diff --git a/console-web/app/(dashboard)/tenants/[namespace]/[name]/tenant-detail-client.tsx b/console-web/app/(dashboard)/tenants/[namespace]/[name]/tenant-detail-client.tsx
index 10468f7..a55fcc3 100644
--- a/console-web/app/(dashboard)/tenants/[namespace]/[name]/tenant-detail-client.tsx
+++ b/console-web/app/(dashboard)/tenants/[namespace]/[name]/tenant-detail-client.tsx
@@ -210,6 +210,7 @@ export function TenantDetailClient({ namespace, name, initialTab, initialYamlEdi
   const [secCtxLoaded, setSecCtxLoaded] = useState(false)
   const [secCtxLoading, setSecCtxLoading] = useState(false)
   const [secCtxSaving, setSecCtxSaving] = useState(false)
+  const [secCtxDelegated, setSecCtxDelegated] = useState(false)
   const [secCtx, setSecCtx] = useState<SecurityContextFormState>({
     runAsUser: "",
     runAsGroup: "",
@@ -337,6 +338,7 @@ export function TenantDetailClient({ namespace, name, initialTab, initialYamlEdi
 
   useEffect(() => {
     setSecCtxLoaded(false)
+    setSecCtxDelegated(false)
     setSecCtxDirty(cleanSecurityContextDirtyFields())
   }, [namespace, name])
 
@@ -350,6 +352,7 @@ export function TenantDetailClient({ namespace, name, initialTab, initialYamlEdi
         fsGroup: data.fsGroup?.toString() ?? "",
         runAsNonRoot: data.runAsNonRoot === null ? "default" : data.runAsNonRoot ? "true" : "false",
       })
+      setSecCtxDelegated(data.operatorDefaultsDelegated)
       setSecCtxDirty(cleanSecurityContextDirtyFields())
     } catch (e) {
       const err = e as ApiError
@@ -362,6 +365,10 @@ export function TenantDetailClient({ namespace, name, initialTab, initialYamlEdi
 
   const handleSaveSecurityContext = async (e: React.FormEvent) => {
     e.preventDefault()
+    if (secCtxDelegated) {
+      toast.error(t("Platform-delegated security contexts can only be changed in Raw YAML."))
+      return
+    }
     setSecCtxSaving(true)
     try {
       await api.updateSecurityContext(namespace, name, buildSecurityContextUpdate(secCtx, secCtxDirty))
@@ -1300,6 +1307,18 @@ export function TenantDetailClient({ namespace, name, initialTab, initialYamlEdi
               </div>
             ) : (
               <form onSubmit={handleSaveSecurityContext} className="space-y-6">
+                {secCtxDelegated && (
+                  <div className="rounded-md border border-border bg-muted/50 px-4 py-3 text-sm">
+                    <p>
+                      {t(
+                        "Security defaults are delegated to platform admission. Effective UID/GID and runAsNonRoot values are platform-owned.",
+                      )}
+                    </p>
+                    <Button type="button" variant="outline" size="sm" className="mt-3" onClick={() => setTab("edit")}>
+                      {t("Open Raw YAML")}
+                    </Button>
+                  </div>
+                )}
                 <div className="grid gap-4 sm:grid-cols-2 lg:grid-cols-4">
                   <div className="space-y-2">
                     <Label>{t("Run As User")}</Label>
@@ -1307,6 +1326,7 @@ export function TenantDetailClient({ namespace, name, initialTab, initialYamlEdi
                       type="number"
                       placeholder="10001"
                       value={secCtx.runAsUser}
+                      disabled={secCtxDelegated}
                       onChange={(e) => {
                         setSecCtx((s) => ({ ...s, runAsUser: e.target.value }))
                         setSecCtxDirty((dirty) => ({ ...dirty, runAsUser: true }))
@@ -1319,6 +1339,7 @@ export function TenantDetailClient({ namespace, name, initialTab, initialYamlEdi
                       type="number"
                       placeholder="10001"
                       value={secCtx.runAsGroup}
+                      disabled={secCtxDelegated}
                       onChange={(e) => {
                         setSecCtx((s) => ({ ...s, runAsGroup: e.target.value }))
                         setSecCtxDirty((dirty) => ({ ...dirty, runAsGroup: true }))
@@ -1331,6 +1352,7 @@ export function TenantDetailClient({ namespace, name, initialTab, initialYamlEdi
                       type="number"
                       placeholder="10001"
                       value={secCtx.fsGroup}
+                      disabled={secCtxDelegated}
                       onChange={(e) => {
                         setSecCtx((s) => ({ ...s, fsGroup: e.target.value }))
                         setSecCtxDirty((dirty) => ({ ...dirty, fsGroup: true }))
@@ -1344,6 +1366,7 @@ export function TenantDetailClient({ namespace, name, initialTab, initialYamlEdi
                     <select
                       id="sec-nonroot"
                       value={secCtx.runAsNonRoot}
+                      disabled={secCtxDelegated}
                       onChange={(e) => {
                         setSecCtx((s) => ({ ...s, runAsNonRoot: e.target.value as RunAsNonRootMode }))
                         setSecCtxDirty((dirty) => ({ ...dirty, runAsNonRoot: true }))
@@ -1357,7 +1380,7 @@ export function TenantDetailClient({ namespace, name, initialTab, initialYamlEdi
                   </div>
                 </div>
                 <div className="flex gap-2">
-                  <Button type="submit" disabled={secCtxSaving}>
+                  <Button type="submit" disabled={secCtxSaving || secCtxDelegated}>
                     {secCtxSaving && <Spinner className="mr-2 size-4" />}
                     {secCtxSaving ? t("Saving...") : t("Save")}
                   </Button>
diff --git a/console-web/i18n/locales/en-US.json b/console-web/i18n/locales/en-US.json
index a2730c7..373f72d 100755
--- a/console-web/i18n/locales/en-US.json
+++ b/console-web/i18n/locales/en-US.json
@@ -254,6 +254,9 @@
   "Override Pod SecurityContext UID/GID fields. Use Raw YAML for seccomp, container, and Pool-level settings. Changes apply after Pods are recreated.": "Override Pod SecurityContext UID/GID fields. Use Raw YAML for seccomp, container, and Pool-level settings. Changes apply after Pods are recreated.",
   "SecurityContext updated": "SecurityContext updated",
   "Failed to load security context": "Failed to load security context",
+  "Security defaults are delegated to platform admission. Effective UID/GID and runAsNonRoot values are platform-owned.": "Security defaults are delegated to platform admission. Effective UID/GID and runAsNonRoot values are platform-owned.",
+  "Platform-delegated security contexts can only be changed in Raw YAML.": "Platform-delegated security contexts can only be changed in Raw YAML.",
+  "Open Raw YAML": "Open Raw YAML",
   "Do not run as Root": "Do not run as Root",
   "Default": "Default",
   "Loading...": "Loading..."
diff --git a/console-web/i18n/locales/zh-CN.json b/console-web/i18n/locales/zh-CN.json
index 9270ef4..6581d98 100755
--- a/console-web/i18n/locales/zh-CN.json
+++ b/console-web/i18n/locales/zh-CN.json
@@ -253,6 +253,9 @@
   "Override Pod SecurityContext UID/GID fields. Use Raw YAML for seccomp, container, and Pool-level settings. Changes apply after Pods are recreated.": "覆盖 Pod SecurityContext 的 UID/GID 字段。如需配置 seccomp、容器级和 Pool 级设置，请使用原始 YAML。修改将在 Pod 重建后生效。",
   "SecurityContext updated": "SecurityContext 已更新",
   "Failed to load security context": "加载 SecurityContext 失败",
+  "Security defaults are delegated to platform admission. Effective UID/GID and runAsNonRoot values are platform-owned.": "安全默认值已委托给平台准入机制，实际的 UID/GID 和 runAsNonRoot 值由平台决定。",
+  "Platform-delegated security contexts can only be changed in Raw YAML.": "平台委托的 SecurityContext 只能通过原始 YAML 修改。",
+  "Open Raw YAML": "打开原始 YAML",
   "Do not run as Root": "禁止以 Root 运行",
   "Default": "默认值",
   "Custom Certificates": "自定义证书",
diff --git a/console-web/types/api.ts b/console-web/types/api.ts
index 5d6ee1e..039e7bd 100644
--- a/console-web/types/api.ts
+++ b/console-web/types/api.ts
@@ -413,7 +413,8 @@ export interface SecurityContextInfo {
   runAsGroup: number | null
   fsGroup: number | null
   runAsNonRoot: boolean | null
-  effectiveRunAsNonRoot: boolean
+  effectiveRunAsNonRoot: boolean | null
+  operatorDefaultsDelegated: boolean
 }
 
