diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index d360c9c..bac7d4a 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -73,6 +73,7 @@ jobs:
             --restart unless-stopped \
             --read-only \
             --cap-drop=ALL \
+            --security-opt=no-new-privileges:true \
             -p 127.0.0.1:8000:8000 \
             "$IMAGE"; then
             echo "New container started"
@@ -83,6 +84,7 @@ jobs:
               --restart unless-stopped \
               --read-only \
               --cap-drop=ALL \
+              --security-opt=no-new-privileges:true \
               -p 127.0.0.1:8000:8000 \
               "$OLD_IMAGE"
             exit 1
@@ -110,6 +112,7 @@ jobs:
               --restart unless-stopped \
               --read-only \
               --cap-drop=ALL \
+              --security-opt=no-new-privileges:true \
               -p 127.0.0.1:8000:8000 \
               "$OLD_IMAGE"
             exit 1