diff --git a/glance-system/glance-kisfenyo.yaml b/glance-system/glance-kisfenyo.yaml
index 98ce881..94617e1 100644
--- a/glance-system/glance-kisfenyo.yaml
+++ b/glance-system/glance-kisfenyo.yaml
@@ -1965,10 +1965,14 @@ spec:
       initContainers:
         - name: build-bookmarks-index
           image: python:3.12-alpine
+          securityContext:
+            runAsUser: 0
+            runAsGroup: 0
+            allowPrivilegeEscalation: false
           command: ["/bin/sh", "-c"]
           args:
             - |
-              pip install --no-cache-dir pyyaml >/dev/null
+              apk add --no-cache py3-yaml >/dev/null
               python - <<'PY'
               import json, os, yaml
 
@@ -1997,7 +2001,7 @@ spec:
                           "group": group_title,
                         })
 
-              # de-dupe by URL (keep first)
+              # de-dupe by URL
               seen = set()
               out = []
               for it in items:
@@ -2012,6 +2016,12 @@ spec:
 
               print(f"Wrote {len(out)} bookmarks -> /app/assets/bookmarks.json")
               PY
+    volumeMounts:
+      - name: config
+        mountPath: /config
+        readOnly: true
+      - name: assets
+        mountPath: /app/assets
           volumeMounts:
             - name: config
               mountPath: /config