diff --git a/Kubernetes/GitOps/Gotify/deployment.yaml b/Kubernetes/GitOps/Gotify/deployment.yaml
index a58b226a..1dde5595 100644
--- a/Kubernetes/GitOps/Gotify/deployment.yaml
+++ b/Kubernetes/GitOps/Gotify/deployment.yaml
@@ -23,7 +23,8 @@ spec:
         worker: "true"
       containers:
       - name: gotify
-        image: gotify/server:latest
+        # Pin to the major tag so a pod restart can't silently pull a new major.
+        image: gotify/server:2
         env:
         - name: GOTIFY_DB_SQLITE
           value: /app/data/gotify.db
@@ -31,6 +32,38 @@ spec:
           value: "80"
         ports:
         - containerPort: 80
+        # Limits so a leak or spike can't starve the node.
+        resources:
+          requests:
+            memory: "16Mi"
+            cpu: "25m"
+            ephemeral-storage: "64Mi"
+          limits:
+            memory: "128Mi"
+            cpu: "200m"
+            ephemeral-storage: "256Mi"
+        # Probes: liveness is a cheap TCP check; readiness hits /version,
+        # which Gotify serves unauthenticated, so traffic waits until it's up.
+        livenessProbe:
+          tcpSocket:
+            port: 80
+          initialDelaySeconds: 5
+          periodSeconds: 15
+        readinessProbe:
+          httpGet:
+            path: /version
+            port: 80
+          initialDelaySeconds: 3
+          periodSeconds: 10
+        # Defense-in-depth. Gotify binds :80, so ALL caps are dropped and only
+        # NET_BIND_SERVICE is added back — nothing else is needed.
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: ["ALL"]
+            add: ["NET_BIND_SERVICE"]
+          seccompProfile:
+            type: RuntimeDefault
         volumeMounts:
         - name: gotify
           mountPath: /app/data