diff --git a/apps/nextcloud/manifests/pvc-sync-cronjob.yaml b/apps/nextcloud/manifests/pvc-sync-cronjob.yaml
index bf006b9..3a5c5a3 100644
--- a/apps/nextcloud/manifests/pvc-sync-cronjob.yaml
+++ b/apps/nextcloud/manifests/pvc-sync-cronjob.yaml
@@ -60,6 +60,11 @@ spec:
       template:
         spec:
           restartPolicy: Never
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 65534
+            seccompProfile:
+              type: RuntimeDefault
           affinity:
             podAffinity:
               requiredDuringSchedulingIgnoredDuringExecution:
@@ -70,6 +75,10 @@ spec:
           containers:
             - name: restic-backup
               image: restic/restic:0.16.4
+              securityContext:
+                allowPrivilegeEscalation: false
+                capabilities:
+                  drop: ["ALL"]
               command:
                 - /bin/sh
                 - -c
diff --git a/infrastructure/cert-manager/manifests/home-ip-ddns-cronjob.yaml b/infrastructure/cert-manager/manifests/home-ip-ddns-cronjob.yaml
index e1caf2f..9ca373e 100644
--- a/infrastructure/cert-manager/manifests/home-ip-ddns-cronjob.yaml
+++ b/infrastructure/cert-manager/manifests/home-ip-ddns-cronjob.yaml
@@ -17,7 +17,7 @@ data:
     #!/bin/sh
     set -eu
 
-    ZONE_NAME="kube.huskypup.net"
+    ZONE_NAME="huskypup.net"  # Cloudflare zone is the parent domain - kube.huskypup.net is just a record within it, not its own zone
     RECORD_NAME="home.kube.huskypup.net"
     TOKEN="$(cat /etc/cf/cloudflare-token)"
 
@@ -75,6 +75,8 @@ spec:
           securityContext:
             runAsNonRoot: true
             runAsUser: 65534
+            seccompProfile:
+              type: RuntimeDefault
           containers:
             - name: ddns-update
               image: alpine/k8s:1.32.13  # already has curl + jq (see MEMORY.md kubectl image note)
diff --git a/infrastructure/vault/manifests/raft-snapshot-cronjob.yaml b/infrastructure/vault/manifests/raft-snapshot-cronjob.yaml
index 3ff6f17..f987da7 100644
--- a/infrastructure/vault/manifests/raft-snapshot-cronjob.yaml
+++ b/infrastructure/vault/manifests/raft-snapshot-cronjob.yaml
@@ -60,17 +60,18 @@ data:
     kubectl -n vault exec vault-0 -- rm -f "/tmp/${SNAP_NAME}"
 
     echo "==> Installing mc (MinIO client)..."
-    curl -sf https://dl.min.io/client/mc/release/linux-amd64/mc -o /usr/local/bin/mc
-    chmod +x /usr/local/bin/mc
-    mc alias set vps-minio "http://${VPS_MINIO_ENDPOINT}" \
+    curl -sf https://dl.min.io/client/mc/release/linux-amd64/mc -o /tmp/mc
+    chmod +x /tmp/mc
+    export MC_CONFIG_DIR=/tmp/.mc
+    /tmp/mc alias set vps-minio "http://${VPS_MINIO_ENDPOINT}" \
       "${MINIO_ACCESS_KEY}" "${MINIO_SECRET_KEY}" >/dev/null
 
     echo "==> Uploading ${SNAP_NAME} to vps-minio/${BUCKET}..."
-    mc cp "/tmp/${SNAP_NAME}" "vps-minio/${BUCKET}/${SNAP_NAME}"
+    /tmp/mc cp "/tmp/${SNAP_NAME}" "vps-minio/${BUCKET}/${SNAP_NAME}"
     rm -f "/tmp/${SNAP_NAME}"
 
     echo "==> Pruning snapshots older than 30 days..."
-    mc find "vps-minio/${BUCKET}" --older-than 30d --exec "mc rm {}" || true
+    /tmp/mc find "vps-minio/${BUCKET}" --older-than 30d --exec "/tmp/mc rm {}" || true
 
     echo "==> Done: ${SNAP_NAME}"
 ---
@@ -91,10 +92,19 @@ spec:
         spec:
           serviceAccountName: argocd-hook-sa  # already has kubectl exec rights in this namespace (see vault-init-job.yaml)
           restartPolicy: Never
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 65534
+            seccompProfile:
+              type: RuntimeDefault
           containers:
             - name: raft-snapshot
               image: alpine/k8s:1.32.13
               command: ["/bin/bash", "/scripts/snapshot.sh"]
+              securityContext:
+                allowPrivilegeEscalation: false
+                capabilities:
+                  drop: ["ALL"]
               env:
                 - name: MINIO_ACCESS_KEY
                   valueFrom:
diff --git a/scripts/vps-dns-failover/vps-dns-failover.sh b/scripts/vps-dns-failover/vps-dns-failover.sh
index 5eabb8e..e198739 100755
--- a/scripts/vps-dns-failover/vps-dns-failover.sh
+++ b/scripts/vps-dns-failover/vps-dns-failover.sh
@@ -30,7 +30,7 @@ set -euo pipefail
 
 TOKEN_FILE="/etc/vps-dns-failover/cloudflare-token"
 STATE_DIR="/var/lib/vps-dns-failover"
-ZONE_NAME="kube.huskypup.net"
+ZONE_NAME="huskypup.net"  # Cloudflare zone is the parent domain - kube.huskypup.net is just a record within it, not its own zone
 HOME_CHECK_HOST="home.kube.huskypup.net"
 HOME_CHECK_PORT=443
 FAILURE_THRESHOLD=3   # consecutive failed checks before flipping to the VPS