 export interface EncryptionInfoResponse {
diff --git a/deploy/rustfs-operator/crds/tenant-crd.yaml b/deploy/rustfs-operator/crds/tenant-crd.yaml
index b9da934..4c6437d 100644
--- a/deploy/rustfs-operator/crds/tenant-crd.yaml
+++ b/deploy/rustfs-operator/crds/tenant-crd.yaml
@@ -58,8 +58,10 @@ spec:
                 x-kubernetes-list-type: map
               containerSecurityContext:
                 description: |-
-                  Override the default RustFS container SecurityContext for every Pool in this Tenant.
-                  Pool-level values take precedence.
+                  RustFS container SecurityContext overrides for every Pool in this Tenant.
+                  Non-empty values merge by field over operator defaults, with Pool-level values taking
+                  precedence. Setting this and `securityContext` to explicit empty objects resets the
+                  defaults and delegates unspecified values to platform admission.
                 nullable: true
                 properties:
                   allowPrivilegeEscalation:
@@ -1204,7 +1206,9 @@ spec:
                     containerSecurityContext:
                       description: |-
                         RustFS container SecurityContext overrides for this Pool.
-                        Values are merged over Tenant-level container settings and operator defaults.
+                        Non-empty values merge by field over Tenant-level settings and operator defaults. An
+                        explicit empty object paired with an empty `securityContext` resets inherited values and
+                        delegates unspecified values to platform admission.
                       nullable: true
                       properties:
                         allowPrivilegeEscalation:
@@ -1500,7 +1504,9 @@ spec:
                     securityContext:
                       description: |-
                         Pod SecurityContext overrides for this Pool.
-                        Values override Tenant-level Pod SecurityContext settings.
+                        Non-empty values merge by field over Tenant-level settings and operator defaults. An
+                        explicit empty object paired with an empty `containerSecurityContext` resets inherited
+                        values and delegates unspecified values to platform admission.
                       nullable: true
                       properties:
                         fsGroup:
@@ -1700,8 +1706,10 @@ spec:
                 type: string
               securityContext:
                 description: |-
-                  Override the default Pod SecurityContext for every Pool in this Tenant.
-                  Pool-level values take precedence.
+                  Pod SecurityContext overrides for every Pool in this Tenant.
+                  Non-empty values merge by field over operator defaults, with Pool-level values taking
+                  precedence. Setting this and `containerSecurityContext` to explicit empty objects resets
+                  the defaults and delegates unspecified values to platform admission.
                 nullable: true
                 properties:
                   fsGroup:
diff --git a/src/console/handlers/encryption.rs b/src/console/handlers/encryption.rs
index 18dfbc0..2be0f34 100644
--- a/src/console/handlers/encryption.rs
+++ b/src/console/handlers/encryption.rs
@@ -21,7 +21,6 @@ use crate::console::{
 use crate::types::v1alpha1::encryption::{
     EncryptionConfig, KmsBackendType, LocalKmsConfig, LocalKmsMasterKeySecretRef, VaultKmsConfig,
 };
-use crate::types::v1alpha1::security_context::effective_run_as_non_root;
 use crate::types::v1alpha1::tenant::Tenant;
 use axum::{Extension, Json, extract::Path};
 use k8s_openapi::api::core::v1 as corev1;
@@ -136,63 +135,46 @@ pub async fn get_encryption(
         .get(&name)
         .await
         .map_err(|e| error::map_kube_error(e, format!("Tenant '{}'", name)))?;
-
-    let enc_resp =
-        match tenant.spec.encryption {
-            Some(ref enc) => EncryptionInfoResponse {
-                enabled: enc.enabled,
-                backend: enc.backend.to_string(),
-                vault: enc.vault.as_ref().map(|v| VaultInfo {
-                    endpoint: v.endpoint.clone(),
-                }),
-                local: enc.local.as_ref().map(|l| LocalInfo {
-                    key_directory: l.key_directory.clone(),
-                    master_key_secret_ref: l.master_key_secret_ref.as_ref().map(|s| {
-                        LocalMasterKeySecretRefInfo {
-                            name: s.name.clone(),
-                            key: s.key.clone(),
-                        }
-                    }),
-                    allow_insecure_dev_defaults: l.allow_insecure_dev_defaults,
-                }),
-                kms_secret_name: (enc.backend == KmsBackendType::Vault)
-                    .then(|| enc.kms_secret.as_ref().map(|s| s.name.clone()))
-                    .flatten(),
-                default_key_id: enc.default_key_id.clone(),
-                security_context: tenant.spec.security_context.as_ref().map(|sc| {
-                    SecurityContextInfo {
-                        run_as_user: sc.run_as_user,
-                        run_as_group: sc.run_as_group,
-                        fs_group: sc.fs_group,
-                        run_as_non_root: sc.run_as_non_root,
-                        effective_run_as_non_root: effective_run_as_non_root(
-                            sc.run_as_user,
-                            sc.run_as_non_root,
-                        ),
-                    }
-                }),
-            },
-            None => EncryptionInfoResponse {
-                enabled: false,
-                backend: "local".to_string(),
-                vault: None,
-                local: None,
-                kms_secret_name: None,
-                default_key_id: None,
-                security_context: tenant.spec.security_context.as_ref().map(|sc| {
-                    SecurityContextInfo {
-                        run_as_user: sc.run_as_user,
-                        run_as_group: sc.run_as_group,
-                        fs_group: sc.fs_group,
-                        run_as_non_root: sc.run_as_non_root,
-                        effective_run_as_non_root: effective_run_as_non_root(
-                            sc.run_as_user,
-                            sc.run_as_non_root,
-                        ),
+    let security_context = tenant.spec.security_context.as_ref().map(|_| {
+        SecurityContextInfo::from_contexts(
+            tenant.spec.security_context.as_ref(),
+            tenant.spec.container_security_context.as_ref(),
+        )
+    });
+
+    let enc_resp = match tenant.spec.encryption {
+        Some(ref enc) => EncryptionInfoResponse {
+            enabled: enc.enabled,
+            backend: enc.backend.to_string(),
+            vault: enc.vault.as_ref().map(|v| VaultInfo {
+                endpoint: v.endpoint.clone(),
+            }),
+            local: enc.local.as_ref().map(|l| LocalInfo {
+                key_directory: l.key_directory.clone(),
+                master_key_secret_ref: l.master_key_secret_ref.as_ref().map(|s| {
+                    LocalMasterKeySecretRefInfo {
+                        name: s.name.clone(),
+                        key: s.key.clone(),
                     }
                 }),
-            },
-        };
+                allow_insecure_dev_defaults: l.allow_insecure_dev_defaults,
+            }),
+            kms_secret_name: (enc.backend == KmsBackendType::Vault)
+                .then(|| enc.kms_secret.as_ref().map(|s| s.name.clone()))
+                .flatten(),
+            default_key_id: enc.default_key_id.clone(),
+            security_context,
+        },
+        None => EncryptionInfoResponse {
+            enabled: false,
+            backend: "local".to_string(),
+            vault: None,
+            local: None,
+            kms_secret_name: None,
+            default_key_id: None,
+            security_context,
+        },
+    };
 
