diff --git a/files/entrypoint.sh b/files/entrypoint.sh
index d86ce84..01c1e2f 100644
--- a/files/entrypoint.sh
+++ b/files/entrypoint.sh
@@ -4,72 +4,95 @@ set -euo pipefail
 log(){ echo "[nats-registration][entrypoint] $*"; }
 err(){ echo "[nats-registration][entrypoint][ERROR] $*" >&2; }
 
-# Sanity: tools
+# ---- Tool sanity (only what we use)
 for bin in curl python; do
-  command -v "$bin" >/dev/null 2>&1 || { err "Missing $bin"; exit 2; }
+  if ! command -v "$bin" >/dev/null 2>&1; then
+    err "Missing $bin"
+    exit 2
+  fi
 done
 
-# Paths (match Dockerfile ENV)
-: "${APP_DIR:=/opt/containers/nats-registration-listener}"
-: "${DATA_DIR:=${APP_DIR}/data}"
-mkdir -p "${DATA_DIR}"
+# ---- Paths
+APP_DIR="${APP_DIR:-/opt/containers/nats-registration-listener}"
+DATA_DIR="${DATA_DIR:-$APP_DIR/data}"
+mkdir -p "$DATA_DIR"
 
-# Required (fed from .env via compose)
-: "${NATS_SERVERS:?NATS_SERVERS required (space-separated NATS URLs, e.g. 'tls://nats01:4222')}"
-: "${NATS_SUBJECT:?NATS_SUBJECT required (e.g. 'v1.registration')}"
+# ---- Required env
+: "${NATS_SERVERS:?NATS_SERVERS required (e.g. 'nats://host:4222' or 'tls://host:4222')}"
+: "${NATS_SUBJECT:=v1.registration}"   # default to common registration subject
 
-# Optional with defaults
-: "${NATS_NAME:=registration-listener}"
-: "${PRINT_RAW:=}"
-: "${NATS_QUEUE:=}"
+# ---- Optional env
+NATS_NAME="${NATS_NAME:-registration-listener}"
+PRINT_RAW="${PRINT_RAW:-}"
+NATS_QUEUE="${NATS_QUEUE:-}"
 
-# TLS input options (dynamic)
-# Priority:
-#  1) TLS_CA      -> use as a path (pre-mounted file)
-#  2) TLS_CA_PEM  -> write PEM content to ${DATA_DIR}/tls-ca.pem
-#  3) TLS_CA_PEM_B64 -> base64 decode to ${DATA_DIR}/tls-ca.pem
-#  4) TLS_CA_URL  -> curl to ${DATA_DIR}/tls-ca.pem
-: "${TLS_CA:=}"
-: "${TLS_CA_PEM:=}"
-: "${TLS_CA_PEM_B64:=}"
-: "${TLS_CA_URL:=}"
-: "${TLS_INSECURE:=}"
+# TLS inputs (all optional)
+TLS_CA="${TLS_CA:-}"
+TLS_CA_PEM="${TLS_CA_PEM:-}"
+TLS_CA_PEM_B64="${TLS_CA_PEM_B64:-}"
+TLS_CA_URL="${TLS_CA_URL:-}"
+TLS_INSECURE="${TLS_INSECURE:-}"
 
-# Auth (optional)
-: "${NATS_USER:=}"
-: "${NATS_PASS:=}"
-: "${NATS_TOKEN:=}"
-: "${NATS_CREDS:=}"           # path to a .creds file if you have one
-: "${NATS_CREDS_B64:=}"       # optional: base64-encoded creds; will be written to DATA_DIR
+# Auth (all optional)
+NATS_USER="${NATS_USER:-}"
+NATS_PASS="${NATS_PASS:-}"
+NATS_TOKEN="${NATS_TOKEN:-}"
+NATS_CREDS="${NATS_CREDS:-}"
+NATS_CREDS_B64="${NATS_CREDS_B64:-}"
 
-# ---- Dynamic materialization of CA (and optional .creds) ----
 CA_TARGET="${DATA_DIR}/tls-ca.pem"
 CREDS_TARGET="${DATA_DIR}/user.creds"
 
