diff --git a/clusters/base/apps/woodpecker/helmrelease.yaml b/clusters/base/apps/woodpecker/helmrelease.yaml
index b60e814..bf621f7 100644
--- a/clusters/base/apps/woodpecker/helmrelease.yaml
+++ b/clusters/base/apps/woodpecker/helmrelease.yaml
@@ -11,6 +11,11 @@ spec:
   driftDetection:
     mode: enabled
   values:
+    defaultPodOptions:
+      securityContext:
+        fsGroup: 1000 # non-root image, fresh longhorn volume is root-owned
+        fsGroupChangePolicy: OnRootMismatch
+
     controllers:
       server:
         replicas: 1
@@ -47,7 +52,7 @@ spec:
               repository: woodpeckerci/woodpecker-agent
               tag: v3.8.0
             env:
-              WOODPECKER_SERVER: woodpecker-server:9000
+              WOODPECKER_SERVER: woodpecker:9000
               WOODPECKER_BACKEND: kubernetes
               WOODPECKER_BACKEND_K8S_NAMESPACE: ci
               WOODPECKER_BACKEND_K8S_STORAGE_CLASS: longhorn-no-retain