diff --git a/charts/common/Chart.yaml b/charts/common/Chart.yaml
index b825a4b0..e51d3791 100644
--- a/charts/common/Chart.yaml
+++ b/charts/common/Chart.yaml
@@ -15,4 +15,4 @@ maintainers:
 name: common
 sources: null
 type: library
-version: 10.5.9
+version: 10.5.10
diff --git a/charts/common/templates/addons/vpn/tailscale/_addon.tpl b/charts/common/templates/addons/vpn/tailscale/_addon.tpl
index f393c692..b97464e3 100644
--- a/charts/common/templates/addons/vpn/tailscale/_addon.tpl
+++ b/charts/common/templates/addons/vpn/tailscale/_addon.tpl
@@ -9,5 +9,6 @@ Template to render Tailscale addon. It will add the container to the list of add
     {{- $_ := set .Values.additionalContainers "addon-tailscale" $container -}}
     {{ include "tailscale.sa" . }}
     {{ include "tailscale.rbac" . }}
+    {{ include "tailscale.secret" . }}
   {{- end -}}
 {{- end -}}
diff --git a/charts/common/templates/addons/vpn/tailscale/_container.tpl b/charts/common/templates/addons/vpn/tailscale/_container.tpl
index c4fa4f72..98b69861 100644
--- a/charts/common/templates/addons/vpn/tailscale/_container.tpl
+++ b/charts/common/templates/addons/vpn/tailscale/_container.tpl
@@ -11,10 +11,18 @@ command: ["ash", "/tailscale/run.sh"]
 
 tty: true
 
-# It should run rootless. But needs test
 securityContext:
+{{- if .Values.addons.vpn.tailscale.userspace }}
   runAsUser: 1000
   runAsGroup: 1000
+  runAsNonRoot: true
+  readOnlyRootFilesystem: true
+{{- else }}
+  runAsUser: 0
+  runAsGroup: 0
+  runAsNonRoot: false
+  readOnlyRootFilesystem: false
+{{- end }}
   capabilities:
     add:
       - NET_ADMIN