     Ok(Json(enc_resp))
 }
diff --git a/src/console/handlers/security_context.rs b/src/console/handlers/security_context.rs
index 6544b12..554b98f 100644
--- a/src/console/handlers/security_context.rs
+++ b/src/console/handlers/security_context.rs
@@ -22,9 +22,12 @@ use crate::console::{
     },
     state::Claims,
 };
-use crate::types::v1alpha1::security_context::PodSecurityContextOverride;
+use crate::types::v1alpha1::security_context::{
+    PodSecurityContextOverride, security_context_pair_delegates_to_platform,
+};
 use crate::types::v1alpha1::tenant::Tenant;
 use axum::{Extension, Json, extract::Path};
+use k8s_openapi::api::core::v1 as corev1;
 use kube::{Api, Client};
 
 /// GET /namespaces/:namespace/tenants/:name/security-context
@@ -44,13 +47,15 @@ pub async fn get_security_context(
 
     Ok(Json(security_context_info(
         tenant.spec.security_context.as_ref(),
+        tenant.spec.container_security_context.as_ref(),
     )))
 }
 
 fn security_context_info(
-    security_context: Option<&PodSecurityContextOverride>,
+    pod: Option<&PodSecurityContextOverride>,
+    container: Option<&corev1::SecurityContext>,
 ) -> SecurityContextInfo {
-    SecurityContextInfo::from_override(security_context)
+    SecurityContextInfo::from_contexts(pod, container)
 }
 
 fn apply_patch_field<T: Copy>(target: &mut Option<T>, field: &PatchField<T>) {
@@ -73,6 +78,24 @@ fn apply_validated_security_context_update(
         return Ok(false);
     }
 
+    let operator_defaults_delegated = security_context_pair_delegates_to_platform(
+        tenant.spec.security_context.as_ref(),
+        tenant.spec.container_security_context.as_ref(),
+    );
+    if operator_defaults_delegated {
+        let sets_value = matches!(&body.run_as_user, PatchField::Value(_))
+            || matches!(&body.run_as_group, PatchField::Value(_))
+            || matches!(&body.fs_group, PatchField::Value(_))
+            || matches!(&body.run_as_non_root, PatchField::Value(_));
+        if sets_value {
+            return Err(Error::BadRequest {
+                message: "Tenant security contexts delegate Operator defaults to platform admission; use the raw YAML editor to change or remove the paired empty objects"
+                    .to_string(),
+            });
+        }
+        return Ok(false);
+    }
+
     let context = tenant.spec.security_context.get_or_insert_default();
     apply_patch_field(&mut context.run_as_user, &body.run_as_user);
     apply_patch_field(&mut context.run_as_group, &body.run_as_group);
@@ -154,6 +177,7 @@ mod tests {
     use crate::console::error::Error;
     use crate::console::models::encryption::{PatchField, UpdateSecurityContextRequest};
     use crate::types::v1alpha1::security_context::PodSecurityContextOverride;
+    use k8s_openapi::api::core::v1 as corev1;
 
     #[test]
     fn legacy_root_context_reports_effective_non_root_false() {
@@ -163,11 +187,12 @@ mod tests {
             ..Default::default()
         };
 
-        let info = security_context_info(Some(&context));
+        let info = security_context_info(Some(&context), None);
 
         assert_eq!(info.run_as_user, Some(0));
         assert_eq!(info.run_as_non_root, None);
-        assert!(!info.effective_run_as_non_root);
+        assert_eq!(info.effective_run_as_non_root, Some(false));
+        assert!(!info.operator_defaults_delegated);
     }
 
     #[test]
@@ -178,19 +203,32 @@ mod tests {
             ..Default::default()
         };
 
-        let info = security_context_info(Some(&context));
+        let info = security_context_info(Some(&context), None);
 
         assert_eq!(info.run_as_non_root, Some(true));
-        assert!(info.effective_run_as_non_root);
+        assert_eq!(info.effective_run_as_non_root, Some(true));
+        assert!(!info.operator_defaults_delegated);
     }
 
     #[test]
     fn absent_context_reports_default_without_inventing_raw_values() {
-        let info = security_context_info(None);
+        let info = security_context_info(None, None);
 
         assert_eq!(info.run_as_user, None);
         assert_eq!(info.run_as_non_root, None);
-        assert!(info.effective_run_as_non_root);
+        assert_eq!(info.effective_run_as_non_root, Some(true));
+        assert!(!info.operator_defaults_delegated);
+    }
+
+    #[test]
+    fn delegated_context_reports_platform_owned_effective_values() {
+        let pod = PodSecurityContextOverride::default();
+        let container = corev1::SecurityContext::default();
+
+        let info = security_context_info(Some(&pod), Some(&container));
+
+        assert_eq!(info.effective_run_as_non_root, None);
+        assert!(info.operator_defaults_delegated);
     }
 
