diff --git a/api/v1alpha1/irsasetup_types.go b/api/v1alpha1/irsasetup_types.go
index 285810e..bcb87ec 100644
--- a/api/v1alpha1/irsasetup_types.go
+++ b/api/v1alpha1/irsasetup_types.go
@@ -52,6 +52,7 @@ type IRSASetupSpec struct {
 
 // +kubebuilder:default=selfhosted
 // +kubebuilder:validation:Enum=selfhosted;eks
+// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Value is immutable"
 type SetupMode string
 
 const (
diff --git a/charts/irsa-manager/crds/irsasetup-crd.yaml b/charts/irsa-manager/crds/irsasetup-crd.yaml
index b6bcd31..6ea464b 100644
--- a/charts/irsa-manager/crds/irsasetup-crd.yaml
+++ b/charts/irsa-manager/crds/irsasetup-crd.yaml
@@ -82,6 +82,9 @@ spec:
                 - selfhosted
                 - eks
                 type: string
+                x-kubernetes-validations:
+                - message: Value is immutable
+                  rule: self == oldSelf
               provider:
                 description: |-
                   IamOIDCProvider configures IAM OIDC IamOIDCProvider Name
diff --git a/charts/irsa-manager/templates/deployment.yaml b/charts/irsa-manager/templates/deployment.yaml
index c75e3ce..a712ba7 100644
--- a/charts/irsa-manager/templates/deployment.yaml
+++ b/charts/irsa-manager/templates/deployment.yaml
@@ -71,5 +71,7 @@ spec:
           | nindent 10 }}
       securityContext:
         runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: {{ include "irsa-manager.fullname" . }}-controller-manager
       terminationGracePeriodSeconds: 10
\ No newline at end of file
diff --git a/config/crd/bases/irsa-manager.kkb0318.github.io_irsasetups.yaml b/config/crd/bases/irsa-manager.kkb0318.github.io_irsasetups.yaml
index 0cc7e3f..c3ffe7b 100644
--- a/config/crd/bases/irsa-manager.kkb0318.github.io_irsasetups.yaml
+++ b/config/crd/bases/irsa-manager.kkb0318.github.io_irsasetups.yaml
@@ -83,6 +83,9 @@ spec:
                 - selfhosted
                 - eks
                 type: string
+                x-kubernetes-validations:
+                - message: Value is immutable
+                  rule: self == oldSelf
               provider:
                 description: |-
                   IamOIDCProvider configures IAM OIDC IamOIDCProvider Name