diff --git a/Cargo.lock b/Cargo.lock
index 3f5af5d..a0a5e40 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4079,6 +4079,7 @@ dependencies = [
 name = "up-subscription-cli"
 version = "0.4.0"
 dependencies = [
+ "backon",
  "clap",
  "serde_json",
  "tokio",
diff --git a/Cargo.toml b/Cargo.toml
index b612812..cdceade 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -30,11 +30,17 @@ version = "0.4.0"
 
 [workspace.dependencies]
 async-trait = { version = "0.1" }
+backon = { version = "1.6", default-features = false, features = [
+    "tokio-sleep",
+] }
 mockall = { version = "0.14" }
 protobuf = { version = "3.7.2" }
 test-case = { version = "3.3" }
 tokio = { version = "1", features = ["full"] }
-tracing = { version = "0.1", default-features = false, features = ["log", "std"] }
+tracing = { version = "0.1", default-features = false, features = [
+    "log",
+    "std",
+] }
 up-rust = { version = "0.9.0", features = ["usubscription"] }
 up-subscription = { path = "./up-subscription" }
 
@@ -59,3 +65,4 @@ install-updater = false
 [profile.dist]
 inherits = "release"
 lto = "thin"
+overflow-checks = true
diff --git a/Dockerfile b/Dockerfile
index 82a2c57..3c4e61f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -34,8 +34,5 @@ FROM debian:stable-slim
 COPY --from=build /up-subscription-rust/target/dist/up-subscription-cli .
 RUN chmod +x /up-subscription-cli
 
-ADD tools/startup.sh /
-RUN chmod +x /startup.sh
-
 # set the startup command to run your binary
-ENTRYPOINT ["/startup.sh"]
+ENTRYPOINT ["/up-subscription-cli"]
diff --git a/deny.toml b/deny.toml
index e2dd0b8..95cc2ee 100644
--- a/deny.toml
+++ b/deny.toml
@@ -25,3 +25,8 @@ allow = ["Apache-2.0", "BSD-2-Clause", "MIT", "Unicode-3.0"]
 name = "ring"
 expression = "MIT AND ISC AND OpenSSL"
 license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }]
+
+[advisories]
+ignore = [
+    "RUSTSEC-2026-0007", # We perform integer overflow checks also in release builds
+]
diff --git a/docker-compose.yaml b/docker-compose.yaml
index 932e165..8884b0f 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -23,6 +23,6 @@ services:
       - AUTHORITY=usubscription.local
       - TRANSPORT=zenoh
       - VERBOSE=true
-
-#      - SUBSCRIPTION_BUFFER=1024
-#      - NOTIFICATION_BUFFER=1024
+    #   - SUBSCRIPTION_BUFFER=1024
+    #   - NOTIFICATION_BUFFER=1024
+    # command: ["mqtt5"]
diff --git a/tools/startup.sh b/tools/startup.sh
deleted file mode 100755
index 008e53c..0000000
--- a/tools/startup.sh
+++ /dev/null
@@ -1,16 +0,0 @@
-#!/bin/sh
-
-################################################################################
-# Copyright (c) 2025 Contributors to the Eclipse Foundation
-#
-# See the NOTICE file(s) distributed with this work for additional
-# information regarding copyright ownership.
-#
-# This program and the accompanying materials are made available under the
-# terms of the Apache License Version 2.0 which is available at
-# https://www.apache.org/licenses/LICENSE-2.0
-#
-# SPDX-License-Identifier: Apache-2.0
-################################################################################
-
-/up-subscription-cli
diff --git a/up-subscription-cli/Cargo.toml b/up-subscription-cli/Cargo.toml
index c3eb17f..17a80ad 100644
--- a/up-subscription-cli/Cargo.toml
+++ b/up-subscription-cli/Cargo.toml
@@ -33,6 +33,7 @@ mqtt5 = ["dep:up-transport-mqtt5"]
 zenoh = ["dep:up-transport-zenoh", "dep:serde_json"]
 
 [dependencies]
+backon = { workspace = true }
 clap = { version = "4.5.53", default-features = false, features = [
     "std",
     "derive",
@@ -47,7 +48,7 @@ serde_json = { version = "1.0", optional = true }
 tokio = { workspace = true }
 tracing = { workspace = true }
 tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt"] }
-up-rust = { workspace = true, features = ["usubscription", "util" ] }
+up-rust = { workspace = true, features = ["usubscription", "util"] }
 up-subscription = { workspace = true }
 up-transport-mqtt5 = { version = "0.4.0", optional = true }
 up-transport-zenoh = { version = "0.9.0", optional = true }
diff --git a/up-subscription-cli/src/transport/mqtt5.rs b/up-subscription-cli/src/transport/mqtt5.rs
index 3b45654..dad17f2 100644
--- a/up-subscription-cli/src/transport/mqtt5.rs
+++ b/up-subscription-cli/src/transport/mqtt5.rs
@@ -11,10 +11,11 @@
  * SPDX-License-Identifier: Apache-2.0
  ********************************************************************************/
 
-use std::sync::Arc;
+use std::{sync::Arc, time::Duration};
 
+use backon::{ExponentialBuilder, Retryable};
 use tracing::info;
-use up_rust::UTransport;
+use up_rust::{UCode, UTransport};
 use up_transport_mqtt5::{Mqtt5Transport, Mqtt5TransportOptions};
 
 pub(crate) async fn get_mqtt5_transport(
@@ -22,7 +23,24 @@ pub(crate) async fn get_mqtt5_transport(
     mqtt5_args: Mqtt5TransportOptions,
 ) -> Result<Arc<dyn UTransport>, Box<dyn std::error::Error>> {
     info!("Using MQTT 5 uProtocol transport");
-    Ok(Mqtt5Transport::new(mqtt5_args, authority_name)
+
+    let transport = Mqtt5Transport::new(mqtt5_args, authority_name)
         .await
-        .map(Arc::new)?)
+        .map(Arc::new)?;
+
+    (|| transport.connect())
+                    .retry(
+                        ExponentialBuilder::default().with_total_delay(Some(Duration::from_secs(10))),
+                    )
+                    .notify(|error, sleep_duration| {
+                        info!("Attempt to connect to MQTT broker failed [error: {error}], retrying in {sleep_duration:?}");
+                    })
+                    .when(|err| {
+                        // no need to keep retrying if authentication or permission is denied
+                        err.get_code() != UCode::UNAUTHENTICATED
+                            && err.get_code() != UCode::PERMISSION_DENIED
+                    })
+                    .await?;
+    info!("Connected to MQTT5 broker");
+    Ok(transport)
 }