     #[test]
@@ -266,4 +304,63 @@ mod tests {
                 if message.contains("UID 0") && message.contains("explicitly true")
         ));
     }
+
+    #[test]
+    fn delegated_context_rejects_lossy_console_updates() {
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        tenant.spec.security_context = Some(PodSecurityContextOverride::default());
+        tenant.spec.container_security_context = Some(corev1::SecurityContext::default());
+
+        let error = apply_validated_security_context_update(
+            &mut tenant,
+            &UpdateSecurityContextRequest {
+                run_as_user: PatchField::Missing,
+                run_as_group: PatchField::Missing,
+                fs_group: PatchField::Missing,
+                run_as_non_root: PatchField::Value(true),
+            },
+        )
+        .expect_err("the legacy form must not disable platform delegation");
+
+        assert!(matches!(
+            error,
+            Error::BadRequest { message }
+                if message.contains("platform admission")
+                    && message.contains("raw YAML")
+        ));
+        assert!(
+            tenant
+                .spec
+                .security_context
+                .as_ref()
+                .is_some_and(PodSecurityContextOverride::is_empty)
+        );
+    }
+
+    #[test]
+    fn delegated_context_treats_null_only_updates_as_noops() {
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        tenant.spec.security_context = Some(PodSecurityContextOverride::default());
+        tenant.spec.container_security_context = Some(corev1::SecurityContext::default());
+
+        let changed = apply_validated_security_context_update(
+            &mut tenant,
+            &UpdateSecurityContextRequest {
+                run_as_user: PatchField::Null,
+                run_as_group: PatchField::Null,
+                fs_group: PatchField::Null,
+                run_as_non_root: PatchField::Null,
+            },
+        )
+        .expect("null fields preserve the delegated pair");
+
+        assert!(!changed);
+        assert!(
+            tenant
+                .spec
+                .security_context
+                .as_ref()
+                .is_some_and(PodSecurityContextOverride::is_empty)
+        );
+    }
 }
diff --git a/src/console/models/encryption.rs b/src/console/models/encryption.rs
index affe5be..1cbef3d 100644
--- a/src/console/models/encryption.rs
+++ b/src/console/models/encryption.rs
@@ -17,7 +17,9 @@ use utoipa::ToSchema;
 
 use crate::types::v1alpha1::security_context::{
     PodSecurityContextOverride, effective_run_as_non_root,
+    security_context_pair_delegates_to_platform,
 };
+use k8s_openapi::api::core::v1 as corev1;
 
 /// GET response – current encryption configuration for a Tenant.
 #[derive(Debug, Serialize, ToSchema)]
@@ -64,21 +66,31 @@ pub struct SecurityContextInfo {
     pub run_as_group: Option<i64>,
     pub fs_group: Option<i64>,
     pub run_as_non_root: Option<bool>,
-    /// Effective value after applying the Operator default while preserving the raw override.
-    pub effective_run_as_non_root: bool,
+    /// Effective value after applying Operator defaults, or unknown when platform admission owns it.
+    #[schema(value_type = Option<bool>, nullable, required = false)]
+    pub effective_run_as_non_root: Option<bool>,
+    /// Whether an exact empty pair delegates unspecified values to platform admission.
+    pub operator_defaults_delegated: bool,
 }
 
 impl SecurityContextInfo {
-    pub(crate) fn from_override(context: Option<&PodSecurityContextOverride>) -> Self {
-        let run_as_user = context.and_then(|context| context.run_as_user);
-        let run_as_non_root = context.and_then(|context| context.run_as_non_root);
+    pub(crate) fn from_contexts(
+        pod: Option<&PodSecurityContextOverride>,
+        container: Option<&corev1::SecurityContext>,
+    ) -> Self {
+        let run_as_user = pod.and_then(|context| context.run_as_user);
+        let run_as_non_root = pod.and_then(|context| context.run_as_non_root);
+        let operator_defaults_delegated =
+            security_context_pair_delegates_to_platform(pod, container);
 
         Self {
             run_as_user,
-            run_as_group: context.and_then(|context| context.run_as_group),
-            fs_group: context.and_then(|context| context.fs_group),
+            run_as_group: pod.and_then(|context| context.run_as_group),
+            fs_group: pod.and_then(|context| context.fs_group),
             run_as_non_root,
-            effective_run_as_non_root: effective_run_as_non_root(run_as_user, run_as_non_root),
+            effective_run_as_non_root: (!operator_defaults_delegated)
+                .then(|| effective_run_as_non_root(run_as_user, run_as_non_root)),
+            operator_defaults_delegated,
         }
     }
 }
@@ -183,6 +195,7 @@ mod tests {
         PatchField, SecurityContextInfo, UpdateEncryptionRequest, UpdateSecurityContextRequest,
     };
     use crate::types::v1alpha1::security_context::PodSecurityContextOverride;
+    use k8s_openapi::api::core::v1 as corev1;
 
     #[test]
     fn security_context_info_keeps_raw_value_and_serializes_effective_value() {
@@ -192,13 +205,29 @@ mod tests {
             ..Default::default()
         };
 
-        let info = SecurityContextInfo::from_override(Some(&context));
+        let info = SecurityContextInfo::from_contexts(Some(&context), None);
         let json = serde_json::to_value(&info).expect("SecurityContextInfo should serialize");
 
         assert_eq!(info.run_as_non_root, None);
-        assert!(!info.effective_run_as_non_root);
+        assert_eq!(info.effective_run_as_non_root, Some(false));
+        assert!(!info.operator_defaults_delegated);
         assert!(json["runAsNonRoot"].is_null());
         assert_eq!(json["effectiveRunAsNonRoot"], serde_json::json!(false));
+        assert_eq!(json["operatorDefaultsDelegated"], serde_json::json!(false));
+    }
+
+    #[test]
+    fn delegated_security_context_serializes_an_unknown_effective_value() {
+        let pod = PodSecurityContextOverride::default();
+        let container = corev1::SecurityContext::default();
+
+        let info = SecurityContextInfo::from_contexts(Some(&pod), Some(&container));
+        let json = serde_json::to_value(&info).expect("SecurityContextInfo should serialize");
+
+        assert_eq!(info.effective_run_as_non_root, None);
+        assert!(info.operator_defaults_delegated);
+        assert!(json["effectiveRunAsNonRoot"].is_null());
+        assert_eq!(json["operatorDefaultsDelegated"], serde_json::json!(true));
     }
 
