diff --git a/VERSION b/VERSION
index 1fe6958..369bd4c 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.0.28
+0.0.29
diff --git a/bundle/manifests/susql-operator.clusterserviceversion.yaml b/bundle/manifests/susql-operator.clusterserviceversion.yaml
index 450c21e..4f0e484 100644
--- a/bundle/manifests/susql-operator.clusterserviceversion.yaml
+++ b/bundle/manifests/susql-operator.clusterserviceversion.yaml
@@ -27,15 +27,15 @@ metadata:
       ]
     capabilities: Basic Install
     categories: Monitoring
-    containerImage: quay.io/sustainable_computing_io/susql_operator:0.0.28
-    createdAt: "2024-09-10T02:33:36Z"
+    containerImage: quay.io/sustainable_computing_io/susql_operator:0.0.29
+    createdAt: "2024-09-10T06:44:16Z"
     description: 'Aggregates energy and CO2 emission data for pods tagged with SusQL
       labels '
     operators.operatorframework.io/builder: operator-sdk-v1.36.1
     operators.operatorframework.io/project_layout: go.kubebuilder.io/v4
     repository: https://github.com/sustainable-computing-io/susql-operator
     support: https://github.com/sustainable-computing-io/susql-operator/issues
-  name: susql-operator.v0.0.28
+  name: susql-operator.v0.0.29
   namespace: placeholder
 spec:
   apiservicedefinitions: {}
@@ -204,6 +204,7 @@ spec:
                   capabilities:
                     drop:
                     - ALL
+                  runAsNonRoot: true
               - command:
                 - /manager
                 env:
@@ -297,8 +298,8 @@ spec:
                       key: CARBON-QUERY-CONV-2J
                       name: susql-config
                       optional: true
-                image: quay.io/sustainable_computing_io/susql_operator:0.0.28
-                imagePullPolicy: IfNotPresent
+                image: quay.io/sustainable_computing_io/susql_operator:0.0.29
+                imagePullPolicy: Always
                 livenessProbe:
                   httpGet:
                     path: /healthz
@@ -400,5 +401,5 @@ spec:
   provider:
     name: SusQL Operator Contributors
     url: https://github.com/sustainable-computing-io/susql-operator
-  replaces: susql-operator.v0.0.27
-  version: 0.0.28
+  replaces: susql-operator.v0.0.28
+  version: 0.0.29
diff --git a/config/default/manager_auth_proxy_patch.yaml b/config/default/manager_auth_proxy_patch.yaml
index 81326ca..8bca255 100644
--- a/config/default/manager_auth_proxy_patch.yaml
+++ b/config/default/manager_auth_proxy_patch.yaml
@@ -12,6 +12,7 @@ spec:
       - name: kube-rbac-proxy
         securityContext:
           allowPrivilegeEscalation: false
+          runAsNonRoot: true
           capabilities:
             drop:
               - "ALL"
diff --git a/config/default/manager_config_patch.yaml b/config/default/manager_config_patch.yaml
index ff124ea..d9c015a 100644
--- a/config/default/manager_config_patch.yaml
+++ b/config/default/manager_config_patch.yaml
@@ -8,3 +8,9 @@ spec:
     spec:
       containers:
       - name: manager
+      securityContext:
+        allowPrivilegeEscalation: false
+        runAsNonRoot: true
+        capabilities:
+          drop:
+          - ALL
diff --git a/config/manager/kustomization.yaml b/config/manager/kustomization.yaml
index 1ad73d0..d5ba0e4 100644
--- a/config/manager/kustomization.yaml
+++ b/config/manager/kustomization.yaml
@@ -5,4 +5,4 @@ kind: Kustomization
 images:
 - name: controller
   newName: quay.io/sustainable_computing_io/susql_operator
-  newTag: 0.0.28
+  newTag: 0.0.29
diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml
index 8a40dd8..437c672 100644
--- a/config/manager/manager.yaml
+++ b/config/manager/manager.yaml
@@ -160,7 +160,7 @@ spec:
                 key: CARBON-QUERY-CONV-2J
                 optional: true
         image: '<OPERATOR_IMG>'
-        imagePullPolicy: IfNotPresent
+        imagePullPolicy: Always
         name: manager
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/config/manifests/bases/susql-operator.clusterserviceversion.yaml b/config/manifests/bases/susql-operator.clusterserviceversion.yaml
index 8a6f4b1..7e04aa1 100644
--- a/config/manifests/bases/susql-operator.clusterserviceversion.yaml
+++ b/config/manifests/bases/susql-operator.clusterserviceversion.yaml
@@ -116,5 +116,5 @@ spec:
   provider:
     name: SusQL Operator Contributors
     url: https://github.com/sustainable-computing-io/susql-operator
+  replaces: susql-operator.v0.0.28
   version: 0.0.0
-  replaces: susql-operator.v0.0.27
diff --git a/deployment/susql-controller/templates/deployment.yam b/deployment/susql-controller/templates/deployment.yam
new file mode 100644
index 0000000..e69de29
diff --git a/deployment/susql-controller/templates/deployment.yaml b/deployment/susql-controller/templates/deployment.yaml
index 241ae19..c113055 100644
--- a/deployment/susql-controller/templates/deployment.yaml
+++ b/deployment/susql-controller/templates/deployment.yaml
@@ -22,7 +22,7 @@ spec:
             containers:
                 - name: {{ .Values.name }}
                   image: {{ required "Please specify a 'containerImage' in the user file" .Values.containerImage }}
-                  imagePullPolicy: {{ .Values.imagePullPolicy | default "IfNotPresent" }}
+                  imagePullPolicy: {{ .Values.imagePullPolicy | default "Always" }}
                   args:
                       - "--kepler-prometheus-url={{ .Values.keplerPrometheusUrl }}"
                       - "--kepler-metric-name={{ .Values.keplerMetricName }}"
diff --git a/go.mod b/go.mod
index dbbce46..34a9de0 100644
--- a/go.mod
+++ b/go.mod
@@ -1,8 +1,6 @@
 module github.com/sustainable-computing-io/susql-operator
 
-go 1.22.0
-
-toolchain go1.22.7
+go 1.22.7
 
 require (
 	github.com/go-logr/logr v1.4.2