diff --git a/charts/network-observer/templates/_deployment.yaml b/charts/network-observer/templates/_deployment.yaml
index aee4e1281..6a7541732 100644
--- a/charts/network-observer/templates/_deployment.yaml
+++ b/charts/network-observer/templates/_deployment.yaml
@@ -22,6 +22,8 @@
     secretName: {{ include "network-observer.basicAuthSecretName" . }}
 {{- end }}
 {{- end }}
+- name: proxy-tmp
+  emptyDir: {}
 {{- end -}}
 
 {{- define "network-observer.nginxProxySpec" -}}
@@ -52,6 +54,8 @@ volumeMounts:
     name: {{ include "network-observer.tlsSecretName" . }}
   - mountPath: /etc/nginx
     name: nginx-config
+  - mountPath: /tmp
+    name: proxy-tmp
 {{- if eq .Values.auth.strategy "basic" }}
   - mountPath: /etc/httpusers
     name: nginx-htpasswd
@@ -90,4 +94,6 @@ volumeMounts:
     name: {{ include "network-observer.tlsSecretName" . }}
   - mountPath: /etc/session-secrets/
     name: session-cookie-secret
+  - mountPath: /tmp
+    name: proxy-tmp
 {{- end -}}
diff --git a/charts/network-observer/templates/deployment.yaml b/charts/network-observer/templates/deployment.yaml
index 2e01cdb5a..4ba457e37 100644
--- a/charts/network-observer/templates/deployment.yaml
+++ b/charts/network-observer/templates/deployment.yaml
@@ -47,6 +47,14 @@ spec:
       {{- end }}
       containers:
         - name: network-observer
+          {{- if .Values.livenessProbe.enabled }}    
+          livenessProbe:
+            {{- omit .Values.livenessProbe "enabled" | toYaml | nindent 12 }}
+          {{- end }}
+          {{- if .Values.readinessProbe.enabled }}    
+          readinessProbe:
+            {{- omit .Values.readinessProbe "enabled" | toYaml | nindent 12 }}
+          {{- end }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           {{- with .Values.securityContext }}
diff --git a/charts/network-observer/values.yaml b/charts/network-observer/values.yaml
index 2fd5b00ca..4b889ceb9 100644
--- a/charts/network-observer/values.yaml
+++ b/charts/network-observer/values.yaml
@@ -20,6 +20,7 @@ prometheus:
   pullPolicy: IfNotPresent
   tag: "v3.11.3"
   securityContext:
+    readOnlyRootFilesystem: true
     allowPrivilegeEscalation: false
     capabilities:
       drop:
@@ -79,6 +80,7 @@ nginx:
   tag: "1.31.0-alpine"
   pullPolicy: IfNotPresent
   securityContext:
+    readOnlyRootFilesystem: true
     allowPrivilegeEscalation: false
     capabilities:
       drop:
@@ -90,6 +92,7 @@ openshiftOauthProxy:
   tag: "4.22.0"
   pullPolicy: IfNotPresent
   securityContext:
+    readOnlyRootFilesystem: true
     allowPrivilegeEscalation: false
     capabilities:
       drop:
@@ -218,9 +221,38 @@ podSecurityContext:
 
 # network-observer container securityContext
 securityContext:
+  readOnlyRootFilesystem: true
   allowPrivilegeEscalation: false
   capabilities:
     drop:
       - ALL
 
 skipManagementLabels: false
+
+## Controller containers' readiness probe
+## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes
+readinessProbe:
+  enabled: false
+  # httpGet:
+  #   path: /healthz
+  #   port: 9191
+  #   scheme: HTTP
+  # failureThreshold: 3
+  # initialDelaySeconds: 60
+  # periodSeconds: 30
+  # successThreshold: 1
+  # timeoutSeconds: 30
+
+## Default backend containers' liveness probe
+## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes
+livenessProbe:
+  enabled: false
+  # httpGet:
+  #   path: /healthz
+  #   port: 9191
+  #   scheme: HTTP
+  # failureThreshold: 3
+  # initialDelaySeconds: 60
+  # periodSeconds: 30
+  # successThreshold: 1
+  # timeoutSeconds: 30