diff --git a/apps/sample-app/base/deployment.yaml b/apps/sample-app/base/deployment.yaml
index 5f8e262..ebb3b34 100644
--- a/apps/sample-app/base/deployment.yaml
+++ b/apps/sample-app/base/deployment.yaml
@@ -14,9 +14,21 @@ spec:
       labels:
         app: sample-app
     spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
       containers:
         - name: sample-app
           image: ghcr.io/david-uka/sample-app:latest
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
           ports:
             - containerPort: 8080
           env: