diff --git a/charts/backstage/values.yaml b/charts/backstage/values.yaml
index a7c2ca3d..403b5a93 100644
--- a/charts/backstage/values.yaml
+++ b/charts/backstage/values.yaml
@@ -67,6 +67,7 @@ upstream:
                 subject: legacy-default-config
                 secret: ${BACKEND_SECRET}
     containerSecurityContext:
+      readOnlyRootFilesystem: true
       allowPrivilegeEscalation: false
       capabilities:
         drop: ["ALL"]