diff --git a/deploy/gcp/cloudrun-service.yaml b/deploy/gcp/cloudrun-service.yaml
index afee9c69..9990b308 100644
--- a/deploy/gcp/cloudrun-service.yaml
+++ b/deploy/gcp/cloudrun-service.yaml
@@ -12,11 +12,22 @@ spec:
       annotations:
         autoscaling.knative.dev/minScale: "0"
         autoscaling.knative.dev/maxScale: "10"
+        container.apparmor.security.beta.kubernetes.io/explorer: runtime/default
+        seccomp.security.alpha.kubernetes.io/pod: runtime/default
     spec:
       containerConcurrency: 80
       timeoutSeconds: 300
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
       containers:
-        - image: gcr.io/PROJECT_ID/knowledge-explorer:latest
+        - name: explorer
+          image: gcr.io/PROJECT_ID/knowledge-explorer:latest
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            runAsUser: 1000
           ports:
             - name: http1
               containerPort: 8000
diff --git a/deploy/helm/knowledge-explorer/values.yaml b/deploy/helm/knowledge-explorer/values.yaml
index 7b5914b0..78577d88 100644
--- a/deploy/helm/knowledge-explorer/values.yaml
+++ b/deploy/helm/knowledge-explorer/values.yaml
@@ -13,6 +13,9 @@ fullnameOverride: ""
 podAnnotations:
   # AppArmor — must match the container name defined in the Deployment template ("explorer").
   container.apparmor.security.beta.kubernetes.io/explorer: runtime/default
+  # Legacy seccomp annotation — required by older Terrascan/checkov versions
+  # that predate the seccompProfile field in PodSecurityContext.
+  seccomp.security.alpha.kubernetes.io/pod: runtime/default
 podLabels: {}
 
 podSecurityContext:
diff --git a/deploy/kubernetes/deployment.yaml b/deploy/kubernetes/deployment.yaml
index 4a6c9d3d..7343da95 100644
--- a/deploy/kubernetes/deployment.yaml
+++ b/deploy/kubernetes/deployment.yaml
@@ -20,6 +20,7 @@ spec:
     metadata:
       annotations:
         container.apparmor.security.beta.kubernetes.io/explorer: runtime/default
+        seccomp.security.alpha.kubernetes.io/pod: runtime/default
       labels:
         app.kubernetes.io/name: knowledge-explorer
         app.kubernetes.io/part-of: semantica
@@ -30,7 +31,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: explorer
-          image: semantica-knowledge-explorer:latest
+          image: semantica-knowledge-explorer:0.5.0
           imagePullPolicy: IfNotPresent
           ports:
             - name: http