diff --git a/docker-compose.yaml b/docker-compose.yaml
index 073c831c..9a3d8751 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -30,7 +30,8 @@ services:
       - grafana:/var/lib/grafana
 
   timescaledb:
-    image: timescale/timescaledb-ha:pg14-latest
+    build:
+      dockerfile: timescaledb/Dockerfile
     environment:
       POSTGRES_DB: metrics
       POSTGRES_PASSWORD: pass
diff --git a/timescaledb/Dockerfile b/timescaledb/Dockerfile
new file mode 100644
index 00000000..e16cd085
--- /dev/null
+++ b/timescaledb/Dockerfile
@@ -0,0 +1,3 @@
+FROM timescale/timescaledb:pg14-latest@sha256:c453fa2d290d578a5983b5823e9ffbf16f478735d8c121620436c4a9c6e55df5
+
+COPY timescaledb/init.sql /docker-entrypoint-initdb.d/
diff --git a/timescaledb/init.sql b/timescaledb/init.sql
new file mode 100644
index 00000000..9f09aea7
--- /dev/null
+++ b/timescaledb/init.sql
@@ -0,0 +1,6 @@
+-- set up the grafanareader role with select permissions by default
+CREATE ROLE grafanareader;
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO grafanareader;
+ALTER USER grafanareader WITH PASSWORD 'grafana';
+GRANT CONNECT ON DATABASE metrics TO grafanareader;
+GRANT USAGE ON SCHEMA public TO grafanareader;