     #[test]
diff --git a/src/console/openapi.rs b/src/console/openapi.rs
index 82de098..693d1dc 100644
--- a/src/console/openapi.rs
+++ b/src/console/openapi.rs
@@ -898,6 +898,30 @@ mod tests {
                 .and_then(Value::as_str),
             Some("#/components/schemas/SecurityContextUpdateResponse")
         );
+        let effective_types = spec
+            .pointer(
+                "/components/schemas/SecurityContextInfo/properties/effectiveRunAsNonRoot/type",
+            )
+            .and_then(Value::as_array)
+            .expect("effective runAsNonRoot should use OpenAPI nullable types");
+        assert!(
+            effective_types
+                .iter()
+                .filter_map(Value::as_str)
+                .any(|value| value == "boolean")
+                && effective_types
+                    .iter()
+                    .filter_map(Value::as_str)
+                    .any(|value| value == "null"),
+            "platform delegation makes the effective runAsNonRoot value unknown"
+        );
+        assert_eq!(
+            spec.pointer(
+                "/components/schemas/SecurityContextInfo/properties/operatorDefaultsDelegated/type"
+            )
+            .and_then(Value::as_str),
+            Some("boolean")
+        );
         assert_eq!(
             operation.pointer("/put/tags/0").and_then(Value::as_str),
             Some("security-context")
diff --git a/src/types/v1alpha1/pool.rs b/src/types/v1alpha1/pool.rs
index 6a52551..039166c 100755
--- a/src/types/v1alpha1/pool.rs
+++ b/src/types/v1alpha1/pool.rs
@@ -67,12 +67,16 @@ pub struct Pool {
     pub persistence: PersistenceConfig,
 
     /// Pod SecurityContext overrides for this Pool.
-    /// Values override Tenant-level Pod SecurityContext settings.
+    /// Non-empty values merge by field over Tenant-level settings and operator defaults. An
+    /// explicit empty object paired with an empty `containerSecurityContext` resets inherited
+    /// values and delegates unspecified values to platform admission.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub security_context: Option<PodSecurityContextOverride>,
 
     /// RustFS container SecurityContext overrides for this Pool.
-    /// Values are merged over Tenant-level container settings and operator defaults.
+    /// Non-empty values merge by field over Tenant-level settings and operator defaults. An
+    /// explicit empty object paired with an empty `securityContext` resets inherited values and
+    /// delegates unspecified values to platform admission.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub container_security_context: Option<corev1::SecurityContext>,
 
diff --git a/src/types/v1alpha1/security_context.rs b/src/types/v1alpha1/security_context.rs
index 32c3ccf..e446d49 100644
--- a/src/types/v1alpha1/security_context.rs
+++ b/src/types/v1alpha1/security_context.rs
@@ -27,11 +27,23 @@ pub(crate) fn effective_run_as_non_root(run_as_user: Option<i64>, explicit: Opti
     explicit.unwrap_or(run_as_user != Some(0))
 }
 
+/// Returns whether an exact Pod/container empty-object pair delegates Operator defaults.
+pub(crate) fn security_context_pair_delegates_to_platform(
+    pod: Option<&PodSecurityContextOverride>,
+    container: Option<&corev1::SecurityContext>,
+) -> bool {
+    pod.is_some_and(PodSecurityContextOverride::is_empty)
+        && container.is_some_and(|context| context == &corev1::SecurityContext::default())
+}
+
 /// Pod SecurityContext overrides for RustFS pods.
 ///
-/// Overrides the operator defaults (`runAsUser` / `runAsGroup` / `fsGroup` = 10001,
-/// `runAsNonRoot` = true, and `seccompProfile.type` = `RuntimeDefault`).
-#[derive(Deserialize, Serialize, Clone, Debug, KubeSchema, Default)]
+/// A non-empty object overrides the operator defaults (`runAsUser` / `runAsGroup` /
+/// `fsGroup` = 10001, `runAsNonRoot` = true, and `seccompProfile.type` =
+/// `RuntimeDefault`). When both the Pod and container security contexts at the same scope are
+/// explicit empty objects, those values are delegated to the platform, for example to an
+/// OpenShift Security Context Constraint.
+#[derive(Deserialize, Serialize, Clone, Debug, KubeSchema, Default, PartialEq)]
 #[serde(rename_all = "camelCase")]
 pub struct PodSecurityContextOverride {
     /// UID to run the container process as.
@@ -58,9 +70,58 @@ pub struct PodSecurityContextOverride {
     pub seccomp_profile: Option<corev1::SeccompProfile>,
 }
 
+impl PodSecurityContextOverride {
+    /// Returns whether the API object was explicitly supplied without any override fields.
+    pub(crate) fn is_empty(&self) -> bool {
+        self == &Self::default()
+    }
+}
+
 #[cfg(test)]
 mod tests {
-    use super::effective_run_as_non_root;
+    use super::{
+        PodSecurityContextOverride, effective_run_as_non_root,
+        security_context_pair_delegates_to_platform,
+    };
+    use k8s_openapi::api::core::v1 as corev1;
+
+    #[test]
+    fn empty_override_is_distinct_from_a_partial_override() {
+        assert!(PodSecurityContextOverride::default().is_empty());
+        assert!(
+            !PodSecurityContextOverride {
+                run_as_non_root: Some(true),
+                ..Default::default()
+            }
+            .is_empty()
+        );
+    }
+
+    #[test]
+    fn only_an_exact_empty_pair_delegates_to_the_platform() {
+        let empty_pod = PodSecurityContextOverride::default();
+        let empty_container = corev1::SecurityContext::default();
+
+        assert!(security_context_pair_delegates_to_platform(
+            Some(&empty_pod),
+            Some(&empty_container)
+        ));
+        assert!(!security_context_pair_delegates_to_platform(
+            Some(&empty_pod),
+            None
+        ));
+        assert!(!security_context_pair_delegates_to_platform(
+            None,
+            Some(&empty_container)
+        ));
+        assert!(!security_context_pair_delegates_to_platform(
+            Some(&PodSecurityContextOverride {
+                run_as_non_root: Some(true),
+                ..Default::default()
+            }),
+            Some(&empty_container)
+        ));
+    }
 
     #[test]
     fn effective_run_as_non_root_preserves_legacy_uid_zero() {
diff --git a/src/types/v1alpha1/tenant.rs b/src/types/v1alpha1/tenant.rs
index 50664ad..f63a3e8 100755
--- a/src/types/v1alpha1/tenant.rs
+++ b/src/types/v1alpha1/tenant.rs
@@ -231,13 +231,17 @@ pub struct TenantSpec {
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub encryption: Option<EncryptionConfig>,
 
-    /// Override the default Pod SecurityContext for every Pool in this Tenant.
-    /// Pool-level values take precedence.
+    /// Pod SecurityContext overrides for every Pool in this Tenant.
+    /// Non-empty values merge by field over operator defaults, with Pool-level values taking
+    /// precedence. Setting this and `containerSecurityContext` to explicit empty objects resets
+    /// the defaults and delegates unspecified values to platform admission.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub security_context: Option<PodSecurityContextOverride>,
 