-materialized_ca=""
-
-if [[ -z "${TLS_CA}" ]]; then
-  if [[ -n "${TLS_CA_PEM}" ]]; then
+# ---- Materialize TLS CA (if a path not already provided)
+materialized_ca=0
+if [ -z "$TLS_CA" ]; then
+  if [ -n "$TLS_CA_PEM" ]; then
     log "Materializing TLS CA from TLS_CA_PEM -> ${CA_TARGET}"
-    printf '%s\n' "${TLS_CA_PEM}" > "${CA_TARGET}"
-    chmod 0644 "${CA_TARGET}"
-    TLS_CA="${CA_TARGET}"
-    materialized_ca="1"
-  elif [[ -n "${TLS_CA_PEM_B64}" ]]; then
+    printf '%s\n' "$TLS_CA_PEM" > "$CA_TARGET"
+    chmod 0644 "$CA_TARGET"
+    TLS_CA="$CA_TARGET"
+    materialized_ca=1
+  elif [ -n "$TLS_CA_PEM_B64" ]; then
     log "Materializing TLS CA from TLS_CA_PEM_B64 -> ${CA_TARGET}"
-    echo "${TLS_CA_PEM_B64}" | base64 -d > "${CA_TARGET}"
-    chmod 0644 "${CA_TARGET}"
-    TLS_CA="${CA_TARGET}"
-    materialized_ca="1"
-  elif [[ -n "${TLS_CA_URL}" ]]; then
+    echo "$TLS_CA_PEM_B64" | base64 -d > "$CA_TARGET"
+    chmod 0644 "$CA_TARGET"
+    TLS_CA="$CA_TARGET"
+    materialized_ca=1
+  elif [ -n "$TLS_CA_URL" ]; then
     log "Fetching TLS CA from TLS_CA_URL -> ${CA_TARGET}"
-    curl -fsSL "${TLS_CA_URL}" -o "${CA_TARGET}"
-    chmod 0644 "${CA_TARGET}"
-    TLS_CA="${CA_TARGET}"
-    materialized_ca="1"
+    curl -fsSL "$TLS_CA_URL" -o "$CA_TARGET"
+    chmod 0644 "$CA_TARGET"
+    TLS_CA="$CA_TARGET"
+    materialized_ca=1
   fi
 fi
 
-# Validate CA if present
-if [[ -n "${TLS_CA}" ]]; then
-  if [[ ! -s "${TLS_CA}" ]_]()]()
+# ---- Validate CA if present
+if [ -n "$TLS_CA" ]; then
+  if [ ! -s "$TLS_CA" ]; then
+    err "TLS_CA='$TLS_CA' not found or empty"
+    exit 3
+  fi
+  if ! grep -q "BEGIN CERTIFICATE" "$TLS_CA"; then
+    err "TLS_CA does not look like a PEM certificate: $TLS_CA"
+    exit 3
+  fi
+  log "Using TLS CA at $TLS_CA (materialized=${materialized_ca})"
+fi
+
+# ---- Materialize .creds if provided as base64
+if [ -z "$NATS_CREDS" ] && [ -n "$NATS_CREDS_B64" ]; then
+  log "Materializing NATS .creds from NATS_CREDS_B64 -> ${CREDS_TARGET}"
+  echo "$NATS_CREDS_B64" | base64 -d > "$CREDS_TARGET"
+  chmod 0600 "$CREDS_TARGET"
+  NATS_CREDS="$CREDS_TARGET"
+fi
+
+log "servers='${NATS_SERVERS}' subject='${NATS_SUBJECT}' queue='${NATS_QUEUE:- -}' name='${NATS_NAME}' tls_ca='${TLS_CA:-}'"
+
+# Export variables for the runner script
+export TLS_CA NATS_CREDS NATS_SERVERS NATS_SUBJECT NATS_NAME PRINT_RAW NATS_QUEUE \
+       NATS_USER NATS_PASS NATS_TOKEN TLS_INSECURE
+
+# Hand off to main script
+exec "$@"