diff --git a/argocd/apps/penpot/penpot.yaml b/argocd/apps/penpot/penpot.yaml
index 861bc05..b0377f8 100644
--- a/argocd/apps/penpot/penpot.yaml
+++ b/argocd/apps/penpot/penpot.yaml
@@ -37,10 +37,11 @@ spec:
         - name: ingress.annotations.cert-manager\.io\/cluster-issuer
           value: lets-encrypt-staging
           backend.containerSecurityContext:
-            allowPrivilegeEscalation: 'false'
+            allowPrivilegeEscalation: false
             capabilities:
               drop:
                 - ALL
+            runAsNonRoot: true
     chart: penpot
   destination:
     server: 'https://kubernetes.default.svc'