diff --git a/gotenberg/Chart.yaml b/gotenberg/Chart.yaml
index 2be02a3..90d40a4 100644
--- a/gotenberg/Chart.yaml
+++ b/gotenberg/Chart.yaml
@@ -5,7 +5,7 @@ icon: https://gotenberg.dev/img/logo.png
 
 type: application
 
-version: 7.0.0+up8.36.0
+version: 8.0.0+up8.36.0
 appVersion: "8.36.0"
 
 maintainers:
diff --git a/gotenberg/templates/_helpers.tpl b/gotenberg/templates/_helpers.tpl
index 6aedb55..682ebc1 100644
--- a/gotenberg/templates/_helpers.tpl
+++ b/gotenberg/templates/_helpers.tpl
@@ -214,7 +214,8 @@ rebuilt default probe needs no further context.
 {{- $defaults := dict
       "runAsNonRoot" true
       "runAsUser" 1001
-      "runAsGroup" 1001 -}}
+      "runAsGroup" 1001
+      "seccompProfile" (dict "type" "RuntimeDefault") -}}
 {{- include "gotenberg.defaultedDict" (dict "defaults" $defaults "given" $given "path" "gotenberg.securityContext.pod") -}}
 {{- end -}}
 
diff --git a/gotenberg/values.yaml b/gotenberg/values.yaml
index b39b5cb..5562d9a 100644
--- a/gotenberg/values.yaml
+++ b/gotenberg/values.yaml
@@ -16,6 +16,20 @@ gotenberg:
       runAsNonRoot: true
       runAsUser: 1001
       runAsGroup: 1001
+      # RuntimeDefault applies the container runtime's default seccomp filter,
+      # which blocks the syscalls a normal workload never makes. It sits in the
+      # pod context on purpose: from here it covers every container in the pod
+      # including init containers, while a container-level seccompProfile would
+      # have to be repeated for each one (and silently missed on the next one
+      # added). A container that genuinely needs a different filter can still
+      # override it under securityContext.container, which wins over this value.
+      #
+      # Verified against both conversion engines, because a browser sandbox is
+      # the classic case where a syscall filter bites: Chromium HTML->PDF and
+      # LibreOffice document->PDF both still return real PDFs under the filter,
+      # and /health reports chromium and libreoffice as "up".
+      seccompProfile:
+        type: RuntimeDefault
     container:
       allowPrivilegeEscalation: false
       readOnlyRootFilesystem: true