diff --git a/argocd/apps/penpot/penpot.yaml b/argocd/apps/penpot/penpot.yaml
index 8f1bafc..766c4df 100644
--- a/argocd/apps/penpot/penpot.yaml
+++ b/argocd/apps/penpot/penpot.yaml
@@ -36,6 +36,9 @@ spec:
           value: 'true'
         - name: ingress.annotations.cert-manager\.io\/cluster-issuer
           value: lets-encrypt-staging
+          backend.containerSecurityContext:
+          - name: allowPrivilegeEscalation
+            value: false
     chart: penpot
   destination:
     server: 'https://kubernetes.default.svc'