diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 8ce459dfd..b073e15d5 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -64,7 +64,7 @@ repos:
         require_serial: false
         additional_dependencies: [prettier@3.9.4]
         files: \.(md|ya?ml)$
-        exclude: ^(CHANGELOG.md|chart/templates/.*|chart/.snapshots/.*|docs/reference/load_balancer_.*\.md|)$
+        exclude: ^(CHANGELOG.md|chart/templates/.*|chart/.snapshots/.*|deploy/.*|docs/reference/load_balancer_.*\.md|)$
 
   - repo: local
     hooks:
diff --git a/chart/.snapshots/default.yaml b/chart/.snapshots/default.yaml
index f5ed1322f..32a481688 100644
--- a/chart/.snapshots/default.yaml
+++ b/chart/.snapshots/default.yaml
@@ -107,6 +107,12 @@ spec:
         app.kubernetes.io/name: 'hcloud-cloud-controller-manager'
     spec:
       serviceAccountName: hcloud-cloud-controller-manager
+      securityContext:
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65532
+        seccompProfile:
+          type: RuntimeDefault
       dnsPolicy: Default
       tolerations:
         # Allow HCCM itself to schedule on nodes that have not yet been initialized by HCCM.
@@ -128,6 +134,12 @@ spec:
           effect: "NoExecute"
       containers:
         - name: hcloud-cloud-controller-manager
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            readOnlyRootFilesystem: true
           args:
             - "--allow-untagged-cloud"
             - "--cloud-provider=hcloud"
diff --git a/chart/.snapshots/full.daemonset.yaml b/chart/.snapshots/full.daemonset.yaml
index b4369cba8..735e39edb 100644
--- a/chart/.snapshots/full.daemonset.yaml
+++ b/chart/.snapshots/full.daemonset.yaml
@@ -109,6 +109,12 @@ spec:
         pod-annotation: pod-annotation
     spec:
       serviceAccountName: hcloud-cloud-controller-manager
+      securityContext:
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65532
+        seccompProfile:
+          type: RuntimeDefault
       dnsPolicy: Default
       tolerations:
         # Allow HCCM itself to schedule on nodes that have not yet been initialized by HCCM.
@@ -137,6 +143,12 @@ spec:
         foo: bar
       containers:
         - name: hcloud-cloud-controller-manager
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            readOnlyRootFilesystem: true
           command:
             - "/bin/hcloud-cloud-controller-manager"
             - "--allow-untagged-cloud"
diff --git a/chart/templates/daemonset.yaml b/chart/templates/daemonset.yaml
index 4a72d18f6..f6a8af112 100644
--- a/chart/templates/daemonset.yaml
+++ b/chart/templates/daemonset.yaml
@@ -26,6 +26,10 @@ spec:
         {{- toYaml . | nindent 8 }}
     {{- end }}
       serviceAccountName: {{ include "hcloud-cloud-controller-manager.name" . }}
+      {{- with .Values.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       dnsPolicy: Default
       tolerations:
         # Allow HCCM itself to schedule on nodes that have not yet been initialized by HCCM.
@@ -60,6 +64,10 @@ spec:
       {{- end }}
       containers:
         - name: hcloud-cloud-controller-manager
+          {{- with .Values.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           command:
             - "/bin/hcloud-cloud-controller-manager"
             {{- range $key, $value := $.Values.args }}
diff --git a/chart/templates/deployment.yaml b/chart/templates/deployment.yaml
index f3be3c54a..c9177dd37 100644
--- a/chart/templates/deployment.yaml
+++ b/chart/templates/deployment.yaml
@@ -31,6 +31,10 @@ spec:
         {{- toYaml . | nindent 8 }}
     {{- end }}
       serviceAccountName: {{ include "hcloud-cloud-controller-manager.name" . }}
+      {{- with .Values.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       dnsPolicy: {{ .Values.dnsPolicy }}
       {{- with .Values.dnsConfig }}
       dnsConfig:
@@ -74,6 +78,10 @@ spec:
       {{- end }}
       containers:
         - name: hcloud-cloud-controller-manager
+          {{- with .Values.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           args:
             {{- range $key, $value := $.Values.args }}
             {{- if not (eq $value nil) }}
diff --git a/chart/values.yaml b/chart/values.yaml
index 33f17ff05..f282c7ddc 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -120,6 +120,24 @@ resources:
     cpu: 100m
     memory: 50Mi
 
+# Pod-level security context for the hccm Pod.
+# See https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+podSecurityContext:
+  runAsNonRoot: true
+  runAsUser: 65532
+  runAsGroup: 65532
+  seccompProfile:
+    type: RuntimeDefault
+
+# Container-level security context for the hccm container.
+# See https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+securityContext:
+  readOnlyRootFilesystem: true
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+
 selectorLabels:
   app.kubernetes.io/name: '{{ include "hcloud-cloud-controller-manager.name" $ }}'
   app.kubernetes.io/instance: "{{ $.Release.Name }}"
diff --git a/deploy/ccm-networks.yaml b/deploy/ccm-networks.yaml
index 499948ddd..550d60cef 100644
--- a/deploy/ccm-networks.yaml
+++ b/deploy/ccm-networks.yaml
@@ -105,6 +105,12 @@ spec:
         app: hcloud-cloud-controller-manager
     spec:
       serviceAccountName: hcloud-cloud-controller-manager
+      securityContext:
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65532
+        seccompProfile:
+          type: RuntimeDefault
       dnsPolicy: Default
       tolerations:
         # Allow HCCM itself to schedule on nodes that have not yet been initialized by HCCM.
@@ -127,6 +133,12 @@ spec:
       hostNetwork: true
       containers:
         - name: hcloud-cloud-controller-manager
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            readOnlyRootFilesystem: true
           args:
             - "--allow-untagged-cloud"
             - "--cloud-provider=hcloud"
diff --git a/deploy/ccm.yaml b/deploy/ccm.yaml
index 001a8a187..99d33c055 100644
--- a/deploy/ccm.yaml
+++ b/deploy/ccm.yaml
@@ -105,6 +105,12 @@ spec:
         app: hcloud-cloud-controller-manager
     spec:
       serviceAccountName: hcloud-cloud-controller-manager
+      securityContext:
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65532
+        seccompProfile:
+          type: RuntimeDefault
       dnsPolicy: Default
       tolerations:
         # Allow HCCM itself to schedule on nodes that have not yet been initialized by HCCM.
@@ -126,6 +132,12 @@ spec:
           effect: "NoExecute"
       containers:
         - name: hcloud-cloud-controller-manager
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            readOnlyRootFilesystem: true
           args:
             - "--allow-untagged-cloud"
             - "--cloud-provider=hcloud"