chmod +x /app/docker-entrypoint.sh && mkdir -p /app/instance
+
 # Create non-root user and set permissions
 RUN useradd -m -u 1000 oidc && chown -R oidc:oidc /app
 USER oidc
@@ -47,5 +51,8 @@ EXPOSE 5000
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
     CMD python -c "import requests; requests.get('http://localhost:5000/health')" || exit 1
 
+# Set entrypoint script to handle initialization
+ENTRYPOINT ["/app/docker-entrypoint.sh"]
+
 # Start with Gunicorn (production WSGI server)
 CMD ["gunicorn", "--bind", "0.0.0.0:5000", "--workers", "4", "--threads", "2", "--timeout", "60", "oidc_server:app"]
diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh
new file mode 100755
index 0000000..7d49108
--- /dev/null
+++ b/docker-entrypoint.sh
@@ -0,0 +1,39 @@
+#!/bin/bash
+# Docker entrypoint script for OIDC Identity Provider
+# Generates JWT keys if they don't exist and starts the application
+
+set -e
+
+echo "========================================"
+echo "OIDC IdP - Container Initialization"
+echo "========================================"
+
+# Create instance directory if it doesn't exist
+mkdir -p /app/instance
+
+# Generate JWT keys if they don't exist
+if [ ! -f /app/instance/jwt_private.pem ]; then
+    echo "Generating JWT RSA key pair..."
+
+    # Generate private key (2048-bit RSA)
+    openssl genrsa -out /app/instance/jwt_private.pem 2048
+
+    # Extract public key from private key
+    openssl rsa -in /app/instance/jwt_private.pem -pubout -out /app/instance/jwt_public.pem
+
+    # Set proper permissions
+    chmod 600 /app/instance/jwt_private.pem
+    chmod 644 /app/instance/jwt_public.pem
+
+    echo "✓ JWT keys generated successfully"
+else
+    echo "✓ JWT keys already exist"
+fi
+
+echo ""
+echo "Starting OIDC server..."
+echo "========================================"
+echo ""
+
+# Execute the CMD from Dockerfile (Gunicorn)
+exec "$@"