diff --git a/.github/workflows/kube-linter.yml b/.github/workflows/kube-linter.yml
new file mode 100644
index 00000000..5bbe3566
--- /dev/null
+++ b/.github/workflows/kube-linter.yml
@@ -0,0 +1,31 @@
+name: Check Kubernetes YAMLs with kube-linter
+
+on:
+  push:
+    branches: [ test-branch-kube-lint ]
+    # Keep this list in sync with the matrix below
+    paths:
+      - 'components/ra/**'
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    runs-on: fase-self-hosted-dind
+    strategy:
+      fail-fast: true
+      matrix:
+        directory:
+          - components/ra/user-claims-backend/overlays
+          - components/ra/user-claims-frontend/overlays
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Scan ${{ matrix.directory }} with KubeLinter
+        uses: stackrox/kube-linter-action@v1
+        with:
+          directory: ${{ matrix.directory }}
+          config: .kube-linter.yaml
+          format: plain
diff --git a/.kube-linter.yaml b/.kube-linter.yaml
new file mode 100644
index 00000000..5a4a7aff
--- /dev/null
+++ b/.kube-linter.yaml
@@ -0,0 +1,7 @@
+# kube-linter configuration
+# Uses kube-linter's default checks, minus the CPU/memory requests and limits checks.
+checks:
+  addAllBuiltIn: false # Keep the default set rather than enabling every built-in check
+  exclude:
+    - unset-cpu-requirements
+    - unset-memory-requirements
diff --git a/components/ra/user-claims-backend/base/deployment.yaml b/components/ra/user-claims-backend/base/deployment.yaml
index a708afdf..5f5c02d1 100644
--- a/components/ra/user-claims-backend/base/deployment.yaml
+++ b/components/ra/user-claims-backend/base/deployment.yaml
@@ -22,6 +22,11 @@ spec:
       containers:
         - name: user-claims-backend
           imagePullPolicy: Always
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 1000
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
           ports:
             - containerPort: 3001
           envFrom:
@@ -29,7 +34,7 @@ spec:
                 name: user-claims-backend
           volumeMounts:
             - name: uploads
-              mountPath: "/app/uploads"
+              mountPath: "/app/backend/uploads"
               readOnly: false
           readinessProbe:
             httpGet:
diff --git a/components/ra/user-claims-frontend/base/deployment.yaml b/components/ra/user-claims-frontend/base/deployment.yaml
index 7827f4f3..43d5b5cd 100644
--- a/components/ra/user-claims-frontend/base/deployment.yaml
+++ b/components/ra/user-claims-frontend/base/deployment.yaml
@@ -21,6 +21,11 @@ spec:
     spec:
       containers:
         - name: user-claims-frontend
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 1000
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
           imagePullPolicy: Always
           ports:
             - containerPort: 6011
@@ -30,3 +35,4 @@ spec:
         - name: env-config
           secret:
             secretName: user-claims-frontend
+