diff --git a/examples/production/README.md b/examples/production/README.md
index 77f3b78..4cf892c 100644
--- a/examples/production/README.md
+++ b/examples/production/README.md
@@ -1,8 +1,14 @@
-Install with something similar to:
+# Recommended production setup
 
+Too install Spire with the least privileges possible we deploy spire accross 2 namespaces.
+
+```shell
 kubectl create namespace "spire-system"
 kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privileged
 kubectl create namespace "spire-server"
 kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted
 
 helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml
+```
+
+See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
diff --git a/examples/production/values.yaml b/examples/production/values.yaml
index 7658760..b18767e 100644
--- a/examples/production/values.yaml
+++ b/examples/production/values.yaml
@@ -10,6 +10,8 @@ spiffe-oidc-discovery-provider:
   podSecurityContext:
     runAsUser: 1000
     runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch
   securityContext:
     allowPrivilegeEscalation: false
     runAsNonRoot: true
@@ -29,6 +31,8 @@ spire-server:
   podSecurityContext:
     runAsUser: 1000
     runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch
   securityContext:
     allowPrivilegeEscalation: false
     runAsNonRoot: true