diff --git a/devel/addon/pebble/BUILD.bazel b/devel/addon/pebble/BUILD.bazel
index a1337a6fe..9f60fef78 100644
--- a/devel/addon/pebble/BUILD.bazel
+++ b/devel/addon/pebble/BUILD.bazel
@@ -1,6 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary")
 load("@io_bazel_rules_docker//go:image.bzl", "go_image")
 load("@io_bazel_rules_docker//container:bundle.bzl", "container_bundle")
+load("@io_bazel_rules_docker//container:container.bzl", "container_image")
 
 # gazelle:ignore
 
@@ -12,9 +13,16 @@ container_bundle(
     tags = ["manual"],
 )
 
+container_image(
+    name = "nonroot_go_image_static",
+    base = "@go_image_static//image",
+    # See https://github.com/GoogleContainerTools/distroless/blob/2cac07c7c62b2dc52c4274a1810939fb06039ab9/base/base.bzl#L9
+    user = "65532",
+)
+
 go_image(
     name = "image",
-    base = "@static_base//image",
+    base = ":nonroot_go_image_static",
     binary = ":app",
     tags = ["manual"],
     visibility = ["//visibility:public"],
diff --git a/devel/addon/pebble/chart/templates/deployment.yaml b/devel/addon/pebble/chart/templates/deployment.yaml
index ea47e533a..73f97831f 100644
--- a/devel/addon/pebble/chart/templates/deployment.yaml
+++ b/devel/addon/pebble/chart/templates/deployment.yaml
@@ -23,6 +23,8 @@ spec:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
+          securityContext:
+            runAsNonRoot: true
           args:
           - -config=/config/config.json
           - -strict={{ .Values.strict }}