-    /// Override the default RustFS container SecurityContext for every Pool in this Tenant.
-    /// Pool-level values take precedence.
+    /// RustFS container SecurityContext overrides for every Pool in this Tenant.
+    /// Non-empty values merge by field over operator defaults, with Pool-level values taking
+    /// precedence. Setting this and `securityContext` to explicit empty objects resets the
+    /// defaults and delegates unspecified values to platform admission.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub container_security_context: Option<corev1::SecurityContext>,
 }
diff --git a/src/types/v1alpha1/tenant/workloads.rs b/src/types/v1alpha1/tenant/workloads.rs
index 81df872..250246a 100755
--- a/src/types/v1alpha1/tenant/workloads.rs
+++ b/src/types/v1alpha1/tenant/workloads.rs
@@ -23,6 +23,7 @@ use crate::types::v1alpha1::persistence::{
 use crate::types::v1alpha1::pool::Pool;
 use crate::types::v1alpha1::security_context::{
     MAX_KUBERNETES_ID, PodSecurityContextOverride, effective_run_as_non_root,
+    security_context_pair_delegates_to_platform,
 };
 use crate::types::v1alpha1::tls::{TlsPlan, http_probe};
 use k8s_openapi::DeepMerge;
@@ -342,17 +343,30 @@ fn apply_pod_security_context_override(
 fn explicit_pod_run_as_non_root(
     tenant: Option<&PodSecurityContextOverride>,
     pool: Option<&PodSecurityContextOverride>,
+    tenant_delegates: bool,
+    pool_delegates: bool,
 ) -> Option<bool> {
-    pool.and_then(|overrides| overrides.run_as_non_root)
-        .or_else(|| tenant.and_then(|overrides| overrides.run_as_non_root))
+    let mut explicit = None;
+    for (overrides, delegates) in [(tenant, tenant_delegates), (pool, pool_delegates)] {
+        let Some(overrides) = overrides else {
+            continue;
+        };
+        if delegates {
+            explicit = None;
+        } else if overrides.run_as_non_root.is_some() {
+            explicit = overrides.run_as_non_root;
+        }
+    }
+    explicit
 }
 
-fn effective_pod_security_context(
-    tenant: Option<&PodSecurityContextOverride>,
-    pool: Option<&PodSecurityContextOverride>,
-) -> corev1::PodSecurityContext {
-    let explicit_run_as_non_root = explicit_pod_run_as_non_root(tenant, pool);
-    let mut context = corev1::PodSecurityContext {
+struct EffectivePodSecurityContext {
+    context: corev1::PodSecurityContext,
+    operator_defaults_delegated: bool,
+}
+
+fn default_pod_security_context() -> corev1::PodSecurityContext {
+    corev1::PodSecurityContext {
         run_as_user: Some(DEFAULT_RUN_AS_USER),
         run_as_group: Some(DEFAULT_RUN_AS_GROUP),
         fs_group: Some(DEFAULT_FS_GROUP),
@@ -363,18 +377,56 @@ fn effective_pod_security_context(
             ..Default::default()
         }),
         ..Default::default()
-    };
+    }
+}
+
+fn platform_delegated_pod_security_context() -> corev1::PodSecurityContext {
+    corev1::PodSecurityContext {
+        // Match MinIO: retain the volume ownership optimization without constraining
+        // the UID/GID values assigned by an OpenShift SCC.
+        fs_group_change_policy: Some("OnRootMismatch".to_string()),
+        ..Default::default()
+    }
+}
 
-    for overrides in [tenant, pool].into_iter().flatten() {
-        apply_pod_security_context_override(&mut context, overrides);
+fn effective_pod_security_context(
+    tenant: Option<&PodSecurityContextOverride>,
+    pool: Option<&PodSecurityContextOverride>,
+    tenant_delegates: bool,
+    pool_delegates: bool,
+) -> EffectivePodSecurityContext {
+    let explicit_run_as_non_root =
+        explicit_pod_run_as_non_root(tenant, pool, tenant_delegates, pool_delegates);
+    let mut context = default_pod_security_context();
+    let mut operator_defaults_delegated = false;
+
+    for (overrides, delegates) in [(tenant, tenant_delegates), (pool, pool_delegates)] {
+        let Some(overrides) = overrides else {
+            continue;
+        };
+        if delegates {
+            context = platform_delegated_pod_security_context();
+            operator_defaults_delegated = true;
+        } else {
+            apply_pod_security_context_override(&mut context, overrides);
+        }
     }
 
-    context.run_as_non_root = Some(effective_run_as_non_root(
-        context.run_as_user,
-        explicit_run_as_non_root,
-    ));
+    // An exact empty pair is a platform delegation signal. Do not materialize the secure
+    // default again unless a later non-empty override supplies an identity.
+    if context.run_as_user.is_some() || explicit_run_as_non_root.is_some() {
+        context.run_as_non_root = Some(effective_run_as_non_root(
+            context.run_as_user,
+            explicit_run_as_non_root,
+        ));
+    }
 
-    context
+    EffectivePodSecurityContext {
+        context,
+        // A later partial override only fills its declared fields; every field erased by
+        // the empty-object barrier remains delegated to platform admission.
+        operator_defaults_delegated,
+    }
 }
 
 fn merge_container_security_context(
@@ -401,10 +453,10 @@ fn effective_container_security_context(
     tenant: Option<&corev1::SecurityContext>,
     pool: Option<&corev1::SecurityContext>,
     explicit_pod_run_as_non_root: Option<bool>,
+    tenant_delegates: bool,
+    pool_delegates: bool,
 ) -> corev1::SecurityContext {
-    let explicit_container_run_as_non_root = pool
-        .and_then(|overrides| overrides.run_as_non_root)
-        .or_else(|| tenant.and_then(|overrides| overrides.run_as_non_root));
+    let mut explicit_container_run_as_non_root = None;
     let mut context = corev1::SecurityContext {
         allow_privilege_escalation: Some(false),
         capabilities: Some(corev1::Capabilities {
@@ -414,8 +466,19 @@ fn effective_container_security_context(
         ..Default::default()
     };
 
-    for overrides in [tenant, pool].into_iter().flatten() {
-        merge_container_security_context(&mut context, overrides);
+    for (overrides, delegates) in [(tenant, tenant_delegates), (pool, pool_delegates)] {
+        let Some(overrides) = overrides else {
+            continue;
+        };
+        if delegates {
+            context = corev1::SecurityContext::default();
+            explicit_container_run_as_non_root = None;
+        } else {
+            merge_container_security_context(&mut context, overrides);
+            if overrides.run_as_non_root.is_some() {
+                explicit_container_run_as_non_root = overrides.run_as_non_root;
+            }
+        }
     }
 
