diff --git a/deploy/installer/generated/ibm-block-csi-operator.yaml b/deploy/installer/generated/ibm-block-csi-operator.yaml
index 93370252b..f9e2b2727 100644
--- a/deploy/installer/generated/ibm-block-csi-operator.yaml
+++ b/deploy/installer/generated/ibm-block-csi-operator.yaml
@@ -1447,6 +1447,9 @@ spec:
                       - amd64
                       - s390x
                       - ppc64le
+      hostIPC: false
+      hostNetwork: false
+      hostPID: false
       containers:
       - name: ibm-block-csi-operator
         resources:
@@ -1467,9 +1470,14 @@ spec:
           initialDelaySeconds: 10
           periodSeconds: 30
         securityContext:
+          allowPrivilegeEscalation: false
           capabilities:
             drop:
             - ALL
+          privileged: false
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          runAsUser: 1001
         image: ibmcom/ibm-block-csi-operator:1.4.0
         imagePullPolicy: IfNotPresent
         command:
diff --git a/deploy/olm-catalog/ibm-block-csi-operator-community/1.4.0/ibm-block-csi-operator.v1.4.0.clusterserviceversion.yaml b/deploy/olm-catalog/ibm-block-csi-operator-community/1.4.0/ibm-block-csi-operator.v1.4.0.clusterserviceversion.yaml
index 5c7a48bec..d1893ae84 100644
--- a/deploy/olm-catalog/ibm-block-csi-operator-community/1.4.0/ibm-block-csi-operator.v1.4.0.clusterserviceversion.yaml
+++ b/deploy/olm-catalog/ibm-block-csi-operator-community/1.4.0/ibm-block-csi-operator.v1.4.0.clusterserviceversion.yaml
@@ -745,6 +745,9 @@ spec:
                               operator: In
                               values:
                                 - amd64
+                hostIPC: false
+                hostNetwork: false
+                hostPID: false
                 containers:
                 - name: ibm-block-csi-operator
                   resources:
@@ -765,9 +768,14 @@ spec:
                     initialDelaySeconds: 10
                     periodSeconds: 30
                   securityContext:
+                    allowPrivilegeEscalation: false
                     capabilities:
                       drop:
                       - ALL
+                    privileged: false
+                    readOnlyRootFilesystem: true
+                    runAsNonRoot: true
+                    runAsUser: 1001
                   image: ibmcom/ibm-block-csi-operator:1.4.0
                   imagePullPolicy: IfNotPresent
                   command:
diff --git a/deploy/olm-catalog/ibm-block-csi-operator/ibm-block-csi-operator.v1.4.0.clusterserviceversion.yaml b/deploy/olm-catalog/ibm-block-csi-operator/ibm-block-csi-operator.v1.4.0.clusterserviceversion.yaml
index 4a07723d1..9ac557780 100644
--- a/deploy/olm-catalog/ibm-block-csi-operator/ibm-block-csi-operator.v1.4.0.clusterserviceversion.yaml
+++ b/deploy/olm-catalog/ibm-block-csi-operator/ibm-block-csi-operator.v1.4.0.clusterserviceversion.yaml
@@ -743,6 +743,9 @@ spec:
                               operator: In
                               values:
                                 - amd64
+                hostIPC: false
+                hostNetwork: false
+                hostPID: false
                 containers:
                 - name: ibm-block-csi-operator
                   resources:
@@ -763,9 +766,14 @@ spec:
                     initialDelaySeconds: 10
                     periodSeconds: 30
                   securityContext:
+                    allowPrivilegeEscalation: false
                     capabilities:
                       drop:
                       - ALL
+                    privileged: false
+                    readOnlyRootFilesystem: true
+                    runAsNonRoot: true
+                    runAsUser: 1001
                   image: registry.connect.redhat.com/ibm/ibm-block-csi-operator:1.4.0
                   imagePullPolicy: IfNotPresent
                   command:
diff --git a/deploy/operator.yaml b/deploy/operator.yaml
index 7cd0b549e..fff29400d 100644
--- a/deploy/operator.yaml
+++ b/deploy/operator.yaml
@@ -40,6 +40,9 @@ spec:
                       - amd64
                       - s390x
                       - ppc64le
+      hostIPC: false
+      hostNetwork: false
+      hostPID: false
       containers:
       - name: ibm-block-csi-operator
         resources:
@@ -60,9 +63,14 @@ spec:
           initialDelaySeconds: 10
           periodSeconds: 30
         securityContext:
+          allowPrivilegeEscalation: false
           capabilities:
             drop:
             - ALL
+          privileged: false
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          runAsUser: 1001
         image: ibmcom/ibm-block-csi-operator:1.4.0
         imagePullPolicy: IfNotPresent
         command:
diff --git a/pkg/config/settings.go b/pkg/config/settings.go
index 754b02fa7..601e9f659 100644
--- a/pkg/config/settings.go
+++ b/pkg/config/settings.go
@@ -31,6 +31,7 @@ const (
 	DefaultNamespace = "default"
 	DefaultLogLevel  = "DEBUG"
 	ControllerUserID = int64(9999)
+	NonRootUserID    = int64(1001)
 
