diff --git a/cluster/deployment.yaml b/cluster/deployment.yaml
index ab5ad03b..c10799c1 100644
--- a/cluster/deployment.yaml
+++ b/cluster/deployment.yaml
@@ -12,10 +12,39 @@ spec:
       labels:
         app: reactibot
     spec:
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      volumes:
+        - name: tmp
+          emptyDir: {}
       containers:
         - name: reactibot
           image: $(IMAGE)
+          ports:
+            - containerPort: 3000
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+          resources:
+            requests:
+              cpu: 10m
+              memory: 64Mi
+            limits:
+              cpu: 250m
+              memory: 256Mi
           env:
+            - name: HOME # npm (CMD) writes ~/.npm logs; /home/node is read-only
+              value: /tmp
             - name: ENVIRONMENT
               value: production
             - name: DISCORD_HASH
diff --git a/cluster/networkpolicy.yaml b/cluster/networkpolicy.yaml
new file mode 100644
index 00000000..d99f1025
--- /dev/null
+++ b/cluster/networkpolicy.yaml
@@ -0,0 +1,37 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: reactibot
+spec:
+  podSelector:
+    matchLabels:
+      app: reactibot
+  policyTypes: [Ingress, Egress]
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: ingress-nginx
+      ports:
+        - protocol: TCP
+          port: 3000
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except: [10.0.0.0/8, 169.254.0.0/16]
+      ports:
+        - protocol: TCP
+          port: 443
diff --git a/kustomization.yaml b/kustomization.yaml
index 1eeb36d0..2bdbfbd1 100644
--- a/kustomization.yaml
+++ b/kustomization.yaml
@@ -7,6 +7,7 @@ resources:
   - cluster/service.yaml
   - cluster/deployment.yaml
   - cluster/ingress.yaml
+  - cluster/networkpolicy.yaml
 
 configMapGenerator:
   - name: k8s-context # this is an internal name