diff --git a/CHANGELOG.md b/CHANGELOG.md
index b4a04ab7..01145188 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,7 @@ and this project adheres to
 
 ### Added
 
+- 🔒️(helm) Add pod and container securityContext #1197
 - ✨(summary) add routes v2 for async STT and summary tasks  #1171
 
 ## [1.13.0] - 2026-03-31
diff --git a/src/frontend/Dockerfile b/src/frontend/Dockerfile
index 5f2a9ded..12b972d1 100644
--- a/src/frontend/Dockerfile
+++ b/src/frontend/Dockerfile
@@ -1,5 +1,7 @@
 FROM node:20-alpine AS frontend-deps
 
+USER node
+
 WORKDIR /home/frontend/
 
 COPY ./src/frontend/package.json ./package.json
@@ -8,7 +10,7 @@ COPY ./src/frontend/package-lock.json ./package-lock.json
 RUN npm ci
 
 COPY .dockerignore ./.dockerignore
-COPY ./src/frontend/ .
+COPY --chown=node:node ./src/frontend/ .
 
 ### ---- Front-end builder image ----
 FROM frontend-deps AS meet
@@ -17,6 +19,8 @@ WORKDIR /home/frontend
 
 FROM frontend-deps AS meet-dev
 
+USER node
+
 WORKDIR /home/frontend
 
 EXPOSE 8080
diff --git a/src/helm/env.d/common.yaml.gotmpl b/src/helm/env.d/common.yaml.gotmpl
new file mode 100644
index 00000000..1a427b7f
--- /dev/null
+++ b/src/helm/env.d/common.yaml.gotmpl
@@ -0,0 +1,38 @@
+.podSecurityContext: &podSecurityContext
+  runAsUser: 1000
+  runAsGroup: 1000
+  fsGroup: 1000
+  fsGroupChangePolicy: "OnRootMismatch"
+  runAsNonRoot: true
+  seccompProfile:
+    type: RuntimeDefault
+
+.securityContext: &securityContext
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+
+frontend:
+  podSecurityContext: *podSecurityContext
+  securityContext: *securityContext
+
+backend:
+  podSecurityContext: *podSecurityContext
+  securityContext: *securityContext
+
+summary:
+  podSecurityContext: *podSecurityContext
+  securityContext: *securityContext
+
+celeryTranscribe:
+  podSecurityContext: *podSecurityContext
+  securityContext: *securityContext
+
+celerySummarize:
+  podSecurityContext: *podSecurityContext
+  securityContext: *securityContext
+
+agents:
+  podSecurityContext: *podSecurityContext
+  securityContext: *securityContext
diff --git a/src/helm/env.d/dev-dinum/values.livekit.yaml.gotmpl b/src/helm/env.d/dev-dinum/values.livekit.yaml.gotmpl
index aac470fa..dd63e514 100644
--- a/src/helm/env.d/dev-dinum/values.livekit.yaml.gotmpl
+++ b/src/helm/env.d/dev-dinum/values.livekit.yaml.gotmpl
@@ -28,7 +28,6 @@ livekit:
     urls:
         - https://meet.127.0.0.1.nip.io/api/v1.0/rooms/webhooks-livekit/
 
-
 loadBalancer:
   type: nginx
   annotations:
diff --git a/src/helm/env.d/dev-dinum/values.meet.yaml.gotmpl b/src/helm/env.d/dev-dinum/values.meet.yaml.gotmpl
index 56523ff9..89259d5a 100644
--- a/src/helm/env.d/dev-dinum/values.meet.yaml.gotmpl
+++ b/src/helm/env.d/dev-dinum/values.meet.yaml.gotmpl
@@ -174,7 +174,7 @@ ingressWebhook:
 posthog:
   ingress:
     enabled: false
-  
+
   ingressAssets:
     enabled: false
 
diff --git a/src/helm/env.d/dev-keycloak/values.livekit.yaml.gotmpl b/src/helm/env.d/dev-keycloak/values.livekit.yaml.gotmpl
index aac470fa..dd63e514 100644
--- a/src/helm/env.d/dev-keycloak/values.livekit.yaml.gotmpl
+++ b/src/helm/env.d/dev-keycloak/values.livekit.yaml.gotmpl
@@ -28,7 +28,6 @@ livekit:
     urls:
         - https://meet.127.0.0.1.nip.io/api/v1.0/rooms/webhooks-livekit/
 
-
 loadBalancer:
   type: nginx
   annotations:
diff --git a/src/helm/env.d/dev-keycloak/values.meet.yaml.gotmpl b/src/helm/env.d/dev-keycloak/values.meet.yaml.gotmpl
index 6bb6fdf5..88f2ce95 100644
--- a/src/helm/env.d/dev-keycloak/values.meet.yaml.gotmpl
+++ b/src/helm/env.d/dev-keycloak/values.meet.yaml.gotmpl
@@ -126,7 +126,6 @@ backend:
     CELERY_ENABLED: True
     CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
 
