diff --git a/charts/spire/charts/spiffe-csi-driver/README.md b/charts/spire/charts/spiffe-csi-driver/README.md
index 9544dfd..ff68998 100644
--- a/charts/spire/charts/spiffe-csi-driver/README.md
+++ b/charts/spire/charts/spiffe-csi-driver/README.md
@@ -52,8 +52,7 @@ A Helm chart to install the SPIFFE CSI driver.
 | `serviceAccount.name`                         | The name of the service account to use. If not set and create is true, a name is generated.                                                                              | `""`                                        |
 | `podAnnotations`                              | Pod annotations for spiffe-csi-driver                                                                                                                                    | `{}`                                        |
 | `podSecurityContext`                          | Security context for CSI driver pods                                                                                                                                     | `{}`                                        |
-| `securityContext.readOnlyRootFilesystem`      | Flag for read only root filesystem                                                                                                                                       | `true`                                      |
-| `securityContext.privileged`                  | Flag for specifying privileged mode                                                                                                                                      | `true`                                      |
+| `securityContext`                             | Security context for CSI driver containers                                                                                                                               | `{}`                                        |
 | `nodeSelector`                                | Node selector for CSI driver pods                                                                                                                                        | `{}`                                        |
 | `tolerations`                                 | Tolerations for CSI driver pods                                                                                                                                          | `[]`                                        |
 | `affinity`                                    | Node affinity                                                                                                                                                            | `{}`                                        |
diff --git a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml
index 83892b9..ba97d12 100644
--- a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml
+++ b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml
@@ -1,3 +1,6 @@
+{{- $mainSecurityContext := deepCopy .Values.securityContext }}
+{{- $podSecurityContext := deepCopy .Values.podSecurityContext }}
+---
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
@@ -48,6 +51,8 @@ spec:
       {{- end }}
       {{- include "spire-lib.default_node_priority_class_name" . | nindent 6 }}
       {{- if or (gt (len .Values.initContainers) 0) (dig "openshift" false .Values.global) (dig "selinux" false .Values.global) .Values.selinux.enabled }}
+      securityContext:
+        {{- toYaml $podSecurityContext | nindent 8 }}
       initContainers:
       {{- if or (dig "openshift" false .Values.global) (dig "selinux" false .Values.global) .Values.selinux.enabled }}
         - name: set-context
@@ -59,10 +64,7 @@ spec:
           image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.selinux.image "global" .Values.global) }}
           imagePullPolicy: {{ .Values.selinux.image.pullPolicy }}
           securityContext:
-            capabilities:
-              drop:
-                - all
-            privileged: true
+            {{- $mainSecurityContext | toYaml | nindent 12 }}
           volumeMounts:
             - name: spire-agent-socket-dir
               mountPath: /spire-agent-socket
@@ -110,11 +112,7 @@ spec:
               mountPropagation: Bidirectional
               name: mountpoint-dir
           securityContext:
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop:
-                - all
-            privileged: true
+            {{- $mainSecurityContext | toYaml | nindent 12 }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
         # This container runs the CSI Node Driver Registrar which takes care
diff --git a/charts/spire/charts/spiffe-csi-driver/values.yaml b/charts/spire/charts/spiffe-csi-driver/values.yaml
index a1bb7b8..645bc28 100644
--- a/charts/spire/charts/spiffe-csi-driver/values.yaml
+++ b/charts/spire/charts/spiffe-csi-driver/values.yaml
@@ -95,12 +95,14 @@ podAnnotations: {}
 podSecurityContext: {}
   # fsGroup: 2000
 
-## @param securityContext.readOnlyRootFilesystem Flag for read only root filesystem
-## @param securityContext.privileged Flag for specifying privileged mode
+## @param securityContext [object] Security context for CSI driver containers
 ##
 securityContext:
   readOnlyRootFilesystem: true
   privileged: true
+  capabilities:
+    drop:
+      - ALL
   # runAsNonRoot: true
   # runAsUser: 1000
   # capabilities: