diff --git a/templates/audiobookshelf/docker-compose.yml b/templates/audiobookshelf/docker-compose.yml
index 8a1dd3a..9fd0523 100644
--- a/templates/audiobookshelf/docker-compose.yml
+++ b/templates/audiobookshelf/docker-compose.yml
@@ -20,6 +20,11 @@ services:
     image: ghcr.io/advplyr/audiobookshelf:2.19.5
     container_name: audiobookshelf
     restart: unless-stopped
+    # Runs as root (see note above). Restore an escalation boundary: block SUID-based privilege
+    # escalation. Full cap_drop is NOT applied — the image's root-init needs file-ownership caps to
+    # set up /metadata, and dropping them reproduces the EACCES failure we hit pinning user:1000.
+    security_opt:
+      - no-new-privileges:true
     environment:
       - TZ=Europe/Budapest
     volumes:
diff --git a/templates/komga/docker-compose.yml b/templates/komga/docker-compose.yml
index 9d315a7..316fcff 100644
--- a/templates/komga/docker-compose.yml
+++ b/templates/komga/docker-compose.yml
@@ -19,6 +19,11 @@ services:
     image: gotson/komga:1.20.0
     container_name: komga
     restart: unless-stopped
+    # Runs as root (see note above). Restore an escalation boundary: block SUID-based privilege
+    # escalation. Full cap_drop is NOT applied — the image's root-init needs CHOWN/SETUID/SETGID to
+    # set up /config, and dropping them crash-loops it (the same failure we hit pinning user:1000).
+    security_opt:
+      - no-new-privileges:true
     environment:
       - TZ=Europe/Budapest
     volumes: