diff --git a/.ko.yaml b/.ko.yaml
new file mode 100644
index 0000000..6ccd2d5
--- /dev/null
+++ b/.ko.yaml
@@ -0,0 +1 @@
+defaultBaseImage: gcr.io/distroless/static:nonroot
diff --git a/README.md b/README.md
index 79b40e3..ff18b45 100644
--- a/README.md
+++ b/README.md
@@ -40,6 +40,8 @@ webhook:
 
 Secret to store webhook API key:
 
+**Note:** the `api-key` secret must be created in the same namespace as the `Certificate`.
+
 ```
 apiVersion: v1
 kind: Secret
diff --git a/config/200-psp.yaml b/config/200-psp.yaml
new file mode 100644
index 0000000..9ccbce6
--- /dev/null
+++ b/config/200-psp.yaml
@@ -0,0 +1,36 @@
+---
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: template-solver
+  annotations:
+    apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
+    apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
+    seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'
+    seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
+spec:
+  privileged: false
+  allowPrivilegeEscalation: false
+  requiredDropCapabilities: ["ALL"]
+  readOnlyRootFilesystem: true
+  volumes: ["secret"]
+  hostNetwork: false
+  hostIPC: false
+  hostPID: false
+  runAsUser:
+    rule: 'MustRunAsNonRoot'
+  seLinux:
+    rule: 'RunAsAny'
+  supplementalGroups:
+    rule: 'MustRunAs'
+    ranges:
+    - min: 1
+      max: 65535
+  fsGroup:
+    rule: 'MustRunAs'
+    ranges:
+    - min: 1
+      max: 65535
+  hostPorts:
+    - min: 1
+      max: 65535
diff --git a/config/300-podsecuritypolicy.yaml b/config/300-podsecuritypolicy.yaml
deleted file mode 100644
index 722161a..0000000
--- a/config/300-podsecuritypolicy.yaml
+++ /dev/null
@@ -1,28 +0,0 @@
----
-apiVersion: policy/v1beta1
-kind: PodSecurityPolicy
-metadata:
-  name: pvc-reaper
-spec:
-  privileged: false
-  allowPrivilegeEscalation: false
-  requiredDropCapabilities:
-  - ALL
-  readOnlyRootFilesystem: true
-  hostNetwork: false
-  hostIPC: false
-  hostPID: false
-  runAsUser:
-    rule: 'RunAsAny'
-  seLinux:
-    rule: 'RunAsAny'
-  supplementalGroups:
-    rule: 'MustRunAs'
-    ranges:
-    - min: 1
-      max: 65535
-  fsGroup:
-    rule: 'MustRunAs'
-    ranges:
-    - min: 1
-      max: 65535
diff --git a/config/200-rbac.yaml b/config/300-rbac.yaml
similarity index 96%
rename from config/200-rbac.yaml
rename to config/300-rbac.yaml
index b63c6bb..a761642 100644
--- a/config/200-rbac.yaml
+++ b/config/300-rbac.yaml
@@ -51,12 +51,9 @@ kind: ClusterRole
 metadata:
   name: template-solver:domain-solver
 rules:
-- apiGroups:
-  - template-solver
-  resources:
-  - '*'
-  verbs:
-  - 'create'
+- apiGroups: ["template-solver"]
+  resources: ["*"]
+  verbs: ["create"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding
diff --git a/config/400-apiservice.yaml b/config/400-apiservice.yaml
index b521fe0..c88c4b5 100644
--- a/config/400-apiservice.yaml
+++ b/config/400-apiservice.yaml
@@ -1,3 +1,4 @@
+---
 apiVersion: apiregistration.k8s.io/v1beta1
 kind: APIService
 metadata:
diff --git a/config/service.yaml b/config/service.yaml
index 71cd080..ed01072 100644
--- a/config/service.yaml
+++ b/config/service.yaml
@@ -1,3 +1,4 @@
+---
 apiVersion: v1
 kind: Service
 metadata: