diff --git a/deploy/helm/developers-cms/templates/deployment.yaml b/deploy/helm/developers-cms/templates/deployment.yaml
index 1d05e3e..1e642df 100644
--- a/deploy/helm/developers-cms/templates/deployment.yaml
+++ b/deploy/helm/developers-cms/templates/deployment.yaml
@@ -27,6 +27,10 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with .Values.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.app.image.repository }}:{{ .Values.app.image.tag }}"
diff --git a/deploy/helm/developers-cms/values.yaml b/deploy/helm/developers-cms/values.yaml
index 638da16..bf83c7e 100644
--- a/deploy/helm/developers-cms/values.yaml
+++ b/deploy/helm/developers-cms/values.yaml
@@ -4,6 +4,12 @@
 
 replicaCount: 1
 
+# Security context del pod. fsGroup rende il PVC dei media scrivibile dall'utente
+# del container (l'immagine gira come uid/gid 1001): senza, il volume Azure è
+# montato root:root e Payload fallisce gli upload ("problem while uploading the file").
+podSecurityContext:
+  fsGroup: 1001
+
 app:
   image:
     repository: ghcr.io/italia/developers-cms