diff --git a/Dockerfile b/Dockerfile
index ce471d6..7320f29 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -20,4 +20,4 @@ USER deno
 # Compile the main app so that it doesn't need to be compiled each startup/entry.
 RUN deno cache --reload main.ts
 
-CMD ["run", "--allow-all", "main.ts"]
+CMD ["task", "preview"]
diff --git a/Makefile b/Makefile
index cc6dc94..665a55b 100644
--- a/Makefile
+++ b/Makefile
@@ -19,8 +19,12 @@ build:
 
 .PHONY: migrate-db
 migrate-db:
-	deno run --allow-net --allow-read --allow-env migrate-db.ts
+	deno task migrate-db
 
 .PHONY: exec-db
 exec-db:
 	docker exec -it -u postgres $(shell basename $(CURDIR))-postgresql-1 psql
+
+.PHONY: preview
+preview:
+	deno task preview
diff --git a/README.md b/README.md
index be34959..728ca58 100644
--- a/README.md
+++ b/README.md
@@ -72,7 +72,7 @@ These are the amazing entities or individuals who are sponsoring this project fo
 ```sh
 docker compose -f docker-compose.dev.yml up # (optional) runs docker with postgres, locally
 make migrate-db # runs any missing database migrations
-make start # runs the app
+make start # runs the app in development mode (watches for file changes and recompiles the app)
 make format # (optional) formats the code (if you're interested in contributing)
 make test # (optional) runs tests (if you're interested in contributing)
 ```
@@ -80,6 +80,7 @@ make test # (optional) runs tests (if you're interested in contributing)
 ### Other less-used commands (mostly for development)
 
 ```sh
+make preview # runs the app in production mode (serves the app from the built files)
 make exec-db # runs psql inside the postgres container, useful for running direct development queries like `DROP DATABASE "bewcloud"; CREATE DATABASE "bewcloud";`
 make build # generates all static files for production deploy
 ```
diff --git a/deno.json b/deno.json
index 45c3ed1..dd2ad20 100644
--- a/deno.json
+++ b/deno.json
@@ -1,13 +1,15 @@
 {
   "lock": true,
   "tasks": {
+    "execute-with-permissions": "deno run --allow-env --allow-net --allow-sys=networkInterfaces,hostname,cpus,homedir --allow-read=.,/ --allow-write=data-files,/ --allow-run",
     "check": "deno fmt --check && deno lint && deno check .",
     "cli": "echo \"import '\\$fresh/src/dev/cli.ts'\" | deno run --unstable -A -",
     "manifest": "deno task cli manifest $(pwd)",
-    "start": "deno run -A --watch=static/,routes/,lib/,components/,islands/ dev.ts",
-    "build": "deno run -A dev.ts build",
-    "preview": "deno run -A main.ts",
-    "test": "deno test -A --check"
+    "start": "deno task execute-with-permissions --watch=static/,routes/,lib/,components/,islands/ ./dev.ts",
+    "build": "deno task execute-with-permissions ./dev.ts build",
+    "preview": "deno task execute-with-permissions ./main.ts",
+    "test": "deno test --allow-all --check",
+    "migrate-db": "deno task execute-with-permissions ./migrate-db.ts"
   },
   "fmt": {
     "useTabs": false,