     // A container UID overrides the Pod UID. When neither the container nor Pod explicitly
@@ -434,6 +497,7 @@ fn effective_container_security_context(
 struct EffectiveWorkloadSecurityContext {
     pod: corev1::PodSecurityContext,
     container: corev1::SecurityContext,
+    pod_operator_defaults_delegated: bool,
 }
 
 fn effective_workload_security_context(
@@ -442,14 +506,25 @@ fn effective_workload_security_context(
     tenant_container: Option<&corev1::SecurityContext>,
     pool_container: Option<&corev1::SecurityContext>,
 ) -> EffectiveWorkloadSecurityContext {
-    let explicit_pod_run_as_non_root = explicit_pod_run_as_non_root(tenant_pod, pool_pod);
+    // Require the MinIO/OpenShift pair at the same scope. A lone empty object can be left behind
+    // by legacy field-based clients and must retain the historical Operator-default behavior.
+    let tenant_delegates =
+        security_context_pair_delegates_to_platform(tenant_pod, tenant_container);
+    let pool_delegates = security_context_pair_delegates_to_platform(pool_pod, pool_container);
+    let explicit_pod_run_as_non_root =
+        explicit_pod_run_as_non_root(tenant_pod, pool_pod, tenant_delegates, pool_delegates);
+    let effective_pod =
+        effective_pod_security_context(tenant_pod, pool_pod, tenant_delegates, pool_delegates);
     EffectiveWorkloadSecurityContext {
-        pod: effective_pod_security_context(tenant_pod, pool_pod),
+        pod: effective_pod.context,
         container: effective_container_security_context(
             tenant_container,
             pool_container,
             explicit_pod_run_as_non_root,
+            tenant_delegates,
+            pool_delegates,
         ),
+        pod_operator_defaults_delegated: effective_pod.operator_defaults_delegated,
     }
 }
 
@@ -795,7 +870,12 @@ impl Tenant {
                 .or(security.pod.seccomp_profile.as_ref())
                 .map(|profile| profile.type_.as_str());
 
-            if seccomp_type != Some("RuntimeDefault") {
+            // OpenShift restricted SCCs can inject runtime/default after admission. Preserve
+            // the image compatibility gate when an empty Pod securityContext delegates the
+            // profile, even though the pre-admission StatefulSet has no explicit profile.
+            let platform_may_inject_runtime_default =
+                security.pod_operator_defaults_delegated && seccomp_type.is_none();
+            if seccomp_type != Some("RuntimeDefault") && !platform_may_inject_runtime_default {
                 continue;
             }
 
@@ -1338,6 +1418,7 @@ impl Tenant {
         let EffectiveWorkloadSecurityContext {
             pod: pod_security_context,
             container: container_security_context,
+            ..
         } = security;
 
         let container = corev1::Container {
@@ -3154,6 +3235,180 @@ mod tests {
         );
     }
 
+    #[test]
+    fn empty_tenant_security_contexts_delegate_defaults_to_the_platform() {
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        tenant.spec.security_context = Some(PodSecurityContextOverride::default());
+        tenant.spec.container_security_context = Some(corev1::SecurityContext::default());
+
+        let statefulset = tenant
+            .new_statefulset(&tenant.spec.pools[0])
+            .expect("empty contexts should render for platform admission");
+        let pod_spec = statefulset
+            .spec
+            .expect("StatefulSet should have spec")
+            .template
+            .spec
+            .expect("Pod template should have spec");
+        let pod_context = pod_spec
+            .security_context
+            .expect("Pod should have a delegated securityContext");
+
+        assert_eq!(pod_context.run_as_user, None);
+        assert_eq!(pod_context.run_as_group, None);
+        assert_eq!(pod_context.fs_group, None);
+        assert_eq!(pod_context.run_as_non_root, None);
+        assert_eq!(pod_context.seccomp_profile, None);
+        assert_eq!(
+            pod_context.fs_group_change_policy.as_deref(),
+            Some("OnRootMismatch")
+        );
+        assert_eq!(
+            pod_spec.containers[0].security_context,
+            Some(corev1::SecurityContext::default())
+        );
+    }
+
+    #[test]
+    fn lone_empty_tenant_pod_context_retains_operator_defaults() {
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        tenant.spec.security_context = Some(PodSecurityContextOverride::default());
+
+        let statefulset = tenant
+            .new_statefulset(&tenant.spec.pools[0])
+            .expect("legacy empty Pod context should retain defaults");
+        let pod_spec = statefulset
+            .spec
+            .expect("StatefulSet should have spec")
+            .template
+            .spec
+            .expect("Pod template should have spec");
+        let pod_context = pod_spec
+            .security_context
+            .expect("Pod should have a securityContext");
+
+        assert_eq!(pod_context.run_as_user, Some(DEFAULT_RUN_AS_USER));
+        assert_eq!(pod_context.run_as_group, Some(DEFAULT_RUN_AS_GROUP));
+        assert_eq!(pod_context.fs_group, Some(DEFAULT_FS_GROUP));
+        assert_eq!(pod_context.run_as_non_root, Some(true));
+        assert_eq!(
+            pod_context
+                .seccomp_profile
+                .as_ref()
+                .map(|profile| profile.type_.as_str()),
+            Some("RuntimeDefault")
+        );
+    }
+
+    #[test]
+    fn lone_empty_pool_container_context_retains_operator_defaults() {
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        tenant.spec.pools[0].container_security_context = Some(corev1::SecurityContext::default());
+
+        let statefulset = tenant
+            .new_statefulset(&tenant.spec.pools[0])
+            .expect("legacy empty container context should retain defaults");
+        let container_context = statefulset
+            .spec
+            .expect("StatefulSet should have spec")
+            .template
+            .spec
+            .expect("Pod template should have spec")
+            .containers[0]
+            .security_context
+            .clone()
+            .expect("RustFS container should have a securityContext");
+
+        assert_eq!(container_context.allow_privilege_escalation, Some(false));
+        assert_eq!(
+            container_context.capabilities.and_then(|caps| caps.drop),
+            Some(vec!["ALL".to_string()])
+        );
+    }
+
+    #[test]
+    fn empty_pool_security_contexts_block_tenant_and_operator_defaults() {
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        tenant.spec.security_context = Some(PodSecurityContextOverride {
+            run_as_user: Some(20_001),
+            run_as_group: Some(20_002),
+            fs_group: Some(20_003),
+            run_as_non_root: Some(true),
+            seccomp_profile: Some(runtime_default_seccomp_profile()),
+        });
+        tenant.spec.container_security_context = Some(corev1::SecurityContext {
+            read_only_root_filesystem: Some(true),
+            ..Default::default()
+        });
+        tenant.spec.pools[0].security_context = Some(PodSecurityContextOverride::default());
+        tenant.spec.pools[0].container_security_context = Some(corev1::SecurityContext::default());
+
+        let statefulset = tenant
+            .new_statefulset(&tenant.spec.pools[0])
+            .expect("pool delegation should override tenant defaults");
+        let pod_spec = statefulset
+            .spec
+            .expect("StatefulSet should have spec")
+            .template
+            .spec
+            .expect("Pod template should have spec");
+        let pod_context = pod_spec
+            .security_context
+            .expect("Pod should have a delegated securityContext");
+
+        assert_eq!(pod_context.run_as_user, None);
+        assert_eq!(pod_context.run_as_group, None);
+        assert_eq!(pod_context.fs_group, None);
+        assert_eq!(pod_context.run_as_non_root, None);
+        assert_eq!(pod_context.seccomp_profile, None);
+        assert_eq!(
+            pod_spec.containers[0].security_context,
+            Some(corev1::SecurityContext::default())
+        );
+    }
+
+    #[test]
+    fn partial_pool_override_after_tenant_barrier_only_sets_declared_fields() {
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        tenant.spec.security_context = Some(PodSecurityContextOverride::default());
+        tenant.spec.container_security_context = Some(corev1::SecurityContext::default());
+        tenant.spec.pools[0].security_context = Some(PodSecurityContextOverride {
+            run_as_user: Some(20_001),
+            ..Default::default()
+        });
+        tenant.spec.pools[0].container_security_context = Some(corev1::SecurityContext {
+            run_as_user: Some(0),
+            ..Default::default()
+        });
+
+        let statefulset = tenant
+            .new_statefulset(&tenant.spec.pools[0])
+            .expect("partial pool overrides should merge onto the delegated baseline");
+        let pod_spec = statefulset
+            .spec
+            .expect("StatefulSet should have spec")
+            .template
+            .spec
+            .expect("Pod template should have spec");
+        let pod_context = pod_spec
+            .security_context
+            .expect("Pod should have a securityContext");
+        let container_context = pod_spec.containers[0]
+            .security_context
+            .as_ref()
+            .expect("Container should have a securityContext");
+
+        assert_eq!(pod_context.run_as_user, Some(20_001));
+        assert_eq!(pod_context.run_as_non_root, Some(true));
+        assert_eq!(pod_context.run_as_group, None);
+        assert_eq!(pod_context.fs_group, None);
+        assert_eq!(pod_context.seccomp_profile, None);
+        assert_eq!(container_context.run_as_user, Some(0));
+        assert_eq!(container_context.run_as_non_root, Some(false));
+        assert_eq!(container_context.allow_privilege_escalation, None);
+        assert_eq!(container_context.capabilities, None);
+    }
+
     #[test]
     fn known_tokio_io_uring_images_are_blocked_with_runtime_default_seccomp() {
         for image in [
@@ -3195,6 +3450,78 @@ mod tests {
         ));
     }
 
