diff --git a/services/hermes/deployment.yaml b/services/hermes/deployment.yaml
index 0516d9975..1100dc70c 100644
--- a/services/hermes/deployment.yaml
+++ b/services/hermes/deployment.yaml
@@ -292,6 +292,15 @@ spec:
             # TODO: migrate to Vault alongside the Gitea token; this manual
             # Secret was created in the interest of demo time.
 
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            runAsUser: 10000
+            runAsGroup: 10000
+            capabilities:
+              drop: [ALL]
+            seccompProfile:
+              type: RuntimeDefault
           volumeMounts:
             - name: home
               mountPath: /opt/data