-
   migrate:
     command:
       - "/bin/sh"
@@ -194,7 +193,7 @@ ingressWebhook:
 posthog:
   ingress:
     enabled: false
-  
+
   ingressAssets:
     enabled: false
 
diff --git a/src/helm/helmfile.yaml.gotmpl b/src/helm/helmfile.yaml.gotmpl
index a9e754e6..ae27cdaa 100644
--- a/src/helm/helmfile.yaml.gotmpl
+++ b/src/helm/helmfile.yaml.gotmpl
@@ -37,6 +37,7 @@ releases:
   missingFileHandler: Warn
   chart: ./meet
   values:
+  - env.d/common.yaml.gotmpl
   - env.d/{{ .Environment.Name }}/values.meet.yaml.gotmpl
   - env.d/{{ .Environment.Name }}/values.secrets.yaml
   secrets:
diff --git a/src/helm/meet/templates/agents_deployment.yaml b/src/helm/meet/templates/agents_deployment.yaml
index 56d8055c..4d62e49b 100644
--- a/src/helm/meet/templates/agents_deployment.yaml
+++ b/src/helm/meet/templates/agents_deployment.yaml
@@ -31,6 +31,10 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.agents.shareProcessNamespace }}
+      {{- with .Values.agents.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         {{- with .Values.agents.sidecars }}
           {{- toYaml . | nindent 8 }}
diff --git a/src/helm/meet/templates/backend_deployment.yaml b/src/helm/meet/templates/backend_deployment.yaml
index 14468763..bb848ef4 100644
--- a/src/helm/meet/templates/backend_deployment.yaml
+++ b/src/helm/meet/templates/backend_deployment.yaml
@@ -31,6 +31,10 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.backend.shareProcessNamespace }}
+      {{- with .Values.backend.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         {{- with .Values.backend.sidecars }}
           {{- toYaml . | nindent 8 }}
diff --git a/src/helm/meet/templates/backend_job_createsuperuser.yaml b/src/helm/meet/templates/backend_job_createsuperuser.yaml
index 0203ce36..8ff654df 100644
--- a/src/helm/meet/templates/backend_job_createsuperuser.yaml
+++ b/src/helm/meet/templates/backend_job_createsuperuser.yaml
@@ -30,6 +30,10 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.backend.shareProcessNamespace }}
+      {{- with .Values.backend.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         {{- with .Values.backend.sidecars }}
           {{- toYaml . | nindent 8 }}
diff --git a/src/helm/meet/templates/backend_job_migrate.yaml b/src/helm/meet/templates/backend_job_migrate.yaml
index 8f05ec84..efc901b5 100644
--- a/src/helm/meet/templates/backend_job_migrate.yaml
+++ b/src/helm/meet/templates/backend_job_migrate.yaml
@@ -30,6 +30,10 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.backend.shareProcessNamespace }}
+      {{- with .Values.backend.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         {{- with .Values.backend.sidecars }}
           {{- toYaml . | nindent 8 }}
diff --git a/src/helm/meet/templates/celery_backend_deployment.yaml b/src/helm/meet/templates/celery_backend_deployment.yaml
index 32656a8d..0d413646 100644
--- a/src/helm/meet/templates/celery_backend_deployment.yaml
+++ b/src/helm/meet/templates/celery_backend_deployment.yaml
@@ -31,6 +31,10 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.celeryBackend.shareProcessNamespace }}
+      {{- with .Values.celeryBackend.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         {{- with .Values.celeryBackend.sidecars }}
           {{- toYaml . | nindent 8 }}
diff --git a/src/helm/meet/templates/celery_summarize_deployment.yaml b/src/helm/meet/templates/celery_summarize_deployment.yaml
index 31993488..744f338a 100644
--- a/src/helm/meet/templates/celery_summarize_deployment.yaml
+++ b/src/helm/meet/templates/celery_summarize_deployment.yaml
@@ -31,6 +31,10 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.celerySummarize.shareProcessNamespace }}
+      {{- with .Values.celerySummarize.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         {{- with .Values.celerySummarize.sidecars }}
           {{- toYaml . | nindent 8 }}
diff --git a/src/helm/meet/templates/celery_transcribe_deployment.yaml b/src/helm/meet/templates/celery_transcribe_deployment.yaml
index 3ab55fa9..db44cfc0 100644
--- a/src/helm/meet/templates/celery_transcribe_deployment.yaml
+++ b/src/helm/meet/templates/celery_transcribe_deployment.yaml
@@ -31,6 +31,10 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.celeryTranscribe.shareProcessNamespace }}
+      {{- with .Values.celeryTranscribe.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         {{- with .Values.celeryTranscribe.sidecars }}
           {{- toYaml . | nindent 8 }}
diff --git a/src/helm/meet/templates/frontend_deployment.yaml b/src/helm/meet/templates/frontend_deployment.yaml
index ba508ca2..003a4619 100644
--- a/src/helm/meet/templates/frontend_deployment.yaml
+++ b/src/helm/meet/templates/frontend_deployment.yaml
@@ -31,6 +31,10 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.frontend.shareProcessNamespace }}
+      {{- with .Values.frontend.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         {{- with .Values.frontend.sidecars }}
           {{- toYaml . | nindent 8 }}
diff --git a/src/helm/meet/templates/summary_deployment.yaml b/src/helm/meet/templates/summary_deployment.yaml
index b39497cf..4b5b0a3a 100644
--- a/src/helm/meet/templates/summary_deployment.yaml
+++ b/src/helm/meet/templates/summary_deployment.yaml
@@ -31,6 +31,10 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.summary.shareProcessNamespace }}
+      {{- with .Values.summary.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         {{- with .Values.summary.sidecars }}
           {{- toYaml . | nindent 8 }}
diff --git a/src/helm/meet/values.yaml b/src/helm/meet/values.yaml
index ba2b395b..0c01ed9f 100644
--- a/src/helm/meet/values.yaml
+++ b/src/helm/meet/values.yaml
@@ -216,9 +216,12 @@ backend:
     ttlSecondsAfterFinished: 30
     backoffLimit: 2
 
