diff --git a/entrypoint.sh b/entrypoint.sh
index 5021169..c0d9c82 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -9,6 +9,10 @@ fi
 # permitir override explícito vía HOST_UID/HOST_GID, y por defecto usar 1000.
 DETECTED_UID=$(stat -c '%u' "/home/${HOME_USER}" 2>/dev/null || echo 1000)
 DETECTED_GID=$(stat -c '%g' "/home/${HOME_USER}" 2>/dev/null || echo 1000)
+# Descartar UID/GID 0 (root) detectados del mount: es metadata espuria
+# de bind mounts (p.ej. WSL2/Docker Desktop), no un UID/GID real de host.
+[ "$DETECTED_UID" = "0" ] && DETECTED_UID=1000
+[ "$DETECTED_GID" = "0" ] && DETECTED_GID=1000
 TARGET_UID="${HOST_UID:-$DETECTED_UID}"
 TARGET_GID="${HOST_GID:-$DETECTED_GID}"
 
@@ -86,20 +90,26 @@ if ! id -u "$HOME_USER" > /dev/null 2>&1; then
   # Changing the property of the directory /home/${HOME_USER}/.vscode
   sudo chown -R ${HOME_USER} /home/${HOME_USER}/.vscode
 else
-  # Usuario ya existe (imagen/volumen reusado) — resincronizar UID/GID si cambiaron
-  CURRENT_UID=$(id -u "${HOME_USER}")
-  CURRENT_GID=$(id -g "${HOME_USER}")
-  CURRENT_GROUP=$(id -gn "${HOME_USER}")
+  # Usuario ya existe (imagen/volumen reusado) — resincronizar UID/GID
+  # SOLO si el operador lo pidió explícitamente vía HOST_UID/HOST_GID.
+  # No usar la detección automática del mount acá: en reinicios repetidos
+  # es una señal poco confiable (ver metadata GID 0 de bind mounts en
+  # WSL2/Docker Desktop) y causaba un groupmod fallido en cada arranque.
+  if [[ -n "${HOST_UID-}" || -n "${HOST_GID-}" ]]; then
+    CURRENT_UID=$(id -u "${HOME_USER}")
+    CURRENT_GID=$(id -g "${HOME_USER}")
+    CURRENT_GROUP=$(id -gn "${HOME_USER}")
 
-  if [ "$CURRENT_UID" != "$TARGET_UID" ] || [ "$CURRENT_GID" != "$TARGET_GID" ]; then
-    if [ "$CURRENT_GID" != "$TARGET_GID" ]; then
-      sudo groupmod -g "${TARGET_GID}" "${CURRENT_GROUP}"
+    if [ "$CURRENT_UID" != "$TARGET_UID" ] || [ "$CURRENT_GID" != "$TARGET_GID" ]; then
+      if [ "$CURRENT_GID" != "$TARGET_GID" ]; then
+        sudo groupmod -g "${TARGET_GID}" "${CURRENT_GROUP}"
+      fi
+      if [ "$CURRENT_UID" != "$TARGET_UID" ]; then
+        sudo usermod -u "${TARGET_UID}" "${HOME_USER}"
+      fi
+      sudo find / -xdev \( -user "${CURRENT_UID}" -o -group "${CURRENT_GID}" \) \
+        -exec chown -h "${TARGET_UID}:${TARGET_GID}" {} + 2>/dev/null || true
     fi
-    if [ "$CURRENT_UID" != "$TARGET_UID" ]; then
-      sudo usermod -u "${TARGET_UID}" "${HOME_USER}"
-    fi
-    sudo find / -xdev \( -user "${CURRENT_UID}" -o -group "${CURRENT_GID}" \) \
-      -exec chown -h "${TARGET_UID}:${TARGET_GID}" {} + 2>/dev/null || true
   fi
 fi
 
diff --git a/readme.md b/readme.md
index 4e83052..77854cf 100644
--- a/readme.md
+++ b/readme.md
@@ -16,7 +16,7 @@ The following environment variables can be set when running the Docker container
 
 - `HOME_USER`: The username of the user running the container. This is used to set the correct permissions on files created in the container.
 - `VSCODE_TUNNEL_NAME`: The name of the SSH tunnel used by Visual Studio Code to connect to the container.
-- `HOST_UID` / `HOST_GID` (optional): Force the `HOME_USER` account to use a specific UID/GID instead of the default `1000`. If not set, the container will try to auto-detect the UID/GID from an existing `/home/${HOME_USER}` mount (useful when bind-mounting a host directory owned by a non-1000 user); if that can't be detected either, it falls back to `1000`. If the container is restarted/reused and the UID/GID changed, the existing user is resynced (`usermod`/`groupmod`) and its files re-owned accordingly.
+- `HOST_UID` / `HOST_GID` (optional): Force the `HOME_USER` account to use a specific UID/GID instead of the default `1000`. This only applies the first time the user is created: if not set, the container will try to auto-detect the UID/GID from an existing `/home/${HOME_USER}` mount (useful when bind-mounting a host directory owned by a non-1000 user); if that can't be detected either (or the mount reports UID/GID `0`, which some bind mount setups do), it falls back to `1000`. If the container is restarted/reused and the user already exists, its UID/GID is only resynced (`usermod`/`groupmod`, with files re-owned accordingly) when `HOST_UID`/`HOST_GID` are explicitly set — auto-detection from the mount is not used to resync an existing user, since mount metadata can be unreliable across restarts.
 
 ### Custom Environment Variables