diff --git a/glance/templates/deployment-api.yaml b/glance/templates/deployment-api.yaml
index e7c4ec62a9..17b6487e75 100644
--- a/glance/templates/deployment-api.yaml
+++ b/glance/templates/deployment-api.yaml
@@ -92,8 +92,7 @@ spec:
         - name: glance-api
 {{ tuple $envAll "glance_api" | include "helm-toolkit.snippets.image" | indent 10 }}
 {{ tuple $envAll $envAll.Values.pod.resources.api | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
-          securityContext:
-            allowPrivilegeEscalation: false
+{{ dict "envAll" $envAll "application" "glance" "container" "glance_api" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
           command:
             - /tmp/glance-api.sh
             - start
diff --git a/glance/templates/deployment-registry.yaml b/glance/templates/deployment-registry.yaml
index bb82d024a9..25f90d78d6 100644
--- a/glance/templates/deployment-registry.yaml
+++ b/glance/templates/deployment-registry.yaml
@@ -59,8 +59,7 @@ spec:
         - name: glance-registry
 {{ tuple $envAll "glance_registry" | include "helm-toolkit.snippets.image" | indent 10 }}
 {{ tuple $envAll $envAll.Values.pod.resources.registry | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
-          securityContext:
-            allowPrivilegeEscalation: false
+{{ dict "envAll" $envAll "application" "glance" "container" "glance_registry" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
           command:
             - /tmp/glance-registry.sh
             - start
diff --git a/glance/values.yaml b/glance/values.yaml
index 0b84216631..3901d64304 100644
--- a/glance/values.yaml
+++ b/glance/values.yaml
@@ -786,9 +786,17 @@ endpoints:
     namespace: kube-public
 
 pod:
-  user:
+  security_context:
     glance:
-      uid: 42424
+      pod:
+        runAsUser: 42424
+      container:
+        glance_api:
+          readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
+        glance_registry:
+          readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
   affinity:
     anti:
       type: