diff --git a/k8s/03-postgres.yaml b/k8s/03-postgres.yaml
index 305d7d4..d580d71 100644
--- a/k8s/03-postgres.yaml
+++ b/k8s/03-postgres.yaml
@@ -14,6 +14,7 @@ spec:
       labels:
         app: artista-modelcamp-postgres
     spec:
+      automountServiceAccountToken: false
       terminationGracePeriodSeconds: 120   # sauber herunterfahren vor dem Aushaengen
       securityContext:
         runAsNonRoot: true
diff --git a/k8s/04-app.yaml b/k8s/04-app.yaml
index fa74870..56f4888 100644
--- a/k8s/04-app.yaml
+++ b/k8s/04-app.yaml
@@ -16,6 +16,7 @@ spec:
         app: artista-modelcamp-app
         db-client: "true"
     spec:
+      automountServiceAccountToken: false
       securityContext:
         runAsNonRoot: true
         runAsUser: 1001
@@ -28,6 +29,8 @@ spec:
           command: ["prisma", "migrate", "deploy"]
           envFrom:
             - secretRef: { name: artista-modelcamp-secrets }
+          resources:
+            limits: { memory: 512Mi }
           securityContext:
             allowPrivilegeEscalation: false
             capabilities: { drop: ["ALL"] }
@@ -67,9 +70,9 @@ spec:
         - name: media
           persistentVolumeClaim: { claimName: artista-modelcamp-media }
         - name: cache
-          emptyDir: {}
+          emptyDir: { sizeLimit: 512Mi }
         - name: tmp
-          emptyDir: {}
+          emptyDir: { sizeLimit: 64Mi }
 ---
 apiVersion: v1
 kind: Service
diff --git a/k8s/06-worker.yaml b/k8s/06-worker.yaml
index 7e74f54..19cb709 100644
--- a/k8s/06-worker.yaml
+++ b/k8s/06-worker.yaml
@@ -11,12 +11,14 @@ spec:
   jobTemplate:
     spec:
       backoffLimit: 1
+      activeDeadlineSeconds: 900
       template:
         metadata:
           labels:
             db-client: "true"
         spec:
           restartPolicy: Never
+          automountServiceAccountToken: false
           securityContext:
             runAsNonRoot: true
             runAsUser: 1001
@@ -29,6 +31,8 @@ spec:
               envFrom:
                 - configMapRef: { name: artista-modelcamp-config }
                 - secretRef: { name: artista-modelcamp-secrets }
+              resources:
+                limits: { memory: 512Mi }
               securityContext:
                 allowPrivilegeEscalation: false
                 capabilities: { drop: ["ALL"] }