diff --git a/rdp-proxy/entrypoint.sh b/rdp-proxy/entrypoint.sh
index 7c26ce7..4da4d44 100644
--- a/rdp-proxy/entrypoint.sh
+++ b/rdp-proxy/entrypoint.sh
@@ -213,7 +213,23 @@ if [ -n "$RDP_DOMAIN" ]; then
 fi
 
 xfreerdp "${RDP_ARGS[@]}" >/tmp/xfreerdp.log 2>&1 &
+XFREERDP_PID=$!
 
 x11vnc -display "$DISPLAY_NUM" -rfbport 5900 -forever -shared -nopw -noxdamage >/tmp/x11vnc.log 2>&1 &
+X11VNC_PID=$!
 
-exec websockify --verbose --idle-timeout="$IDLE_TIMEOUT" --web=/opt/portal 6080 localhost:5900
+websockify --verbose --idle-timeout="$IDLE_TIMEOUT" --web=/opt/portal 6080 localhost:5900 >/tmp/websockify.log 2>&1 &
+WEBSOCKIFY_PID=$!
+
+# Graceful shutdown on docker stop (SIGTERM) — exit 0 so Docker does NOT auto-restart
+cleanup() {
+    kill "$XFREERDP_PID" "$X11VNC_PID" "$WEBSOCKIFY_PID" 2>/dev/null
+    exit 0
+}
+trap cleanup TERM INT
+
+# Monitor xfreerdp — when it exits (disconnect/logoff) restart the container
+wait "$XFREERDP_PID"
+echo "xfreerdp exited (code $?), triggering container restart" >> /tmp/xfreerdp.log
+kill "$X11VNC_PID" "$WEBSOCKIFY_PID" 2>/dev/null
+exit 1