 	NodeAgentPort = "10086"
 )
diff --git a/pkg/controller/ibmblockcsi/syncer/csi_controller.go b/pkg/controller/ibmblockcsi/syncer/csi_controller.go
index e41920efb..8122e01bf 100644
--- a/pkg/controller/ibmblockcsi/syncer/csi_controller.go
+++ b/pkg/controller/ibmblockcsi/syncer/csi_controller.go
@@ -101,8 +101,9 @@ func (s *csiControllerSyncer) ensurePodSpec() corev1.PodSpec {
 		Containers: s.ensureContainersSpec(),
 		Volumes:    s.ensureVolumes(),
 		SecurityContext: &corev1.PodSecurityContext{
-			FSGroup:   &fsGroup,
-			RunAsUser: &fsGroup,
+			RunAsUser:    &fsGroup,
+			RunAsNonRoot: boolptr.True(),
+			FSGroup:      &fsGroup,
 		},
 		Affinity:           s.driver.Spec.Controller.Affinity,
 		Tolerations:        s.driver.Spec.Controller.Tolerations,
@@ -223,7 +224,12 @@ func ensureNodeAffinity() *corev1.NodeAffinity {
 }
 
 func (s *csiControllerSyncer) ensureContainer(name, image string, args []string) corev1.Container {
-	sc := &corev1.SecurityContext{AllowPrivilegeEscalation: boolptr.False()}
+	sc := &corev1.SecurityContext{
+		Privileged:               boolptr.False(),
+		RunAsNonRoot:             boolptr.True(),
+		ReadOnlyRootFilesystem:   boolptr.True(),
+		AllowPrivilegeEscalation: boolptr.False(),
+	}
 	fillSecurityContextCapabilities(sc)
 	return corev1.Container{
 		Name:  name,
diff --git a/pkg/controller/ibmblockcsi/syncer/csi_node.go b/pkg/controller/ibmblockcsi/syncer/csi_node.go
index 4874c79cd..5b81dca5a 100644
--- a/pkg/controller/ibmblockcsi/syncer/csi_node.go
+++ b/pkg/controller/ibmblockcsi/syncer/csi_node.go
@@ -99,6 +99,7 @@ func (s *csiNodeSyncer) ensurePodSpec() corev1.PodSpec {
 		HostIPC:            true,
 		HostNetwork: 		true,
 		ServiceAccountName: config.GetNameForResource(config.CSINodeServiceAccount, s.driver.Name),
+		SecurityContext:    &corev1.PodSecurityContext{RunAsNonRoot: boolptr.True()},
 		Affinity:           s.driver.Spec.Node.Affinity,
 		Tolerations:        s.driver.Spec.Node.Tolerations,
 	}
@@ -135,6 +136,8 @@ func (s *csiNodeSyncer) ensureContainersSpec() []corev1.Container {
 
 	nodePlugin.SecurityContext = &corev1.SecurityContext{
 		Privileged:               boolptr.True(),
+		RunAsNonRoot:             boolptr.False(),
+		ReadOnlyRootFilesystem:   boolptr.True(),
 		AllowPrivilegeEscalation: boolptr.True(),
 	}
 	fillSecurityContextCapabilities(
@@ -163,7 +166,16 @@ func (s *csiNodeSyncer) ensureContainersSpec() []corev1.Container {
 			},
 		},
 	}
-	registrar.SecurityContext = &corev1.SecurityContext{AllowPrivilegeEscalation: boolptr.False()}
+
+	nonRootUserID := config.NonRootUserID
+
+	registrar.SecurityContext = &corev1.SecurityContext{
+		Privileged:               boolptr.False(),
+		RunAsUser:                &nonRootUserID,
+		RunAsNonRoot:             boolptr.True(),
+		ReadOnlyRootFilesystem:   boolptr.False(),
+		AllowPrivilegeEscalation: boolptr.False(),
+	}
 	fillSecurityContextCapabilities(registrar.SecurityContext)
 	registrar.ImagePullPolicy = s.getCSINodeDriverRegistrarPullPolicy()
 
@@ -174,7 +186,13 @@ func (s *csiNodeSyncer) ensureContainersSpec() []corev1.Container {
 			"--csi-address=/csi/csi.sock",
 		},
 	)
-	livenessProbe.SecurityContext = &corev1.SecurityContext{AllowPrivilegeEscalation: boolptr.False()}
+	livenessProbe.SecurityContext = &corev1.SecurityContext{
+		Privileged:               boolptr.False(),
+		RunAsUser:                &nonRootUserID,
+		RunAsNonRoot:             boolptr.True(),
+		ReadOnlyRootFilesystem:   boolptr.True(),
+		AllowPrivilegeEscalation: boolptr.False(),
+	}
 	fillSecurityContextCapabilities(livenessProbe.SecurityContext)
 	livenessProbe.ImagePullPolicy = s.getCSINodeDriverRegistrarPullPolicy()