+    #[test]
+    fn delegated_seccomp_still_blocks_known_incompatible_images() {
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        tenant.spec.image = Some("rustfs/rustfs:1.0.0-beta.8".to_string());
+        tenant.spec.security_context = Some(PodSecurityContextOverride::default());
+        tenant.spec.container_security_context = Some(corev1::SecurityContext::default());
+
+        let error = tenant
+            .validate_workload_security_compatibility()
+            .expect_err("an SCC may inject RuntimeDefault after admission");
+
+        assert!(matches!(
+            error,
+            crate::types::error::Error::WorkloadSecurityIncompatible { message, .. }
+                if message.contains("rustfs/rustfs#4364")
+                    && message.contains("pool-0")
+        ));
+    }
+
+    #[test]
+    fn pool_barrier_restores_delegated_seccomp_image_gate() {
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        tenant.spec.image = Some("rustfs/rustfs:1.0.0-beta.8".to_string());
+        tenant.spec.security_context = Some(PodSecurityContextOverride {
+            seccomp_profile: Some(corev1::SeccompProfile {
+                type_: "Unconfined".to_string(),
+                ..Default::default()
+            }),
+            ..Default::default()
+        });
+        tenant.spec.pools[0].security_context = Some(PodSecurityContextOverride::default());
+        tenant.spec.pools[0].container_security_context = Some(corev1::SecurityContext::default());
+
+        let error = tenant
+            .validate_workload_security_compatibility()
+            .expect_err("pool delegation should block the inherited Unconfined profile");
+
+        assert!(matches!(
+            error,
+            crate::types::error::Error::WorkloadSecurityIncompatible { message, .. }
+                if message.contains("rustfs/rustfs#4364")
+                    && message.contains("pool-0")
+        ));
+    }
+
+    #[test]
+    fn explicit_pool_seccomp_after_tenant_barrier_overrides_delegated_gate() {
+        for profile in [
+            corev1::SeccompProfile {
+                type_: "Unconfined".to_string(),
+                ..Default::default()
+            },
+            corev1::SeccompProfile {
+                type_: "Localhost".to_string(),
+                localhost_profile: Some("profiles/rustfs-io-uring.json".to_string()),
+            },
+        ] {
+            let mut tenant = crate::tests::create_test_tenant(None, None);
+            tenant.spec.image = Some("rustfs/rustfs:1.0.0-beta.8".to_string());
+            tenant.spec.security_context = Some(PodSecurityContextOverride::default());
+            tenant.spec.container_security_context = Some(corev1::SecurityContext::default());
+            tenant.spec.pools[0].security_context = Some(PodSecurityContextOverride {
+                seccomp_profile: Some(profile),
+                ..Default::default()
+            });
+
+            tenant
+                .validate_workload_security_compatibility()
+                .expect("an explicit compatible pool profile should override SCC injection risk");
+        }
+    }
+
     #[test]
     fn compatible_localhost_profile_allows_legacy_rustfs_image() {
         for image in [
@@ -4361,6 +4688,48 @@ mod tests {
         assert!(needs_update, "Container security changes should roll Pods");
     }
 
+    #[test]
+    fn empty_security_context_delegation_triggers_statefulset_update() {
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        let statefulset = tenant
+            .new_statefulset(&tenant.spec.pools[0])
+            .expect("Should create StatefulSet with defaults");
+
+        tenant.spec.security_context = Some(PodSecurityContextOverride::default());
+        tenant.spec.container_security_context = Some(corev1::SecurityContext::default());
+
+        let needs_update = tenant
+            .statefulset_needs_update(&statefulset, &tenant.spec.pools[0])
+            .expect("Should compare delegated security contexts");
+
+        assert!(
+            needs_update,
+            "Delegating UID/GID and container defaults should roll Pods"
+        );
+    }
+
+    #[test]
+    fn removing_empty_delegation_triggers_statefulset_update() {
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        tenant.spec.security_context = Some(PodSecurityContextOverride::default());
+        tenant.spec.container_security_context = Some(corev1::SecurityContext::default());
+        let statefulset = tenant
+            .new_statefulset(&tenant.spec.pools[0])
+            .expect("Should create delegated StatefulSet");
+
+        tenant.spec.security_context = None;
+        tenant.spec.container_security_context = None;
+
+        let needs_update = tenant
+            .statefulset_needs_update(&statefulset, &tenant.spec.pools[0])
+            .expect("Should compare restored operator defaults");
+
+        assert!(
+            needs_update,
+            "Removing delegation should restore defaults and roll Pods"
+        );
+    }
+
     #[test]
     fn test_statefulset_without_container_security_defaults_needs_update() {
         let tenant = crate::tests::create_test_tenant(None, None);