diff --git a/config/01-podsecuritypolicy.yaml b/config/01-podsecuritypolicy.yaml
index 3667a17..449b28c 100644
--- a/config/01-podsecuritypolicy.yaml
+++ b/config/01-podsecuritypolicy.yaml
@@ -5,6 +5,9 @@ metadata:
 spec:
   privileged: false
   allowPrivilegeEscalation: false
+  requiredDropCapabilities:
+  - ALL
+  readOnlyRootFilesystem: true
   volumes:
   - 'secret'
   hostNetwork: false