diff --git a/kubernetes/infrastructure/openbao/snapshot-cronjob.yaml b/kubernetes/infrastructure/openbao/snapshot-cronjob.yaml
index 20bfcc5d..6bc96259 100644
--- a/kubernetes/infrastructure/openbao/snapshot-cronjob.yaml
+++ b/kubernetes/infrastructure/openbao/snapshot-cronjob.yaml
@@ -46,6 +46,10 @@ spec:
           containers:
             - name: snapshot
               image: quay.io/openbao/openbao:2.5.5 # same image as the server — bao CLI included
+              securityContext:
+                allowPrivilegeEscalation: false
+                capabilities:
+                  drop: ["ALL"]
               command: ["/bin/sh", "-ec"]
               args:
                 - |