diff --git a/charts/common/Chart.yaml b/charts/common/Chart.yaml
index b904f15..565be36 100644
--- a/charts/common/Chart.yaml
+++ b/charts/common/Chart.yaml
@@ -7,4 +7,4 @@ maintainers:
   - email: alex@kharkevich.org
     name: Alexander Kharkevich
 name: common
-version: 2.3.0
+version: 2.4.0
diff --git a/charts/common/templates/_container.yaml b/charts/common/templates/_container.yaml
index e8ee9af..28188ce 100644
--- a/charts/common/templates/_container.yaml
+++ b/charts/common/templates/_container.yaml
@@ -11,6 +11,7 @@
 name: app
 image: "{{ default "ghcr.io/technicaldomain" .Values.image.registry }}/{{ .Values.image.name }}:{{ .Values.image.tag | default (include "common.chart.appVersion" .) }}"
 imagePullPolicy: {{ default "IfNotPresent" .Values.image.pullPolicy }}
+{{ include "common.security.containerContext" . -}}
 {{- with .Values.command }}
 command:
   {{- toYaml . | nindent 2 }}
diff --git a/charts/common/templates/_security_context.yaml b/charts/common/templates/_security_context.yaml
index b978f2c..a4059b4 100644
--- a/charts/common/templates/_security_context.yaml
+++ b/charts/common/templates/_security_context.yaml
@@ -9,4 +9,38 @@ securityContext:
   runAsGroup: {{ $runAsGroup }}
   fsGroup: {{ $fsGroup }}
   runAsNonRoot: {{ $runAsNonRoot }}
+{{- with $context.seccompProfile }}
+  seccompProfile:
+    {{- toYaml . | nindent 4 }}
+{{- end }}
+{{- end -}}
+
+{{- /*
+Container-level security context - rendered at containers[*].securityContext.
+Rendered only when `.Values.containerSecurityContext` is set. Each field falls
+back: container value -> pod-level value -> secure default.
+*/ -}}
+{{- define "common.security.containerContext" -}}
+{{- $pod := default (dict) .Values.securityContext -}}
+{{- $ctr := default (dict) .Values.containerSecurityContext -}}
+{{- if $ctr -}}
+{{- $runAsNonRoot := ternary $ctr.runAsNonRoot (ternary $pod.runAsNonRoot true (hasKey $pod "runAsNonRoot")) (hasKey $ctr "runAsNonRoot") -}}
+{{- $runAsUser := ternary $ctr.runAsUser (ternary $pod.runAsUser 1001 (hasKey $pod "runAsUser")) (hasKey $ctr "runAsUser") -}}
+{{- $allowPrivEsc := ternary $ctr.allowPrivilegeEscalation false (hasKey $ctr "allowPrivilegeEscalation") -}}
+{{- $readOnlyRoot := ternary $ctr.readOnlyRootFilesystem true (hasKey $ctr "readOnlyRootFilesystem") -}}
+{{- $seccomp := ternary $ctr.seccompProfile (ternary $pod.seccompProfile nil (hasKey $pod "seccompProfile")) (hasKey $ctr "seccompProfile") -}}
+securityContext:
+  runAsNonRoot: {{ $runAsNonRoot }}
+  runAsUser: {{ $runAsUser }}
+  allowPrivilegeEscalation: {{ $allowPrivEsc }}
+  readOnlyRootFilesystem: {{ $readOnlyRoot }}
+{{- if hasKey $ctr "capabilities" }}
+  capabilities:
+    {{- toYaml $ctr.capabilities | nindent 4 }}
+{{- end }}
+{{- if $seccomp }}
+  seccompProfile:
+    {{- toYaml $seccomp | nindent 4 }}
+{{- end }}
+{{- end -}}
 {{- end -}}