diff --git a/.github/workflows/qa.yml b/.github/workflows/qa.yml
index c996ddd..fc23903 100644
--- a/.github/workflows/qa.yml
+++ b/.github/workflows/qa.yml
@@ -20,7 +20,7 @@ jobs:
     - name: Clone repository
       uses: actions/checkout@v7.0.1
     - name: Use Python
-      uses: actions/setup-python@v6.3.0
+      uses: actions/setup-python@v7.0.0
       with:
         python-version: ${{ matrix.version }}
     - name: Install dependencies
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b63d0fb..bc9d915 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,7 +22,7 @@ jobs:
         fetch-depth: '0'
         token: ${{ secrets.TOKEN_GITHUB_TO_GITHUB_REPOSITORIES_RW }}
     - name: Use Python
-      uses: actions/setup-python@v6.3.0
+      uses: actions/setup-python@v7.0.0
       with:
         python-version: '3.14'
     - name: Install dependencies
diff --git a/eventsourcingdb/container.py b/eventsourcingdb/container.py
index 8f4e798..3be6b9b 100644
--- a/eventsourcingdb/container.py
+++ b/eventsourcingdb/container.py
@@ -65,11 +65,12 @@ def _create_container(self) -> None:
             target_path = "/etc/esdb/signing-key.pem"
             command.extend(["--signing-key-file", target_path])
 
-        self._container = self._docker_client.containers.run(
+        # Only create the container for now, so that the signing key can be copied
+        # into it before the server starts and tries to read it.
+        self._container = self._docker_client.containers.create(
             f"{self._image_name}:{self._image_tag}",
             command=command,
             ports=port_bindings,  # type: ignore
-            detach=True,
         )  # type: ignore
 
         # Copy signing key into container if needed
@@ -102,6 +103,8 @@ def _create_container(self) -> None:
             # Put the archive into /etc which should exist
             self._container.put_archive('/etc', tar_stream)
 
+        self._container.start()
+
     def _extract_port_from_container_info(self, container_info) -> int | None:
         port = None
         valid_mapping = True