diff --git a/calico/templates/daemonset-calico-etcd.yaml b/calico/templates/daemonset-calico-etcd.yaml
index a8f83da771..2ede67cbc6 100644
--- a/calico/templates/daemonset-calico-etcd.yaml
+++ b/calico/templates/daemonset-calico-etcd.yaml
@@ -51,8 +51,7 @@ spec:
         # a failure.  This annotation works in tandem with the toleration below.
         scheduler.alpha.kubernetes.io/critical-pod: ''
     spec:
-      securityContext:
-        readOnlyRootFilesystem: true
+{{ dict "envAll" $envAll "application" "calico" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
       serviceAccountName: {{ $serviceAccountName }}
       tolerations:
         # This taint is set by all kubelets running `--cloud-provider=external`
@@ -77,6 +76,7 @@ spec:
         - name: calico-etcd
 {{ tuple $envAll "calico_etcd" | include "helm-toolkit.snippets.image" | indent 10 }}
 {{ tuple $envAll $envAll.Values.pod.resources.calico_etcd | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
+{{ dict "envAll" $envAll "application" "calico" "container" "calico_etcd" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
           env:
             - name: CALICO_ETCD_IP
               valueFrom:
diff --git a/calico/values.yaml b/calico/values.yaml
index 5b8da9ec05..29e5ae886d 100644
--- a/calico/values.yaml
+++ b/calico/values.yaml
@@ -37,6 +37,13 @@ images:
       - calico_kube_controllers
 
 pod:
+  security_context:
+    calico:
+      pod:
+        runAsUser: 0
+      container:
+        calico_etcd:
+          readOnlyRootFilesystem: true
   resources:
     enabled: false
     jobs: