diff --git a/argocd/apps/penpot/penpot.yaml b/argocd/apps/penpot/penpot.yaml
index 766c4df..7c1fcd4 100644
--- a/argocd/apps/penpot/penpot.yaml
+++ b/argocd/apps/penpot/penpot.yaml
@@ -39,6 +39,9 @@ spec:
           backend.containerSecurityContext:
           - name: allowPrivilegeEscalation
             value: false
+          capabilities:
+          - name: drop
+            value: 'ALL'
     chart: penpot
   destination:
     server: 'https://kubernetes.default.svc'