diff --git a/infrastructure/controllers/base/tailscale/release-operator.yaml b/infrastructure/controllers/base/tailscale/release-operator.yaml
index a96510a..f975868 100644
--- a/infrastructure/controllers/base/tailscale/release-operator.yaml
+++ b/infrastructure/controllers/base/tailscale/release-operator.yaml
@@ -22,17 +22,26 @@ spec:
   upgrade:
     crds: CreateReplace
   values:
-    # Operator configuration
     operatorConfig:
-      # Tag to use for pods created by the operator (e.g., tailnet)
       tags: [tailnet]
-      # Auth key from secret - PLACEHOLDER, replace with real key
       operatorSecretRef:
         name: tailscale-operator-authkey
         key: authkey
       logFile: "/var/log/tailscale.log"
-      # Don't block pod startup if Tailscale auth fails
       waitForLinkLocal: false
-    # Disable webhook (optional)
+      useOAuth: false
+      useOIDC: false
+      podSecurityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+      securityContext:
+        allowPrivilegeEscalation: false
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+        capabilities:
+          drop:
+            - ALL
     webhook:
       enabled: false