diff --git a/bindata/assets/deployments/console-deployment.yaml b/bindata/assets/deployments/console-deployment.yaml
index 79a941e3c..be9af618f 100644
--- a/bindata/assets/deployments/console-deployment.yaml
+++ b/bindata/assets/deployments/console-deployment.yaml
@@ -23,7 +23,7 @@ spec:
         component: ui
       annotations:
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
-        openshift.io/required-scc: restricted-v2
+        openshift.io/required-scc: restricted-v3
     spec:
       dnsPolicy: ClusterFirst
       nodeSelector:
@@ -32,6 +32,7 @@ spec:
       serviceAccountName: console
       serviceAccount: console
       schedulerName: default-scheduler
+      hostUsers: false
       securityContext:
         runAsNonRoot: true
         seccompProfile:
diff --git a/bindata/assets/deployments/downloads-deployment.yaml b/bindata/assets/deployments/downloads-deployment.yaml
index ce23f4fc1..cc53a67d2 100644
--- a/bindata/assets/deployments/downloads-deployment.yaml
+++ b/bindata/assets/deployments/downloads-deployment.yaml
@@ -24,7 +24,7 @@ spec:
         component: downloads
       annotations:
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
-        openshift.io/required-scc: restricted-v2
+        openshift.io/required-scc: restricted-v3
     spec:
       dnsPolicy: ClusterFirst
       serviceAccountName: downloads
@@ -32,6 +32,7 @@ spec:
       nodeSelector:
         kubernetes.io/os: linux
         node-role.kubernetes.io/master: ""
+      hostUsers: false
       terminationGracePeriodSeconds: 5
       securityContext:
         runAsNonRoot: true
diff --git a/pkg/console/subresource/deployment/deployment_test.go b/pkg/console/subresource/deployment/deployment_test.go
index 6b2ee6d3e..8aa2bfb5f 100644
--- a/pkg/console/subresource/deployment/deployment_test.go
+++ b/pkg/console/subresource/deployment/deployment_test.go
@@ -141,7 +141,7 @@ func TestDefaultDeployment(t *testing.T) {
 		consoleImageAnnotation:                         "",
 		servingCertSecretResourceVersionAnnotation:     "",
 		workloadManagementAnnotation:                   workloadManagementAnnotationValue,
-		requiredSCCAnnotation:                          "restricted-v2",
+		requiredSCCAnnotation:                          "restricted-v3",
 	}
 
 	consoleDeploymentAffinity := &corev1.Affinity{
@@ -251,6 +251,7 @@ func TestDefaultDeployment(t *testing.T) {
 							RestartPolicy:                 corev1.RestartPolicyAlways,
 							SchedulerName:                 corev1.DefaultSchedulerName,
 							TerminationGracePeriodSeconds: &gracePeriod,
+							HostUsers:                     ptr.To(false),
 							SecurityContext: &corev1.PodSecurityContext{
 								RunAsNonRoot: utilpointer.Bool(true),
 								SeccompProfile: &corev1.SeccompProfile{
@@ -332,6 +333,7 @@ func TestDefaultDeployment(t *testing.T) {
 							RestartPolicy:                 corev1.RestartPolicyAlways,
 							SchedulerName:                 corev1.DefaultSchedulerName,
 							TerminationGracePeriodSeconds: &gracePeriod,
+							HostUsers:                     ptr.To(false),
 							SecurityContext: &corev1.PodSecurityContext{
 								RunAsNonRoot: utilpointer.Bool(true),
 								SeccompProfile: &corev1.SeccompProfile{
@@ -413,6 +415,7 @@ func TestDefaultDeployment(t *testing.T) {
 							RestartPolicy:                 corev1.RestartPolicyAlways,
 							SchedulerName:                 corev1.DefaultSchedulerName,
 							TerminationGracePeriodSeconds: &gracePeriod,
+							HostUsers:                     ptr.To(false),
 							SecurityContext: &corev1.PodSecurityContext{
 								RunAsNonRoot: utilpointer.Bool(true),
 								SeccompProfile: &corev1.SeccompProfile{
@@ -490,6 +493,7 @@ func TestDefaultDeployment(t *testing.T) {
 							RestartPolicy:                 corev1.RestartPolicyAlways,
 							SchedulerName:                 corev1.DefaultSchedulerName,
 							TerminationGracePeriodSeconds: &gracePeriod,
+							HostUsers:                     ptr.To(false),
 							SecurityContext: &corev1.PodSecurityContext{
 								RunAsNonRoot: utilpointer.Bool(true),
 								SeccompProfile: &corev1.SeccompProfile{
@@ -1755,6 +1759,7 @@ func TestDefaultDownloadsDeployment(t *testing.T) {
 				TolerationSeconds: &tolerationSeconds,
 			},
 		},
+		HostUsers: ptr.To(false),
 		SecurityContext: &corev1.PodSecurityContext{
 			RunAsNonRoot: utilpointer.Bool(true),
 			SeccompProfile: &corev1.SeccompProfile{
@@ -1886,7 +1891,7 @@ func TestDefaultDownloadsDeployment(t *testing.T) {
 							Labels: labels,
 							Annotations: map[string]string{
 								workloadManagementAnnotation: workloadManagementAnnotationValue,
-								requiredSCCAnnotation:        "restricted-v2",
+								requiredSCCAnnotation:        "restricted-v3",
 							},
 						},
 						Spec: downloadsDeploymentPodSpecSingleReplica,
@@ -1931,7 +1936,7 @@ func TestDefaultDownloadsDeployment(t *testing.T) {
 							Labels: labels,
 							Annotations: map[string]string{
 								workloadManagementAnnotation: workloadManagementAnnotationValue,
-								requiredSCCAnnotation:        "restricted-v2",
+								requiredSCCAnnotation:        "restricted-v3",
 							},
 						},
 						Spec: *downloadsDeploymentPodSpecHighAvail,