-  ## @param backend.securityContext Configure backend Pod security context
+  ## @param backend.securityContext Configure backend Container security context
   securityContext: null
 
+  ## @param backend.podSecurityContext Configure backend Pod security context
+  podSecurityContext: null
+
   ## @param backend.envVars Configure backend container environment variables
   ## @extra backend.envVars.BY_VALUE Example environment variable by setting value directly
   ## @extra backend.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap
@@ -359,9 +362,12 @@ frontend:
   ## @param frontend.sidecars Add sidecars containers to frontend deployment
   sidecars: []
 
-  ## @param frontend.securityContext Configure frontend Pod security context
+  ## @param frontend.securityContext Configure frontend Container security context
   securityContext: null
 
+  ## @param frontend.podSecurityContext Configure frontend Pod security context
+  podSecurityContext: null
+
   ## @param frontend.envVars Configure frontend container environment variables
   ## @extra frontend.envVars.BY_VALUE Example environment variable by setting value directly
   ## @extra frontend.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap
@@ -533,9 +539,12 @@ summary:
   ## @param summary.migrateJobAnnotations Annotations for the migrate job
   migrateJobAnnotations: {}
 
-  ## @param summary.securityContext Configure summary Pod security context
+  ## @param summary.securityContext Configure summary Container security context
   securityContext: null
 
+  ## @param summary.podSecurityContext Configure summary Pod security context
+  podSecurityContext: null
+
   ## @param summary.envVars Configure summary container environment variables
   ## @extra summary.envVars.BY_VALUE Example environment variable by setting value directly
   ## @extra summary.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap
@@ -646,9 +655,12 @@ celeryBackend:
   ## @param celeryBackend.migrateJobAnnotations Annotations for the migrate job
   migrateJobAnnotations: {}
 
-  ## @param celeryBackend.securityContext Configure celeryBackend Pod security context
+  ## @param celeryBackend.securityContext Configure celeryBackend Container security context
   securityContext: null
 
+  ## @param celeryBackend.podSecurityContext Configure celeryBackend Pod security context
+  podSecurityContext: null
+
   ## @param celeryBackend.envVars Configure celeryBackend container environment variables
   ## @extra celeryBackend.envVars.BY_VALUE Example environment variable by setting value directly
   ## @extra celeryBackend.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap
@@ -755,9 +767,12 @@ celeryTranscribe:
   ## @param celeryTranscribe.migrateJobAnnotations Annotations for the migrate job
   migrateJobAnnotations: {}
 
-  ## @param celeryTranscribe.securityContext Configure celeryTranscribe Pod security context
+  ## @param celeryTranscribe.securityContext Configure celeryTranscribe Container security context
   securityContext: null
 
+  ## @param celeryTranscribe.podSecurityContext Configure celeryTranscribe Pod security context
+  podSecurityContext: null
+
   ## @param celeryTranscribe.envVars Configure celeryTranscribe container environment variables
   ## @extra celeryTranscribe.envVars.BY_VALUE Example environment variable by setting value directly
   ## @extra celeryTranscribe.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap
@@ -864,9 +879,12 @@ celerySummarize:
   ## @param celerySummarize.migrateJobAnnotations Annotations for the migrate job
   migrateJobAnnotations: {}
 
-  ## @param celerySummarize.securityContext Configure celerySummarize Pod security context
+  ## @param celerySummarize.securityContext Configure celerySummarize Container security context
   securityContext: null
 
+  ## @param celerySummarize.podSecurityContext Configure celerySummarize Pod security context
+  podSecurityContext: null
+
   ## @param celerySummarize.envVars Configure celerySummarize container environment variables
   ## @extra celerySummarize.envVars.BY_VALUE Example environment variable by setting value directly
   ## @extra celerySummarize.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap
@@ -1073,9 +1091,12 @@ agents:
   ## @param agents.sidecars Add sidecars containers to agents deployment
   sidecars: []
 
-  ## @param agents.securityContext Configure agents Pod security context
+  ## @param agents.securityContext Configure agents Container security context
   securityContext: null
 
+  ## @param agents.podSecurityContext Configure agents Pod security context
+  podSecurityContext: null
+
   ## @param agents.envVars Configure agents container environment variables
   ## @extra agents.envVars.BY_VALUE Example environment variable by setting value directly
   ## @extra agents.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap