diff --git a/kubernetes/apps/capacitor/capacitor/app/helmrelease.yaml b/kubernetes/apps/capacitor/capacitor/app/helmrelease.yaml
index 00cfa74a..5353da9d 100644
--- a/kubernetes/apps/capacitor/capacitor/app/helmrelease.yaml
+++ b/kubernetes/apps/capacitor/capacitor/app/helmrelease.yaml
@@ -42,11 +42,16 @@ spec:
               repository: ghcr.io/gimlet-io/capacitor
               tag: v0.4.8@sha256:a80207f52c054dba9e04e8b1ea86e297817ecf05ddbfce249c1f5eaf6ce8c7d8
             securityContext:
+              runAsNonRoot: true
+              runAsUser: 100
+              runAsGroup: 101
               allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
               capabilities:
                 drop:
                   - ALL
-              readOnlyRootFilesystem: true
+              seccompProfile:
+                type: RuntimeDefault
 
             probes:
               startup:
@@ -73,7 +78,7 @@ spec:
                 memory: 127Mi
 
     serviceAccount:
-      create: false
+      create: true
       name: capacitor
 
     service:
diff --git a/kubernetes/apps/capacitor/capacitor/app/kustomization.yaml b/kubernetes/apps/capacitor/capacitor/app/kustomization.yaml
index 8a67b66d..aeffdac2 100644
--- a/kubernetes/apps/capacitor/capacitor/app/kustomization.yaml
+++ b/kubernetes/apps/capacitor/capacitor/app/kustomization.yaml
@@ -4,4 +4,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./helmrelease.yaml
-  - ./rbac.yaml
+  # - ./rbac.yaml