diff --git a/bindata/operator/managers.yaml b/bindata/operator/managers.yaml
index e892da757..08f26dd3c 100644
--- a/bindata/operator/managers.yaml
+++ b/bindata/operator/managers.yaml
@@ -67,7 +67,13 @@ spec:
             memory: {{ .Deployment.Manager.Resources.Requests.Memory }}
         securityContext:
           allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - "ALL"
+          readOnlyRootFilesystem: true
         volumeMounts:
+        - mountPath: /tmp
+          name: tmp
 {{- if isEnvVarTrue .Deployment.Manager.Env "ENABLE_WEBHOOKS" }}
         - mountPath: /tmp/k8s-webhook-server/serving-certs
           name: cert
@@ -99,6 +105,8 @@ spec:
 {{- end }}
 {{- end }}
       volumes:
+      - emptyDir: {}
+        name: tmp
 {{- if isEnvVarTrue .Deployment.Manager.Env "ENABLE_WEBHOOKS" }}
       - name: cert
         secret:
diff --git a/config/operator/managers.yaml b/config/operator/managers.yaml
index e892da757..08f26dd3c 100644
--- a/config/operator/managers.yaml
+++ b/config/operator/managers.yaml
@@ -67,7 +67,13 @@ spec:
             memory: {{ .Deployment.Manager.Resources.Requests.Memory }}
         securityContext:
           allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - "ALL"
+          readOnlyRootFilesystem: true
         volumeMounts:
+        - mountPath: /tmp
+          name: tmp
 {{- if isEnvVarTrue .Deployment.Manager.Env "ENABLE_WEBHOOKS" }}
         - mountPath: /tmp/k8s-webhook-server/serving-certs
           name: cert
@@ -99,6 +105,8 @@ spec:
 {{- end }}
 {{- end }}
       volumes:
+      - emptyDir: {}
+        name: tmp
 {{- if isEnvVarTrue .Deployment.Manager.Env "ENABLE_WEBHOOKS" }}
       - name: cert
         secret: