diff --git a/k8s/lab/deployment.yaml b/k8s/lab/deployment.yaml
index 1592c6c..dd4e6b9 100644
--- a/k8s/lab/deployment.yaml
+++ b/k8s/lab/deployment.yaml
@@ -16,14 +16,28 @@ spec:
       labels:
         app: vanna-clubpetro
     spec:
+      # A imagem roda como non-root (uid/gid 10001). fsGroup dá posse dos
+      # volumes (PVC) ao grupo 10001 pra que o processo consiga escrever no
+      # store/cache — sem isso o ChromaDB/CSV falha com Permission denied.
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        runAsGroup: 10001
+        fsGroup: 10001
       containers:
         - name: vanna-clubpetro
           image: us-central1-docker.pkg.dev/corepetro/clubpetro-lab/vanna-clubpetro:lab-latest
           imagePullPolicy: IfNotPresent
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
           ports:
             - name: http
               containerPort: 8765
           env:
+            - name: HOME
+              value: /home/app
             - name: VANNA_CORS_ORIGINS
               value: "https://lab.clubpetro.com,https://homologation.clubpetro.com"
           envFrom:
@@ -57,7 +71,7 @@ spec:
               mountPath: /app/data_storage
               subPath: data_storage
             - name: data
-              mountPath: /root/.cache/chroma
+              mountPath: /home/app/.cache/chroma
               subPath: chroma-onnx-cache
       volumes:
         - name: data