diff --git a/deploy/k8s/stalwart.yaml b/deploy/k8s/stalwart.yaml
index ffce525..f0da34a 100644
--- a/deploy/k8s/stalwart.yaml
+++ b/deploy/k8s/stalwart.yaml
@@ -51,8 +51,10 @@ spec:
             requests: { cpu: 50m, memory: 192Mi }
             limits: { memory: 1Gi }
           securityContext:
-            allowPrivilegeEscalation: false
-            capabilities: { drop: [ALL] }
+            # The binary carries the file capability cap_net_bind_service; exec fails (EPERM) unless it
+            # can be granted. Everything else stays dropped.
+            allowPrivilegeEscalation: true
+            capabilities: { drop: [ALL], add: [NET_BIND_SERVICE] }
           volumeMounts:
             - { name: config, mountPath: /etc/stalwart }
             # Scratch space and the file tracer (/var/lib/stalwart/logs); nothing durable lives here.