diff --git a/helm/tools/grafana-mcp/tests/deployment_test.yaml b/helm/tools/grafana-mcp/tests/deployment_test.yaml
index d1ed1c4ad..bcb468313 100644
--- a/helm/tools/grafana-mcp/tests/deployment_test.yaml
+++ b/helm/tools/grafana-mcp/tests/deployment_test.yaml
@@ -64,12 +64,10 @@ tests:
       - equal:
           path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem
           value: true
-      - equal:
+      - isNull:
           path: spec.template.spec.containers[0].securityContext.runAsUser
-          value: 1000
-      - equal:
+      - isNull:
           path: spec.template.spec.containers[0].securityContext.runAsGroup
-          value: 999
       - isNull:
           path: spec.template.spec.containers[0].securityContext.seccompProfile
 
diff --git a/helm/tools/grafana-mcp/values.yaml b/helm/tools/grafana-mcp/values.yaml
index 01f0f1f50..d73dfe1a7 100644
--- a/helm/tools/grafana-mcp/values.yaml
+++ b/helm/tools/grafana-mcp/values.yaml
@@ -31,8 +31,14 @@ securityContext:
     drop:
       - ALL
   readOnlyRootFilesystem: true
-  runAsUser: 1000
-  runAsGroup: 999
+  # runAsUser / runAsGroup are left unset so the chart installs on OpenShift,
+  # where the restricted-v2 SCC assigns a per-namespace UID range and rejects a
+  # pinned UID outside it. runAsNonRoot (in podSecurityContext) enforces
+  # non-root: with runAsUser unset the container runs as the image's USER, so
+  # the mcp/grafana image must ship a non-root USER or the pod will fail to
+  # start. Set a fixed UID below on clusters that allow it:
+  # runAsUser: 1000
+  # runAsGroup: 999
 
 tolerations: []
 
diff --git a/helm/tools/querydoc/tests/deployment_test.yaml b/helm/tools/querydoc/tests/deployment_test.yaml
index 2fb47c58a..5f77fe64b 100644
--- a/helm/tools/querydoc/tests/deployment_test.yaml
+++ b/helm/tools/querydoc/tests/deployment_test.yaml
@@ -112,12 +112,10 @@ tests:
       - equal:
           path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem
           value: true
-      - equal:
+      - isNull:
           path: spec.template.spec.containers[0].securityContext.runAsUser
-          value: 14000
-      - equal:
+      - isNull:
           path: spec.template.spec.containers[0].securityContext.runAsGroup
-          value: 14000
       - isNull:
           path: spec.template.spec.containers[0].securityContext.seccompProfile
 
diff --git a/helm/tools/querydoc/values.yaml b/helm/tools/querydoc/values.yaml
index 13185e974..ca9a6e4e7 100644
--- a/helm/tools/querydoc/values.yaml
+++ b/helm/tools/querydoc/values.yaml
@@ -25,8 +25,14 @@ securityContext:
     drop:
       - ALL
   readOnlyRootFilesystem: true
-  runAsUser: 14000
-  runAsGroup: 14000
+  # runAsUser / runAsGroup are left unset so the chart installs on OpenShift,
+  # where the restricted-v2 SCC assigns a per-namespace UID range and rejects a
+  # pinned UID outside it. runAsNonRoot (in podSecurityContext) enforces
+  # non-root: with runAsUser unset the container runs as the image's USER, so
+  # the mcp/querydoc image must ship a non-root USER or the pod will fail to
+  # start. Set a fixed UID below on clusters that allow it:
+  # runAsUser: 14000
+  # runAsGroup: 14000
 
 tolerations: []